ISO 27001 Control A.7.14: Secure Disposal or Re-Use of Equipment

Old laptops are one of the best sources of other people’s data. Stories of second-hand drives bought online and found to hold personal files turn up regularly, and the cause is nearly always the same: someone assumed that deleting files, or resetting a device, was enough. A.7.14 is the last of the 14 physical controls in our walk through Annex A, and it closes the loop on the life of every piece of equipment you own.

The control is not only about the dramatic end of a computer’s life. Re-use counts too: a laptop passed from the sales team to the finance team, a phone handed to a new starter, a server repurposed for a test environment. Each handover is a chance for data to travel somewhere it should not.

What the control requires

Annex A control 7.14 of ISO 27001:2022 states that items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

The key elements:

Items of equipment containing storage media - laptops, desktops, servers, phones, tablets, printers and copiers with hard drives, network devices with stored configurations, and any other device that keeps data
Verified - someone checks that the removal worked; assuming it did is not enough
Sensitive data and licensed software - both the information that could harm you or others if disclosed, and the software licences that you may not be allowed to pass on
Removed or securely overwritten - the data is gone beyond ordinary recovery, not just hidden from view
Prior to disposal or re-use - the check happens before the equipment leaves your control or changes hands internally

A.7.14 is a preventive control in ISO/IEC 27002:2022. Annex A states the control; ISO 27002 gives guidance, including that equipment should be checked for the presence of storage media, that media containing confidential or copyrighted information should be physically destroyed or the information destroyed, deleted or overwritten using techniques that make the original unretrievable rather than the standard delete function, and that labels and markings identifying the organization or classification should be removed. It also covers damaged devices, where a risk assessment decides whether to repair, destroy or discard, and encryption as a way to reduce the exposure of data on equipment that is being disposed of.

How to implement secure disposal and re-use

Build a clear routine and an owner

Pick one owner, usually IT, and one routine for every device that leaves service. The routine should answer a handful of questions in order: what is this device, does it contain storage, how sensitive was the data on it, and what will happen to it next? Create a short checklist that is completed for every retirement or reassignment and kept as a record. Tie it into the asset inventory, so a device is only marked as disposed of once the checklist is complete. This links closely to the life cycle in storage media, where disposal is the final stage.

Do not forget the less obvious holders of data. Multifunction printers and copiers often have internal drives. Network devices keep configurations that include passwords and keys. Phones and tablets sync mail and files. Meeting-room equipment may store calendars and credentials. If it plugs in and has memory, it belongs on the list.

Choose the right method for the sensitivity

Match the method to the classification and the circumstances:

Encrypted devices with managed keys - destroying or rotating the key can render data unreadable, which is often the quickest and most reliable approach for modern devices that were encrypted from the start
Secure erase or overwrite - use tools designed for the media type, and confirm the result; solid-state drives behave differently from spinning disks, so use methods suited to them rather than relying on a quick format
Factory reset with verification - suitable for phones, tablets and low-risk devices where the manufacturer’s reset is documented to clear user data, followed by a check
Physical destruction - shredding, crushing or disintegration for highly sensitive media, failed drives that cannot be erased, and media that are not worth re-using

A plain delete or quick format is not erasure. If you are not sure that a method works for a particular device, choose destruction. For third-party services, use a reputable provider under a written agreement, obtain a certificate that lists the devices or serial numbers, and consider an occasional on-site witness or sample check. Confidentiality terms matter here too, in line with confidentiality or non-disclosure agreements.

Verify, record and handle licences

The word “verified” in the control is deliberate. After erasing, check: boot the device into a clean state, sample the media with a recovery tool, or review the erasure tool’s log. Record the result with the device’s serial number, the date, the method and the person who did it. Keep these records for as long as your retention rules require, since they are the evidence that a device was clean when it left.

Licensed software needs the same care. Remove or deactivate licences so they are not left on equipment that is sold, donated or returned, and check the terms for transferability. This is also the moment to remove management agents, certificates and accounts that tie the device to your systems, and to take the device out of any monitoring or asset tools.

Cover leavers, donations, leases and the odd corner

The routine has to work in less tidy situations. Leased equipment going back to a lessor needs the same wipe before it leaves. Donated or sold equipment is still your responsibility until it is clean. Devices returned by staff leaving the organization, as described in responsibilities after termination or change of employment, should enter the same process rather than being tidied into a cupboard. Equipment that fails under warranty or goes for repair raises the issue discussed in equipment maintenance: decide whether the media can be removed or whether encryption protects you. Finally, equipment that moves between roles inside the organization still needs a wipe and a fresh setup when the new role has different access needs.

A.7.9 connection. Security of assets off-premises covers equipment in transit to a disposal or recycling provider.

A.7.10 connection. Storage media manages media through acquisition, use, transportation and disposal; this control focuses on the equipment that contains them.

A.7.13 connection. Equipment maintenance raises the question of data on devices sent for repair, which is a close cousin of disposal.

A.6.5 connection. Responsibilities after termination or change of employment brings returned devices into the process.

A.6.6 connection. Confidentiality or non-disclosure agreements apply to disposal contractors who handle your equipment.

Clause 7.5.3 connection. Control of documented information applies to the checklists and certificates that serve as your records.

Forward reference. The later organizational control on the inventory of information and other associated assets (A.5.9) and the technological control on information deletion (A.8.10) build on this routine, and the first organizational control, Policies for information security (A.5.1), is where the series turns next.

What auditors check

A documented disposal and re-use process. Auditors look for a written routine, with an owner, that covers all equipment containing storage.

Records for specific devices. They pick items from the asset inventory marked as disposed of and ask for the matching erasure logs or destruction certificates.

Method suitability. Expect questions about why a given method suits the media type, particularly for solid-state storage and mobile devices.

Third-party providers. Auditors check contracts, certificates and any checks you made on the provider.

Coverage of unusual devices. They may ask about printers, network equipment and phones, to test whether the process reaches beyond laptops.

Licences. For software-heavy environments, they may ask how licences are recovered or deactivated.

Common mistakes to avoid

Treating delete or format as erasure. Ordinary deletion leaves data recoverable. Use proper erasure or destruction.

Forgetting hidden storage. Copiers, printers, network gear and meeting-room devices keep data, and they are often missed.

No verification step. Without a check, a successful wipe is an assumption.

Missing records. If you cannot show what happened to a device, you cannot show that the data is gone.

Giving away equipment informally. A laptop gifted to a colleague or a student charity is still a disposal and needs the full routine.

Trusting a contractor without paperwork. A recycler who gives no certificate and no list leaves you with a promise rather than evidence.

Ignoring licences. Software tied to your organization can be reused by someone else if it is not removed.

How 27kay can help

We help organizations turn disposal from a pile in a cupboard into a clean, recorded routine, with methods that fit each device type and evidence that stands up to an audit. As part of ISO 27001 implementation, we review how equipment leaves your hands today, build the checklist and records with you, and check your disposal provider arrangements. For the full picture, see our ISO 27001 knowledge hub.

If we picked up the oldest laptop in your storage cupboard right now, what would we find on it? Get in touch - we will help you make sure the answer is “nothing”.