Secure Information Disposal Checklist

Covers deletion, media sanitisation and certificate evidence for each media type.

Available soon

Format: Excel
Size: 83 KB
Length: 12 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Disposal checks
Disposal log
Reconciliation
Methods and providers
Summary
Lists
Definitions
Framework References

What changed

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: a checklist of 21 items in 5 areas for each disposal batch, with critical items and a closed status; a disposal log that checks the method, the certificate window and the chase for each batch; a tag-by-tag reconciliation of manifest and certificate; the three methods for 10 media types at each level, the certificate's fields and the providers' tiers; a Summary with ICM-04 and a signature block; and the distributor's quarter of disposals, with a laptop missing from a certificate, as the worked example.
1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Before anything leaves, check the legal holds (CL-15) and record each item on the collection manifest: asset tag, serial number, media type and the highest level it held. A device, disk or medium takes the highest level of the information it held (CL-01).
2	Choose the method from the Methods and providers sheet for the media type at that level: clear, purge or destroy, as NIST Special Publication 800-88, Guidelines for Media Sanitization names them. Confidential media leave only to a provider assessed under the third-party pack, under contract terms that protect the information (CL-16).
3	Enter the batch on the Disposal log sheet when it is collected. The log checks the method, and calculates whether the certificate arrived within 10 working days of collection (CL-11).
4	When the certificate arrives, list its asset tags on the Reconciliation sheet beside the manifest. Every manifest item should say Matched. Chase any missing item at once; one not accounted for within 10 working days of the chase is reported as a suspected loss through the incident route (CL-18). The log shows the date.
5	Work through the Disposal checks for the batch: evidence, owner, date and result for each item; a Fail or N/A needs a reason. A Fail on a Critical item means the batch is not closed.
6	Report ICM-04 from the Summary monthly to the security and it leadership team; it counts the quarter (CL-20). Then complete the sign-off.
7	For in-house destruction, the disposal record replaces the certificate: who destroyed what, how, when and with what equipment. Delete the EXAMPLE rows before use; the items on the Disposal checks stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. In Q3 2026 it disposed of 5 batches that held Confidential information through two providers. The head office laptop refresh (DS-2026-10) was collected on 8 Sep 2026; the certificate came back on 21 Sep 2026 with 23 of 24 serials. LT-0417 was chased on 22 Sep 2026: The provider says the laptop is in its quarantine queue and has not been processed; a certificate is promised. If it is not accounted for by 6 Oct 2026, it is reported as a suspected loss.

Tailoring for a small organisation: a cross-cut shredder and one approved provider for devices may be all you need. Keep the manifest and the reconciliation even for a handful of laptops: one missing device is the failure this checklist exists to catch.

Tailoring for a regulated entity: a DORA financial entity needs processes to delete data it no longer needs and to dispose of storage devices holding confidential information, on premises or held externally (Delegated Regulation (EU) 2024/1774 Article 11(2)(g) and (h)). NIS2's Implementing Regulation (EU) 2024/2690 asks for irretrievable deletion and destruction rules (Annex 12.2.2).

Tailoring where a service provider runs your IT: the provider may arrange the collection, but the manifest, the certificate and the reconciliation are yours. Information it holds for you is deleted under P06 clause CL-13 (Data return and deletion), with written confirmation.

Disposal checks

The checks for one disposal batch (EXAMPLE: DS-2026-10). Yellow columns are yours; the Check column calculates. Rules CL-01 to CL-20 are in the Information Classification & Handling Policy.

