What this control covers
Ensures permanent deletion of customer data, metadata, and backups upon contract termination per PI-02 agreements. Uses forensic-resistant methods to prevent data recovery, protecting cloud customer data confidentiality post-service.
Why it matters
A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Google Workspace
Google Vault retention rules cover Gmail/Drive/Chat; combine with periodic third-party backups (e.g., Spanning, Backupify) for full restore-by-user.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Secure deletion of data.
Quick checklist
- Interfaces — Agreements / - Configuration
- Security — Agreements / - Configuration
- Confidentiality — Agreements / - Configuration
- Data — Agreements / - Configuration
- Secure — Agreements / - Configuration
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- Ensure Backup Data in Recovery Services Vaults Is Encrypted Using Customer-Managed Keys (CMK)
- Ensure EBS Volumes Attached to an EC2 Instance Are Marked for Deletion Upon Instance Termination
- Enable Transparent Data Encryption with Customer-Managed Keys on Azure SQL Servers for Enhanced Data Security