Control A.7.14Secure disposal or re-use of equipment
Items of equipment containing storage media must be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
The word that makes this control work is verified. A process that issues instructions to wipe equipment, without checking, produces disposals that may or may not have been sanitised, and the failures surface later and publicly.
The scope is “items of equipment containing storage media”, which is wider than computers. Printers and multifunction devices, network appliances, phones, and equipment returned at the end of a lease all hold data, and the last of those leaves the organisation on a schedule set by someone else.
Re-use inside the organisation is included and is where sanitisation is most often skipped, on the assumption that internal transfer is safe. It is not: a laptop reissued from finance to a contractor carries whatever was on it.
Where destruction is outsourced, certificates of destruction are the evidence, and they should be reconciled against the asset inventory rather than filed.
How to put this in place
Information can survive on discarded or reused equipment, and the project must show that it does not. Devices passed on without a wipe are a common and avoidable leak.
- Decide how each media type is wiped or destroyed before disposal or reuse.
- Write the procedure and make the inventory update part of it.
- Use a reputable disposal company for volume, ideally independently certified for secure destruction, and require certificates listing serial numbers.
- Keep wipe logs for devices reused internally.
- Sample disposals against the inventory.
Evidence an auditor usually looks for: disposal certificates matched to the inventory, wipe logs for reused devices, and inventory updates.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.