ISO 27001 Media and Equipment Disposal: Evidence That Data Is Gone

Disposal is complete only when the organisation can show that information is no longer recoverable to an unacceptable degree and that the asset followed an authorised path. Moving a laptop to a storeroom, deleting files, formatting a drive or receiving a supplier certificate may be steps, but none is automatically sufficient.

ISO/IEC 27001:2022 places disposal and reuse across several controls. A.7.14 concerns secure disposal or reuse of equipment, A.7.10 concerns storage media, and A.8.10 concerns information deletion. The organisation should select methods through risk assessment, legal duties, technology and intended destination.

Define what enters the disposal process

The scope should include more than obvious hard drives. Information may remain in:

• laptops, desktops and servers;
• solid-state drives and removable media;
• mobile phones and tablets;
• printers, copiers and multifunction devices;
• network appliances and security equipment;
• backup media and storage arrays;
• industrial, medical or building-control devices;
• cameras and recorders;
• cloud-hosted resources returned to a provider; and
• paper records and labels attached to equipment.

Some devices store configurations, credentials, certificates, logs or cached data even when they are not treated as storage products. Asset owners and technical specialists should identify these less visible locations before authorising release.

The asset inventory and ownership guide explains how to connect assets to accountable owners and lifecycle status.

Decide whether to reuse, return, resell, recycle or destroy

The destination shapes the risk. Internal reassignment may require removal of one user’s data and access while preserving the device. External resale transfers control beyond the organisation. Lease return may be governed by contract. Destruction prevents reuse but creates environmental and evidence considerations.

For each disposal class, define:

• information types and sensitivity;
• storage technology and condition;
• legal or contractual retention restrictions;
• sanitisation or destruction method;
• verification method;
• custody and transport controls;
• responsible approver;
• evidence to retain; and
• environmental disposal route.

Do not let financial recovery override risk. Equally, do not destroy usable equipment when verified sanitisation supports safe reuse. The decision should be consistent and documented.

Select a method that matches the technology

Common approaches include logical clearing, cryptographic erasure, physical destruction and return to a controlled provider. The correct method depends on whether the device functions, how it stores data, whether encryption keys were controlled, the likelihood of advanced recovery and what happens next.

Simple file deletion usually removes references rather than all underlying data. A factory reset may not cover removable storage, hidden partitions or damaged components. Overwriting methods developed for magnetic media may not behave the same way on flash storage because of wear levelling and inaccessible blocks.

Technical owners should maintain approved methods for device classes and review them as technology changes. Where no method can be verified, physical destruction may be necessary. Destruction should reduce the media sufficiently for the assessed threat and information sensitivity, while meeting environmental and safety obligations.

Treat cryptographic erasure as a controlled process

Cryptographic erasure can make encrypted information inaccessible by securely destroying the relevant keys. It is credible only when:

• encryption covered the intended data before disposal;
• keys were strong and separately controlled;
• no usable key copies remain;
• backups or replicas are addressed;
• the key-destruction event is recorded; and
• the organisation can demonstrate the device’s encryption state.

Turning on encryption immediately before disposal does not necessarily protect data previously written in clear form. Key management evidence is central to the assurance claim.

Control custody until completion

Assets waiting for disposal still contain information. Use segregated storage, restricted access, inventory reconciliation and tamper protection according to risk. Record each handover, including date, asset identity, sender, recipient, quantity and condition.

Transport should address loss, substitution and unauthorised access. For higher-risk loads, use sealed containers, tracked vehicles or witnessed transfer. Investigate discrepancies rather than adjusting the inventory without explanation.

The paper-record security guide describes related custody and destruction considerations for physical documents.

Govern disposal suppliers

Outsourcing an activity does not outsource accountability. Evaluate the supplier’s method, facilities, personnel controls, transport, subcontractors, incident reporting, evidence and environmental authorisations. Contracts should define:

• accepted asset and media types;
• approved sanitisation or destruction outcomes;
• chain-of-custody responsibilities;
• verification and witnessing rights;
• handling of failed or unprocessable items;
• incident notification;
• subcontracting restrictions;
• record content and retention; and
• return or final disposition of residual material.

Sample supplier evidence and observe performance when risk justifies it. A certificate covering “one batch” is weak if the organisation cannot reconcile the batch to specific assets or quantities.

Prevent aggregation risk

Individually low-sensitivity records can become sensitive when combined. A box of old labels, hundreds of access cards or a device containing extensive operational logs may reveal more than each item alone.

Assess the collection presented for disposal, not only each unit. Batch size may change transport, storage, witnessing and destruction requirements. The free ISO 27001 risk score calculator can support consistent initial decisions, provided the assessment also considers volume and linkage.

Build a disposal record that proves the outcome

An audit-ready record should connect the approved asset to the method and result. Depending on risk, capture:

• unique asset or media identifier;
• serial number or batch reference;
• owner and custodian;
• information classification;
• reason and destination;
• approval date and approver;
• sanitisation or destruction method;
• tool, version or equipment used;
• performer and completion date;
• verification result and verifier;
• custody events;
• supplier certificate reference;
• exception or failure handling; and
• inventory status update.

Avoid retaining sensitive content merely to prove it existed. The evidence should show identity, process and result without creating a new copy of the information being destroyed.

Distinguish implementation from operation

Implementation evidence includes approved disposal rules, technical methods, supplier requirements, roles, record fields and exception criteria. Operating evidence includes completed records, failed sanitisation cases, transfer logs, certificates, witnessing results, asset-register updates and periodic reconciliations.

The free Annex A control lookup can help map A.7.10, A.7.14 and A.8.10 to related asset, supplier and cryptography controls.

Audit by tracing assets in both directions

Use two audit trails.

First, select items marked disposed in the asset inventory and trace them forward to approval, custody, sanitisation, verification and final destination. Second, select recent supplier certificates or destruction batches and trace them back to authorised assets. The two directions detect missing records and unrecorded items.

Include:

• a reused internal device;
• an externally recycled device;
• a failed or damaged storage device;
• removable or backup media;
• equipment returned to a lessor;
• a cloud or virtual storage resource; and
• an exception or lost asset.

Useful audit questions include:

• How was the approved method selected for this technology?
• What proves the device was encrypted before key destruction?
• Who can access assets awaiting disposal?
• Can every item in the supplier batch be reconciled?
• How are sanitisation failures contained and escalated?
• Are replicas, backups and embedded media included?
• When and by whom was the asset inventory updated?

Evaluate the result

A pass would show authorised destinations, technology-appropriate methods, controlled custody, verified outcomes and reconciled records. A partial result might show successful sanitisation but inconsistent inventory updates or incomplete supplier detail. A fail could involve resale without verification, missing assets, routine reliance on file deletion or certificates that cannot be linked to the disposed population.

One missing signature may be a record issue; a pattern of untraceable devices can indicate loss of control. Assess scale, sensitivity, recoverability, destination and recurrence before grading.

Keep disposal aligned with retention and incidents

Do not dispose of information subject to a legal hold, investigation or required retention. Connect disposal approvals to records management and legal review where applicable. If an asset is lost before destruction, treat it as an incident and assess notification duties rather than completing the disposal record as normal.

The incident-management evidence guide explains how to record and investigate information-security events.

ISO’s ISO/IEC 27002 overview identifies the standard as guidance for information-security controls. Use its current guidance with authoritative sanitisation standards, manufacturer instructions and applicable law. The practical objective is simple: know what left, prove how information was made inaccessible and retain evidence strong enough to survive later scrutiny.