Row	Item ID	Area	Item	Pass when	Rule tested	Critical	Evidence reference	Owner	Date checked	Result	Reason (for Fail or N/A)	Check (calc)
EXAMPLE	DC-BEF-01	Before disposal	Legal holds checked	Check the register and the legal holds: nothing under hold goes (CL-15).	CL-15	Yes	Legal holds in force: LH-2026-01, Evidence of the ransomware incident INC-2026-014: the images of the 14 Warehouse 2 office PCs taken before they were rebuilt, and the incident's logs. None of the 24 laptops is covered.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-BEF-02	Before disposal	Collection manifest complete	Record each item on the collection manifest: asset tag, serial number, media type, the highest level it held.	CL-11	Yes	Manifest for DS-2026-10: 24 laptops, each with asset tag, serial number, media type and the level it held (Confidential).	IT Operations Manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-BEF-03	Before disposal	Devices stay in device management until reconciled	Remove the device from device management and the asset inventory only after step 6.	CL-11	No	The 23 certified laptops removed after reconciliation; LT-0417 still enrolled and listed as awaiting disposal.	IT Operations Manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-BEF-04	Before disposal	Handover signed against the manifest	Sanitise in house, or hand over to an approved provider against the signed manifest.	CL-11	No	Provider's driver signed the manifest on collection, 8 Sep 2026.	IT Operations Manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-PRV-01	Provider	Provider assessed and tiered under the third-party pack	The provider is in the supplier register at the tier P06's criteria and overrides give it, and its assessment is current (CL-16, P06 TP-02, TP-09).	CL-16	Yes	DP-1 IT asset disposal provider: Tier 2, as a processor of personal data (P06's override).	Head of Information Security	30 Sep 2026	Pass		OK
EXAMPLE	DC-PRV-02	Provider	Contract terms in place	The contract holds the P06 clauses a supplier holding the organisation's information signs: P06 clause CL-01 (Security requirements and standards), P06 clause CL-06 (Data protection: processor terms), P06 clause CL-07 (Security incident notification).	CL-16	Yes	Contract schedule for DP-1: P06 clause CL-01, P06 clause CL-06, P06 clause CL-07.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-MTH-01	Method	Method allowed for the media type and level	The method on the manifest is the one the Methods and providers sheet gives for the media type at the highest level the items held (CL-11).	CL-11	Yes	Solid-state drives and flash storage in laptops, PCs and servers, Confidential: "Purge by built-in sanitise or cryptographic erase, verified; Destroy if it has failed or cannot be verified." Method ordered: Purge.	IT Operations Manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-MTH-02	Method	Verification required	The order asks the provider to verify each item after sanitisation and to destroy any item that fails or cannot be verified.	CL-11	No	Purchase order: purge by built-in sanitise, verified per item; destroy on failure.	IT Operations Manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-01	Certificate	Certificate received on time	Receive the certificate within [[10]] working days of collection for a provider, or complete the disposal record for in-house destruction.	CL-11	No	Collected 8 Sep 2026; certificate received 21 Sep 2026: 9 working days.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-02	Certificate	Certificate shows: provider's name and certificate number	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-03	Certificate	Certificate shows: collection reference, matching the organisation's collection manifest	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-04	Certificate	Certificate shows: each item's asset tag and serial number	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-05	Certificate	Certificate shows: media type of each item	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-06	Certificate	Certificate shows: method for each item: Clear, Purge or Destroy, and the tool or process used	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-07	Certificate	Certificate shows: verification done, and its result	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-08	Certificate	Certificate shows: date of sanitisation or destruction, and the site	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-CRT-09	Certificate	Certificate shows: name and signature of the person responsible	The certificate carries this for every item it lists (CL-11).	CL-11	No	Certificate for DS-2026-10.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-REC-01	Reconciliation	Every manifest item on the certificate	Reconcile the certificate with the manifest, serial by serial. Every item matched closes; any item missing is chased.	CL-11	Yes	Reconciliation sheet: 23 of 24 matched; LT-0417 missing.	Records manager	30 Sep 2026	Fail	LT-0417 is not on the certificate. The provider says the laptop is in its quarantine queue and has not been processed; a certificate is promised.	Critical item failed
EXAMPLE	DC-REC-02	Reconciliation	Missing items chased at once	The provider is asked in writing for every missing item the working day the gap is found.	CL-11	No	Chased 22 Sep 2026, the working day after the certificate arrived.	Records manager	30 Sep 2026	Pass		OK
EXAMPLE	DC-REC-03	Reconciliation	Unaccounted items reported as a suspected loss	An item not accounted for within [[10]] working days of the chase is reported as a suspected loss through the incident pack (CL-18).	CL-18	Yes	Report by 6 Oct 2026: 10 working days after the chase.	Head of Information Security	30 Sep 2026	N/A	Not yet due at 30 Sep 2026: if LT-0417 is not accounted for by 6 Oct 2026, report it through the incident route (CL-18).	OK
EXAMPLE	DC-REC-04	Reconciliation	Records kept	The manifest, the certificate, the reconciliation and any chase are kept for the retention period the schedule sets for disposal certificates.	CL-11	No	Disposal file for the batch, with the records manager.	Records manager	30 Sep 2026	Pass		OK

