Revise control 0301.09O1ORGANIZATIONAL.123 (Laptops are not Classified as Portable)
In section "7.2.16 Portable Media" in the newly released Assessment Handbook, there is a note stating "For purposes of a HITRUST assessment, laptops are not classified as portable media."
However, control 0301.09O1ORGANIZATIONAL.123 is described as saying:
The organization, based on the data classification level, registers media (including laptops) prior to use, places reasonable restrictions on how such media are used, and provides an appropriate level of physical and logical protection (including encryption) for media containing covered information until properly destroyed or sanitized.
If laptops are not classified as portable media, can all references to "laptops" be removed from the control description and Illustrative Procedures.
