Secure disposal or re-use of equipment

What the requirement asks

Before equipment containing storage media is disposed of or reused, it is to be checked to confirm that sensitive data and licensed software have been removed or securely overwritten. Purpose: stop information leaking from equipment that is disposed of or reused. Guidance: check whether equipment contains storage media before disposal or reuse. Where media hold confidential or copyright material, either the media are destroyed physically or the data is destroyed, deleted or overwritten with techniques that make it unrecoverable instead of a standard delete (see 7.10 for media disposal and 8.10 for deletion). Remove labels and markings that identify the organization or show classification, owner, system or network before disposal, including resale or charitable donation. At the end of a lease or when moving out, consider removing security controls such as access control or surveillance equipment, depending on lease terms to restore the premises, the chance that systems holding sensitive data are left behind such as user access lists or video for the next tenant, and whether the controls can be reused elsewhere. Other information: damaged equipment with storage media may need a risk assessment to decide between destruction and repair or discard; careless disposal or reuse compromises information; full-disk encryption reduces disclosure risk if it covers the whole disk including slack space and swap, uses keys long enough to resist brute force, and keeps the keys confidential and off the same disk (8.24); overwriting techniques depend on the media technology and classification, so tools should be checked for suitability; ISO/IEC 27040 covers media sanitization methods. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Disposal and reuse need a data destruction record. The guidance asks for the method, the verification, the certificate and the asset update.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized and one live sample together.

Evidence an assessor asks for

• Equipment disposalA disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized
• Equipment disposalSanitization or destruction certificates identifying each device, method used and verifier
• Equipment disposalEvidence that sanitization tools were validated for the media technology (for example SSD versus HDD)
• Equipment disposalRecords showing organizational labels and classification markings removed before resale or donation
• Equipment disposalFull-disk encryption configuration and key management evidence for devices being redeployed
• Equipment disposalPremises exit checklists covering removal of access control and surveillance systems holding sensitive data

The question an assessor will ask

An assessor will ask for A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized, then trace it to the system it protects. For A.7.14 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Devices are resold or donated after a standard format only
• SSDs are wiped with tools designed for spinning disks
• Printers, copiers and network devices with internal storage are overlooked
• Access control systems with user lists are left behind at the end of a lease

Before the next audit

Before the next audit, check one live sample for this gap: devices are resold or donated after a standard format only.