Disposal log

One row per disposal batch of items that held Confidential information (CL-11). Yellow columns are inputs; the method, certificate window and chase calculate. Measured at the As-at date on the Summary.

Example	Disposal ID	What	Media type	Highest level held	Method	Method allowed? (calc)	Provider	Provider tier (calc)	Collected	Certificate received	Working days to certificate (calc)	Certificate on time? (calc)	Items	Matched on the certificate	Missing (calc)	Item missing	Chased on	Report by, if not accounted for (calc)	Status (calc)	In this quarter? (calc, ICM-04)	Notes
EXAMPLE	DS-2026-07	Confidential paper waste, July collection	Paper	Confidential	Destroy	Allowed	DP-2	Tier 2	29 Jul 2026	31 Jul 2026	2	On time	1	1	0				Closed: every item matched	Yes
EXAMPLE	DS-2026-08	Two failed disks from the FS-02 file server, kept under the no-return warranty option	Hard disk drives	Confidential	Destroy	Allowed	DP-2	Tier 2	20 Aug 2026	20 Aug 2026	0	On time	2	2	0				Closed: every item matched	Yes
EXAMPLE	DS-2026-09	Confidential paper waste, August collection	Paper	Confidential	Destroy	Allowed	DP-2	Tier 2	26 Aug 2026	28 Aug 2026	2	On time	1	1	0				Closed: every item matched	Yes
EXAMPLE	DS-2026-10	Head office laptop refresh: 24 retired laptops with encrypted solid-state drives	Solid-state drives and flash storage in laptops, PCs and servers	Confidential	Purge	Allowed	DP-1	Tier 2	8 Sep 2026	21 Sep 2026	9	On time	24	23	1	LT-0417	22 Sep 2026	6 Oct 2026	Chasing the provider	Yes	The provider says the laptop is in its quarantine queue and has not been processed; a certificate is promised.
EXAMPLE	DS-2026-11	Confidential paper waste, September collection	Paper	Confidential	Destroy	Allowed	DP-2	Tier 2	29 Sep 2026	30 Sep 2026	1	On time	1	1	0				Closed: every item matched	Yes

Reconciliation

The manifest against the certificate, tag by tag (CL-11). List the manifest in one column and the certificate's lines in the next, in any order: each manifest item should say Matched, and each certificate line On the manifest.

Example	Disposal ID	Asset tag on the manifest	Asset tag on the certificate	Method on the certificate	Verified on the certificate	Manifest item (calc)	Certificate line (calc)
EXAMPLE	DS-2026-10	LT-0401	LT-0401	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0402	LT-0402	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0403	LT-0403	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0404	LT-0404	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0405	LT-0405	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0406	LT-0406	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0407	LT-0407	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0408	LT-0408	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0409	LT-0409	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0410	LT-0410	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0411	LT-0411	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0412	LT-0412	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0413	LT-0413	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0414	LT-0414	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0415	LT-0415	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0416	LT-0416	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0417	LT-0418	Purge	Yes	Missing: chase (CL-11)	On the manifest
EXAMPLE	DS-2026-10	LT-0418	LT-0419	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0419	LT-0420	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0420	LT-0421	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0421	LT-0422	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0422	LT-0423	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0423	LT-0424	Purge	Yes	Matched	On the manifest
EXAMPLE	DS-2026-10	LT-0424				Matched

Methods and providers

Methods, media types, certificates and providers

The method for each media type at each level, in this pack's own words after NIST Special Publication 800-88, Guidelines for Media Sanitization. A medium is disposed of at the highest level of anything it held (CL-01).

