<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-lifecycle-audit
description: >-
  Audit the complete data lifecycle from creation through retention to secure
  deletion, verifying that data governance policies are enforced at every stage
  and identifying compliance gaps in classification, retention, and disposal.
domain: cybersecurity
subdomain: data-security
tags:
  - data-lifecycle
  - data-governance
  - retention-audit
  - secure-deletion
  - compliance
  - data-classification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Data Lifecycle Audit

## Overview

Audit the complete data lifecycle from creation through retention to secure
deletion, verifying that data governance policies are enforced at every stage
and identifying compliance gaps in classification, retention, and disposal.

Mode: `[MODE: BLUE]` — Performing Data Lifecycle Audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action audit --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action retention --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action disposal --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action audit --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
