System output-whether in electronic form or hard copy reports-can contain sensitive or confidential information. Unnecessary output increases operating expense and reduces the efficiency of IT operations. Management should analyze output and implement necessary controls to limit the production of unnecessary confidential data output. Automated report management software and similar tools can facilitate the implementation of output controls. Management should also develop specific physical and logistical procedures for hardcopy and electronic report distribution to ensure a secure environment including assessing the use of locked containers, limited access mailboxes, or secure communications. There should also be appropriate controls and procedures to insure the proper disposal or destruction of output whether hardcopy or electronic format. For example, hardcopy output should be shredded to a level to prevent reconstruction of information.
Information Distribution and Transmission