The three methods

Method	What it does
Clear	Overwrite all the space a user can reach, with the device's ordinary commands, so simple recovery tools find nothing. Enough for re-use inside the organisation.
Purge	Make recovery infeasible even in a laboratory: the device's built-in sanitise or secure-erase command, degaussing a magnetic medium, or cryptographic erase where the device was encrypted from first use. Required before a medium leaves the organisation's control.
Destroy	Make the medium unusable and recovery infeasible: shredding, disintegration or incineration by a specialist provider, or in house with equipment rated for the medium. Required where a medium cannot be purged or has failed.

The method by media type and level

Media type	Public	Internal	Confidential
Paper	Recycle.	Destroy: shred, or the confidential waste console.	Destroy: cross-cut shred in house, or the confidential waste provider with a certificate per collection.
Hard disk drives	Clear.	Clear for re-use inside the organisation; Purge before it leaves.	Purge, verified; Destroy if it has failed or cannot be verified.
Solid-state drives and flash storage in laptops, PCs and servers	Clear.	Purge before it leaves: built-in sanitise, or cryptographic erase of an encrypted device. Overwriting alone is not reliable on flash.	Purge by built-in sanitise or cryptographic erase, verified; Destroy if it has failed or cannot be verified.
Mobile phones and tablets	Reset.	Purge: remote wipe and factory reset of an encrypted device through device management.	Purge as for Internal, verified, with a certificate when a provider does it.
USB drives and memory cards	Clear.	Purge where the device supports it; otherwise Destroy.	Destroy.
Optical discs	Recycle.	Destroy.	Destroy.
Backup tapes	Not applicable.	Purge by degaussing, or Destroy.	Destroy, or Purge by degaussing with a certificate.
Printers, copiers and network devices with storage	Reset.	Purge with the maker's sanitise function before return or re-use.	Purge with the maker's sanitise function, verified; or remove the storage and Destroy it.
Information held by a supplier or in a cloud service	Delete.	Deletion under P06 clause CL-13.	Deletion under P06 clause CL-13, with written confirmation within [[10]] working days; cryptographic erase where the organisation holds the keys.
Files and records in managed systems	Delete.	Delete, including recycle bins; backups expire in their cycle.	Delete, including recycle bins and local copies; backups expire in their cycle and stay protected until then.

What a certificate must show

Field

1	Provider's name and certificate number
2	Collection reference, matching the organisation's collection manifest
3	Each item's asset tag and serial number
4	Media type of each item
5	Method for each item: Clear, Purge or Destroy, and the tool or process used
6	Verification done, and its result
7	Date of sanitisation or destruction, and the site
8	Name and signature of the person responsible

The steps of every disposal

Step	What to do	Rule
1	Check the register and the legal holds: nothing under hold goes (CL-15).	CL-15
2	Record each item on the collection manifest: asset tag, serial number, media type, the highest level it held.	CL-11
3	Remove the device from device management and the asset inventory only after step 6.	CL-11
4	Sanitise in house, or hand over to an approved provider against the signed manifest.	CL-11
5	Receive the certificate within [[10]] working days of collection for a provider, or complete the disposal record for in-house destruction.	CL-11
6	Reconcile the certificate with the manifest, serial by serial. Every item matched closes; any item missing is chased.	CL-11
7	An item not accounted for within [[10]] working days of the chase is reported as a suspected loss through the incident pack (CL-18).	CL-18

Approved disposal providers (EXAMPLE)

Processor of personal data: at least tier

From the third-party pack's overrides: a processor under GDPR Article 28 is never below this tier.

Provider	Name and certificate	Worst level on the criteria (TC-1, TC-2, TC-3, TC-4)	Processes personal data	Tier (calc)
DP-1	IT asset disposal provider. Certificate: per item, by serial number. Contract: P06 clause CL-01, P06 clause CL-06, P06 clause CL-07.	2	Yes	Tier 2
DP-2	Confidential waste provider. Certificate: per collection. Contract: P06 clause CL-01, P06 clause CL-06, P06 clause CL-07.	2	Yes	Tier 2

The criteria (service, data, access, substitutability) and tiers are the third-party pack's. Add your own providers on new rows and widen the ProvID and ProvTier names.

Summary

Summary and sign-off

ICM-04 for the quarter from the Disposal log, the checklist results for the batch by area, and the sign-off. Everything above the sign-off is calculated except the yellow settings.

As-at date	30 Sep 2026	EXAMPLE: the example quarter end. Use today's date, or type =TODAY().
Quarter start	1 Jul 2026	Calculated: the first day of the calendar quarter of the As-at date.
Certificate due within (working days of collection)	10	CL-11: the confirmation window the third-party pack sets for deletion at exit.
Missing item reported after (working days of the chase)	10	CL-11, CL-18. Working days are Monday to Friday; add your public holidays to the formulas if you need them.
Batch checked on the Disposal checks	DS-2026-10	EXAMPLE batch.

Headline measure

Measure	Matched	Items	Share	Target	Tolerance	Status	What it counts
ICM-04 Disposal certificates held	28	29	97%	100%	100%	Outside tolerance	Items that held Confidential information disposed of in the quarter with a matching certificate or disposal record, out of all such items.

Tolerance: Same as the target: every item. Target and tolerance are the EXAMPLE's; set your own with the leadership team. ICM-03 and ICM-04 count the quarter. A measure outside tolerance goes to the next executive committee with its plan.

Count, from the log	Batches
Disposals collected this quarter	5
Certificates late	0
Batches still chasing a missing item	1
Batches to report as a suspected loss (CL-18)	0
Manifest items missing from a certificate (Reconciliation)	1

Checklist results by area

Area	Items	Pass	Fail	N/A	Critical items failed	Status
Before disposal	4	4	0	0	0	Closed
Provider	2	2	0	0	0	Closed
Method	2	2	0	0	0	Closed
Certificate	9	9	0	0	0	Closed
Reconciliation	4	2	1	1	1	Not closed
All areas	21	19	1	1	1	Not closed

Not closed: a Critical item failed. Incomplete: an item is not assessed. Closed, with actions: only non-critical items failed. Closed: every item passed or is N/A with a reason.

Sign-off

Role	Name	Date	Signature or approval reference
Checked by (custodian)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Disposal records kept by (records manager)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

Lists

Result	YesNo	Area	Level	Method	Media	ProviderID
Pass	Yes	Before disposal	Public	Clear	Paper	DP-1
Fail	No	Provider	Internal	Purge	Hard disk drives	DP-2
N/A		Method	Confidential	Destroy	Solid-state drives and flash storage in laptops, PCs and servers
		Certificate			Mobile phones and tablets
		Reconciliation			USB drives and memory cards

Optical discs

Backup tapes

Printers, copiers and network devices with storage

Information held by a supplier or in a cloud service

Files and records in managed systems

Definitions

Definitions

Term	Meaning in this workbook
Sanitise	To make information on a medium impossible to recover, by one of the three methods of NIST Special Publication 800-88 (Guidelines for Media Sanitization): clear, purge or destroy.
Clear	Overwrite all the space a user can reach, with the device's ordinary commands, so simple recovery tools find nothing. Enough for re-use inside the organisation.
Purge	Make recovery infeasible even in a laboratory: the device's built-in sanitise or secure-erase command, degaussing a magnetic medium, or cryptographic erase where the device was encrypted from first use. Required before a medium leaves the organisation's control.
Destroy	Make the medium unusable and recovery infeasible: shredding, disintegration or incineration by a specialist provider, or in house with equipment rated for the medium. Required where a medium cannot be purged or has failed.
Certificate	A provider's signed record that named items, listed by serial number, were sanitised or destroyed, by which method, when and by whom.
Disposal record	The organisation's own record of in-house destruction: what was destroyed, by whom, how, when and with what equipment. It replaces the certificate when no provider is used (CL-11).
Collection manifest	The organisation's list of every item handed to a provider: asset tag, serial number, media type and the highest level it held, signed on collection.
Reconciliation	Comparing the certificate with the manifest, item by item, so every item is accounted for.
Legal hold	An instruction from Legal to keep named information unchanged, whatever its retention period, because of a claim, an investigation or an authority's request.
Retention	Every asset in the register names its retention rule from the schedule. Personal data is kept no longer than its purpose needs (GDPR storage limitation). At the end of the period it is deleted or disposed of by the level's rule, unless a legal hold applies.
Suspected loss	An item not accounted for: reported as mishandling through the incident route. At once, through the incident reporting route (P09 IM-01). Nobody is blamed for a report made in good faith.
Critical item	One whose failure leaves Confidential information unaccounted for. A Fail on any makes the batch Not closed.
ICM-04	Disposal certificates held: Items that held Confidential information disposed of in the quarter with a matching certificate or disposal record, out of all such items.
Tier	The third-party pack's supplier tier, set by the worst criterion and its overrides.
P06 clause CL-nn	A contract clause of the Third-Party Security Risk Management pack. Never one of this pack's rules.
(calc)	A cell or column the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026, as at 2026-09-30. The 23 asset tags other than LT-0417 are illustrative. Delete the EXAMPLE rows before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.10 — Information deletion	Methods and providers and Disposal log: information deleted when no longer needed, by the method for the media
ISO/IEC 27001:2022	Annex A 7.14 — Secure disposal or re-use of equipment	Disposal checks and Reconciliation: equipment with storage sanitised or destroyed before disposal or re-use, and accounted for
NIST CSF 2.0	ID.AM-08 — “Systems, hardware, software, services, and data are managed throughout their life cycles”	The whole checklist: hardware and data managed to the end of their life cycle
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The whole checklist: disposal as part of asset management
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Who the Implementing Regulation binds; for other entities it shows what the regulator expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.2.2 — the policy shall “(a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.”	Methods and providers: rules for irretrievable deletion and destruction, by media type
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.5 — assets in the custody of personnel are deposited, returned or deleted upon termination of employment, and this is documented; where that is not possible, the assets can no longer access the entity's network and information systems	Disposal log: devices returned by leavers sanitised before re-use or disposal
DORA — Delegated Regulation (EU) 2024/1774	Article 11(2)(g) — “the process to securely delete data, present on premises of the financial entity or stored externally, that the financial entity no longer needs to collect or to store”	Methods and providers: secure deletion of data no longer needed, including data held by suppliers
DORA — Delegated Regulation (EU) 2024/1774	Article 11(2)(h) — “the process to securely dispose or decommission of data storage devices present on premises of the financial entity or stored externally containing confidential information”	Disposal checks, Disposal log and Reconciliation: storage devices holding confidential information disposed of securely and accounted for
GDPR — Regulation (EU) 2016/679	Article 5(1)(e) — personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (‘storage limitation’), with the exceptions the Article sets for archiving, research and statistics	Before disposal: personal data kept no longer than its purpose needs, then disposed of
GDPR — Regulation (EU) 2016/679	Article 5(1)(f) — personal data shall be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)”	Disposal checks: personal data protected against loss until it is destroyed
GDPR — Regulation (EU) 2016/679	Article 28(3) — a binding contract with the processor, covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion of data, and audits	Methods and providers, providers: processor terms with each disposal provider

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.