Control A.8.10Information deletion
What it means in practice
Information stored in information systems, devices or in any other storage media must be deleted when no longer required.
New in the 2022 edition, and it states a principle that runs against the grain of how organisations behave: data kept beyond its purpose is a liability, not an asset.
The control connects to retention obligations identified under A.5.31, to record protection under A.5.33, and to data protection law under A.5.34, where storage limitation is a requirement rather than a preference.
Deletion has to be effective for the medium. Removing a reference is not deletion; backups hold copies with their own lifecycle; replicated and cached copies in distributed systems persist after the primary is gone; and a provider’s deletion is a contractual question under A.5.20.
The practical difficulty is knowing what exists, which is A.5.9’s inventory again. Most organisations delete what they remember and retain what they have forgotten, which is the opposite of what the risk would suggest.
How to put this in place
Information kept longer than needed adds risk and cost, and promises about deletion mean little if copies survive. Your ISMS needs deletion that follows your retention rules and reaches every copy.
- Take the retention periods from your retention schedule.
- Decide where data lives, including backups, test copies and supplier systems.
- Choose a deletion method for each kind of storage, since an ordinary delete is not enough for sensitive data or for devices and media being retired.
- Configure automatic deletion where the system allows it, and a manual routine where it does not.
- Decide how backup copies age out, so deleted data does not survive in them indefinitely.
- Agree deletion at contract end with suppliers, obtain confirmation, and keep proof of deletion where the data is sensitive or deletion was requested.
Evidence an auditor usually looks for: retention settings in systems, deletion records and methods used, backup expiry settings, and supplier deletion confirmations.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Information Classification & Handling Policy
in Information Classification & HandlingIts Framework References list this control. Supported by: Disposal and deletion (CL-11). - Word
Classification & Labelling Procedure
in Information Classification & HandlingIts Framework References list this control. Supported by: Deletion at the end of retention; disposal steps. - Excel
Secure Information Disposal Checklist
in Information Classification & HandlingIts Framework References list this control. Supported by: Methods and providers and Disposal log: information deleted when no longer needed, by the method for the media.