CC6.5 Protecting data on assets until disposal

Logical and physical protection over physical assets is withdrawn only once the data and software on them can no longer be read or recovered and are no longer needed. Points of focus: data and software on equipment due for disposal are identified and made unreadable; and, as revised in 2022, data and software are removed, deleted or made inaccessible on any device the organisation, its vendors or its staff own once they are no longer needed there or the device leaves the organisation's control. (Device recovery from leavers sits under CC6.4.)

Source: SOC 2 (2017 Trust Services Criteria), CC6.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.