8.10 Information deletion
Information held in systems, devices or any other storage media is to be deleted once it is no longer needed. Purpose: avoid sensitive information being exposed unnecessarily and meet legal, regulatory and contractual deletion requirements. Guidance: sensitive information should not be kept longer than necessary, to limit unwanted disclosure. When deleting from systems, applications and services, choose a method such as electronic overwriting or cryptographic erasure that fits business needs and the law, record the results as evidence, and obtain evidence of deletion from any deletion service provider. Where an outside party holds the organization's information for it, consider writing deletion requirements into the agreements for the period of service and its end. In line with the data retention policy and the law, delete sensitive information that is no longer needed by configuring systems to destroy it securely (for example after a retention period or on a subject access request); clearing out old versions, duplicates and temporary files in every location; using approved secure deletion software so that specialist recovery or forensic tools cannot retrieve it; using approved, certified disposal providers; and using mechanisms suited to the media, such as degaussing magnetic drives. For cloud services, check whether the provider's deletion method is acceptable and use it or ask the provider to delete, automating deletion under policy where possible, with logs to track or verify deletion depending on sensitivity. Remove hard drives and memory from equipment returned to vendors before it leaves the premises. Because some devices such as smartphones can only be securely wiped by destruction or built-in reset functions, choose the method according to the classification of what they hold, and apply 7.14 when destroying devices physically. A formal deletion record helps when investigating a possible leak. Other information: ISO/IEC 27017 addresses user data deletion in cloud services and ISO/IEC 27555 addresses PII deletion.
Source: ISO/IEC 27002:2022, 8.10. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Configuration of automated deletion after retention periods or on data subject requests · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Deletion logs or certificates as evidence, including from deletion service providers · SIEM / log platform
governing documentDocuments that govern the control
- The data retention topic-specific policy with deletion triggers per information type · Policy repository / GRC workspace
- Approved secure deletion tools and methods matched to media type (overwriting, cryptographic erasure, degaussing) · Policy repository / GRC workspace
- Contract clauses requiring deletion by third parties and cloud providers during and at the end of service, and confirmation records · Vendor register / contract repository
- Procedure for removing storage and memory from equipment returned to vendors · Vendor register / contract repository
First move
Common gaps auditors find
- Information is deleted from the primary system but copies remain in backups, exports and temporary files
- No evidence of deletion is kept, so completion cannot be demonstrated
- Cloud providers' deletion methods are accepted without assessment
- Devices go back to vendors under warranty with drives still installed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet