7.14 Secure disposal or re-use of equipment
Before equipment containing storage media is disposed of or reused, it is to be checked to confirm that sensitive data and licensed software have been removed or securely overwritten. Purpose: stop information leaking from equipment that is disposed of or reused. Guidance: check whether equipment contains storage media before disposal or reuse. Where media hold confidential or copyright material, either the media are destroyed physically or the data is destroyed, deleted or overwritten with techniques that make it unrecoverable instead of a standard delete (see 7.10 for media disposal and 8.10 for deletion). Remove labels and markings that identify the organization or show classification, owner, system or network before disposal, including resale or charitable donation. At the end of a lease or when moving out, consider removing security controls such as access control or surveillance equipment, depending on lease terms to restore the premises, the chance that systems holding sensitive data are left behind such as user access lists or video for the next tenant, and whether the controls can be reused elsewhere. Other information: damaged equipment with storage media may need a risk assessment to decide between destruction and repair or discard; careless disposal or reuse compromises information; full-disk encryption reduces disclosure risk if it covers the whole disk including slack space and swap, uses keys long enough to resist brute force, and keeps the keys confidential and off the same disk (8.24); overwriting techniques depend on the media technology and classification, so tools should be checked for suitability; ISO/IEC 27040 covers media sanitization methods.
Source: ISO/IEC 27002:2022, 7.14. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Full-disk encryption configuration and key management evidence for devices being redeployed · Key management / PKI
periodic reviewEvidence produced at each review
- Evidence that sanitization tools were validated for the media technology (for example SSD versus HDD) · Data governance / DLP tooling
- Records showing organizational labels and classification markings removed before resale or donation · Data governance / DLP tooling
governing documentDocuments that govern the control
- A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized · Policy repository / GRC workspace
- Sanitization or destruction certificates identifying each device, method used and verifier · Policy repository / GRC workspace
- Premises exit checklists covering removal of access control and surveillance systems holding sensitive data · Policy repository / GRC workspace
First move
Common gaps auditors find
- Devices are resold or donated after a standard format only
- SSDs are wiped with tools designed for spinning disks
- Printers, copiers and network devices with internal storage are overlooked
- Access control systems with user lists are left behind at the end of a lease
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet