ASTM E2674-09

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E2674 − 09
StandardPractice for
Assessment of Impact of Mobile Data Storage Device
1
(MDSD) Loss
This standard is issued under the fixed designation E2674; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope rity (EMPM) Model
E2495 Practice for Prioritizing Asset Resources in
1.1 This practice describes a methodology for assessing and
Acquisition, Utilization, and Disposition
quantifying the impact of the loss of mobile data storage
E2499 Practice for Classification ofAsset Physical Location
devices (MDSDs), for example, thumb drives, auxiliary hard
Information
drives, and other property containing personally identifiable
E2608 Practice for Equipment Control Matrix (ECM)
information or other entity sensitive information.
1.2 This practice is based on two concepts:
3. Terminology
1.2.1 Identifying the MDSDs that pose the greatest risk to
3.1 Definitions—For definitions relating to property and
the organization based on both the information that is stored on
asset management, refer to Terminology E2135.
them and the location in which they are used, and
3.1.1 compliance impact, n—consequence of loss of control
1.2.2 Determining the impact of the potential loss of spe-
characterized by negative compliance with applicable laws,
cific MDSDs. In general, this impact assessment is best
regulations, or other relevant internal or external guidance that
practiced as a part of a larger risk management process. While
does not rise to the level of an operational impact. (E2608)
this practice does not address this larger topic, it may inform
other risk management standards.
3.1.2 consequence, n—the effect of actions (something that
logically or naturally follows from an action or condition).
1.3 This practice is intended to be applicable and appropri-
ate for all asset-holding entities.
3.1.3 equipment control classes (ECCs), n— classifications
or groupings of equipment based on the consequences of the
1.4 In accordance with the provisions of Practice E2279,
loss of control of the equipment. (E2608)
this practice clarifies and enables effective and efficient control
and tracking of equipment.
3.1.4 operational impact, n—consequence of loss of control
1.5 This standard does not purport to address all of the
characterized by negative operational impact that does not rise
safety concerns, if any, associated with its use. It is the
to the level of a personal or societal safety or security impact.
responsibility of the user of this standard to establish appro-
(E2608)
priate safety and health practices and determine the applica-
3.1.5 organizational impact, n—objects that affect or influ-
bility of regulatory limitations prior to use.
ence the capability of an entity, especially in a significant or
undesirable manner.
2. Referenced Documents
2
3.1.6 personal safety/security consequence,
2.1 ASTM Standards:
n—consequence of loss of control characterized by negative
E2135 Terminology for Property and Asset Management
personal safety or security impact that does not rise to the level
E2279 Practice for Establishing the Guiding Principles of
of a societal safety or security impact. (E2608)
Property Management
E2452 Practice for Equipment Management Process Matu-
3.1.7 probability, n—or chance that something is the case or
will happen.
3.1.8 risk, n—concept that denotes a potential negative
1
This practice is under the jurisdiction of ASTM Committee E53 on Asset
impact.
Management and is the direct responsibility of Subcommittee E53.02 on Data
Management.
3.1.9 risk assessment, n—determination of the quantitative
Current edition approved Feb. 1, 2009. Published February 2009. DOI: 10.1520/
E2674-09. or qualitative value of risk related to a concrete situation and a
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
recognized threat.
contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
3.1.9.1 Discussion—It is considered as the initial and a
Standards volume information, refer to the standard’s Document Summary page on
the ASTM website. recurring step in a risk management process.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
E2674 − 09
3.1.10 risk management, n—structured approach to manag- quences of their loss in accordance with the section on
ing uncertainty through risk assessment, developing strategies Management of Property of Practice E2279.
tomanageit,andmitigationofriskusingmanagerialresources.
4.4 This practice encourages an inclus
...