BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
A.7.14A.7 Physical controls

Secure disposal or re-use of equipment

A.5EVIDENCEA.6EVIDENCEA.7EVIDENCEA.8EVIDENCECONTROL MAPA.7.14 Evidence MapPOLICY / CONTROL / EVIDENCE / REVIEW

Purpose

Verify equipment has had sensitive data and licensed software removed or securely overwritten before disposal or reuse.

How to meet this control

In short: Verify storage media is wiped or destroyed before disposal or re-use.

  1. Step 01Run a documented sanitisation process that checks every device for storage media before disposal or reuse
  2. Step 02Securely wipe media to a recognised standard or physically destroy it, and obtain a certificate of destruction or wiping from the provider
  3. Step 03Use full-disk encryption across the fleet so that crypto-erase further reduces disclosure risk on disposal
  4. Step 04Remove organisation labels, asset tags and classification markings before equipment leaves
  5. Step 05Risk-assess damaged media to decide whether it should be destroyed rather than sent out for repair
  6. Step 06When vacating leased premises, remove access-control and surveillance equipment and confirm no sensitive data is left for the next tenant

Tip: Use certificates of destruction/wiping as evidence.

What ISO 27002 says to cover

Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.

  • ›Check equipment for storage media before disposing of or reusing it
  • ›Physically destroy or securely overwrite media with confidential or copyrighted data
  • ›Remove labels and markings that identify the organisation, classification or system before disposal
  • ›Risk-assess damaged media to decide whether to destroy it rather than send it for repair
  • ›Consider removing access control and surveillance equipment when leaving leased premises
  • ›Avoid leaving sensitive data behind for the next tenant
  • ›Use full-disk encryption with strong keys to further reduce disclosure risk on disposal

Audit evidence to keep

  • - Certificates of destruction or secure-wiping for disposed equipment
  • - The secure disposal and reuse procedure
  • - An asset-disposal register linking devices to their sanitisation outcome
  • - Evidence of encryption applied across the device fleet
  • - Records of label and asset-tag removal before disposal

Common mistakes

  • - Relying on office trust without logs
  • - Not tracking assets used away from the office
  • - Disposing equipment without wipe or destruction evidence

Owner, cadence, and proof

Assign one accountable owner for A.7.14. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Data retention and disposal policyUse for ISO 27001 A.5.33, A.5.34, A.8.10, SOC 2 Confidentiality and Privacy, and PCI DSS requirement 3.
Open the control-to-policy map
← A.7.13 Equipment maintenance
Back to all physical controls or see the requirements (clauses 4 to 10). To run this control with automation, read how AI manages controls.