AM-04 Decommissioning of Hardware
Require documented approval under the applicable policies before hardware supporting production cloud service components is withdrawn from use, and make withdrawal include complete and permanent erasure of the data or pr
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Erasure tool output recording the method used and the verification result · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Retirement approvals for hardware withdrawn from the production estate during the period · Document repository
- Sanitisation or destruction certificates that identify the media by serial number · Policy repository / GRC workspace
- Chain of custody documentation for media released to a disposal contractor · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Failed drives returned to the vendor under warranty without prior sanitisation
- Destruction certificates do not identify which specific media they cover
- Erasure carried out but the verification step is missing from the record
- Equipment physically removed before the withdrawal approval was obtained
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAM-03 Commissioning of Hardware · AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets