Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.8.10Information deletion

Information stored in information systems, devices or in any other storage media must be deleted when no longer required.

New in the 2022 edition, and it states a principle that runs against the grain of how organisations behave: data kept beyond its purpose is a liability, not an asset.

The control connects to retention obligations identified under A.5.31, to record protection under A.5.33, and to data protection law under A.5.34, where storage limitation is a requirement rather than a preference.

Deletion has to be effective for the medium. Removing a reference is not deletion; backups hold copies with their own lifecycle; replicated and cached copies in distributed systems persist after the primary is gone; and a provider’s deletion is a contractual question under A.5.20.

The practical difficulty is knowing what exists, which is A.5.9’s inventory again. Most organisations delete what they remember and retain what they have forgotten, which is the opposite of what the risk would suggest.

How to put this in place

Information kept longer than needed adds risk and cost, and promises about deletion mean little if copies survive. Your ISMS needs deletion that follows your retention rules and reaches every copy.

  1. Take the retention periods from your retention schedule.
  2. Decide where data lives, including backups, test copies and supplier systems.
  3. Choose a deletion method for each kind of storage, since an ordinary delete is not enough for sensitive data or for devices and media being retired.
  4. Configure automatic deletion where the system allows it, and a manual routine where it does not.
  5. Decide how backup copies age out, so deleted data does not survive in them indefinitely.
  6. Agree deletion at contract end with suppliers, obtain confirmation, and keep proof of deletion where the data is sensitive or deletion was requested.

Evidence an auditor usually looks for: retention settings in systems, deletion records and methods used, backup expiry settings, and supplier deletion confirmations.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

  • Annex A Control Implementation LibraryExcel

    Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.

  • Statement of Applicability TemplateExcel

    Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.