01 / THIS YEAR’S CAMPAIGNFour good habits, all aimed at data in use
The 2026 Cybersecurity Awareness Month is the campaign’s 23rd year. It is led by the National Cybersecurity Alliance in partnership with CISA, under the theme “Don’t Make It Easy for Them,” and it organizes its toolkit around four behaviors:
- use strong, unique passwords;
- turn on multi-factor authentication;
- keep devices updated; and
- scrutinize suspicious messages before clicking.
These are the right four. They address the way most intrusions still begin, they are achievable for every organization and household, and the campaign’s framing — security as a daily practice rather than a one-time project — is the one that actually changes outcomes. Nothing here argues with any of it.
What the four share is a point in time. Each protects data while it is in use: on a live account, a running device, an inbox someone is reading this morning. The lifecycle continues past that point. Devices are retired, accounts are closed, employees leave, vendor contracts end, and in each case the data involved usually still exists somewhere. Awareness campaigns rarely reach that stage, partly because it is less dramatic than a phishing email and partly because it tends to belong to a different department.
02 / THE FRAMEWORKS ALREADY SAY SOEnd of life is baseline, not advanced
It would be easy to treat secure disposal as a specialist concern for regulated industries. The two frameworks most security programs are built on do not treat it that way.
In NIST Cybersecurity Framework 2.0, subcategory ID.AM-08 in the asset management category reads: “Systems, hardware, software, services, and data are managed throughout their life cycles.” NIST’s implementation examples for it are specific. Among them: “Securely sanitize data storage when hardware is being retired, decommissioned, reassigned, or sent for repairs or replacement,” and “Securely destroy stored data based on the organization’s data retention policy using the prescribed destruction method, and keep and manage a record of the destructions.” The neighboring subcategory, ID.AM-01, is the hardware inventory those records reconcile against.
In the CIS Critical Security Controls v8.1, Safeguard 3.5, Securely Dispose of Data, reads: “Securely dispose of data as outlined in the enterprise’s data management process. Ensure the disposal process and method are commensurate with the data sensitivity.” It is in Implementation Group 1, the set CIS describes as essential cyber hygiene for every enterprise regardless of size.
03 / THE SAME FOUR HABITS, AT END OF LIFEDon’t make it easy for them after the device is gone, either
The campaign’s theme works at the end of the lifecycle as well as the beginning. Each of the four habits has an end-of-life counterpart:
| Habit | While in use | At end of life |
|---|---|---|
| Passwords | Strong, unique credentials for every account | Retired devices hold saved passwords, session tokens, and wireless keys. Sign out, revoke tokens, and rotate any shared secret the device stored before it leaves your control. |
| Multi-factor authentication | A second factor on every account that supports one | Phones and hardware keys belonging to departed users stay registered as authenticators until someone removes them. Deregister them at offboarding, not at the next audit. |
| Updates | Patch promptly and automatically | A device that can no longer receive security updates has reached a retirement decision. Commercial Windows 10 Extended Security Updates year one ended October 13, 2026. |
| Suspicious messages | Pause before clicking | Apply the same skepticism to disposal offers. “Free pickup” with no certificate, no chain of custody, and no certified downstream is a message worth a second look. |
Two of these are identity problems as much as hardware problems. A sanitized drive protects the data on a device; de-provisioning protects the systems that device could still reach. The offboarding gap diagnostic scores how well an organization closes both when an employee leaves, and Offboarded, Not Forgotten is the thirty-second version. The update row connects to the Windows 10 ESU brief; the last row to what a free pickup typically leaves out.
04 / WHAT RECENT EVENTS ILLUSTRATEData that outlived its purpose
Several stories this fall made the same point from different directions. In September, a criminal marketplace offered more than 153 million driver’s license scans traced to an identity-verification vendor’s cloud; the verification each scan supported took seconds, and the images were retained (our IDScan brief covers the reported facts). In a separate and still-disputed matter, researchers alleged that a manufacturer’s smart televisions collect more audio and network data than owners understand, which the manufacturer denies; whichever way that resolves, the devices involved hold credentials and logs in storage a factory reset does not clear (the connected-device brief). And the oldest version of the story, a leased copier returned with years of scanned documents on its drive, keeps recurring.
None of these is primarily a phishing or password story. Each is about data that existed after its purpose had ended, in a place nobody was watching. That is the stage the lifecycle controls exist to cover.
