The entity disposes of confidential information to meet the entity’s objectives related to confidentiality
Procedures are in place to identify confidential information requiring destruction when the end of the retention period is reached
Procedures are in place to erase or otherwise destroy confidential information that has been identified for destruction.