05 / A LIFECYCLE CHECKFour weeks, four checks, for the rest of October
A practical way to use the month without starting a new program:
- Week one: the storeroom. Walk the closets, storerooms, and desks where retired equipment accumulates. Count the data-bearing devices, record their serials, and decide a disposition date for each (The Storeroom Problem).
- Week two: the certificates. Take the last 12 months of certificates of destruction and reconcile them against the assets marked retired. Every serial should appear on both sides; the exceptions are the gaps.
- Week three: one dataset. Pick one high-sensitivity dataset — scanned IDs, former employees’ files, an old customer export — and confirm it is actually being deleted on the schedule your retention policy says it is.
- Week four: the vendors. For every vendor that stores your data or handles your retired equipment, confirm what it retains and for how long, and verify disposal certifications such as NAID AAA and R2v3 in the issuers’ directories rather than on a website.
The Data Destruction Field Manual covers the method side of each check: what NIST SP 800-88 calls for by media type, and what a certificate should state.
CyberCrunch handles the hardware end of this lifecycle for organizations of every size: serialized pickup, on-site or facility-based sanitization and destruction under NIST SP 800-88, and certificates that reconcile to your asset records. Secure disposition is one control among many in a security program, and it is the one that makes sure the others do not end at the loading dock.
06 / FAQEnd-of-life security FAQ
What is the theme of Cybersecurity Awareness Month 2026?
The 2026 campaign, the 23rd annual Cybersecurity Awareness Month, is led by the National Cybersecurity Alliance in partnership with the Cybersecurity and Infrastructure Security Agency under the theme “Don’t Make It Easy for Them.” Its toolkit centers on four everyday behaviors: using strong, unique passwords, turning on multi-factor authentication, keeping devices updated, and scrutinizing suspicious messages before clicking. The campaign frames cybersecurity as a daily practice rather than a one-time fix.
Where does data disposal appear in the NIST Cybersecurity Framework 2.0?
Most directly in the Identify function's asset management category. Subcategory ID.AM-08 states that systems, hardware, software, services, and data are managed throughout their life cycles, and NIST's implementation examples for it include securely sanitizing data storage when hardware is retired, decommissioned, reassigned, or sent for repair or replacement, and securely destroying stored data according to the retention policy while keeping a record of the destructions. ID.AM-01, the hardware inventory, is the list those records reconcile against.
Is secure data disposal part of the CIS Controls' basic hygiene?
Yes. CIS Controls v8.1 Safeguard 3.5, Securely Dispose of Data, calls for disposing of data as outlined in the enterprise's data management process, with a disposal process and method commensurate with the data's sensitivity. It sits in Implementation Group 1, the set CIS describes as essential cyber hygiene for every enterprise, which means it is not reserved for large or highly regulated organizations.
What should happen to MFA devices and saved credentials when a device is retired or an employee leaves?
They should be removed from the identity system before the device leaves your control, not after. That means signing the device out of accounts, revoking session and refresh tokens, removing it from mobile device management, deregistering any authenticator app or hardware key associated with a departed user, and rotating shared secrets the device stored, such as a wireless key. A sanitized drive protects the data on the device; de-provisioning protects the systems the device could still reach.
How often should an organization review its data retention and disposal practices?
At least annually, and whenever something changes the picture: a new system, a merger, a refresh, an office move, a new vendor that stores data on your behalf. A useful annual check is to reconcile the last year of certificates of destruction against the assets marked retired, confirm that one high-sensitivity dataset is actually being deleted on schedule, and verify that disposal vendors' certifications are current in the issuers' directories. October is a convenient time to do it.
THE LAST CONTROL IN THE LIFECYCLE
Secure disposition you can reconcile, device by device
Serialized pickup, NIST SP 800-88 sanitization or destruction, and a certificate for every data-bearing device — from a provider certified to NAID AAA, R2v3, RIOS, and PA DEP, serving organizations across all 50 states.
This brief reflects public sources as of October 5, 2026: the National Cybersecurity Alliance’s announcement of the 2026 Cybersecurity Awareness Month campaign, NIST Cybersecurity Framework 2.0 and its implementation examples, the CIS Critical Security Controls v8.1, and Microsoft’s published Windows 10 Extended Security Updates schedule. Quotations from the frameworks are reproduced for reference; consult the current published versions. References to the IDScan incident and the smart TV dispute summarize public reporting described in the linked briefs; the smart TV allegations are disputed by the manufacturer and have not been independently verified. CyberCrunch is not affiliated with the National Cybersecurity Alliance or CISA. CyberCrunch credential statements reflect certificates held at the time of publication.