Key takeaways
- Wipe or destroy data before disposing of or reusing equipment.
- Old devices often still contain recoverable data.
- Start here: wipe or destroy storage before disposal or reuse.
Purpose
Wipe or destroy data before disposing of or reusing equipment.
Requirement
Requirement summaryItems of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Why it matters
Old devices often still contain recoverable data.
How to implement
- Wipe or destroy storage before disposal or reuse.
- Use certified disposal providers and get certificates.
- Record each disposed item against the asset inventory.
- Check licences and settings are removed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.14. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for securely wiping or destroying equipment before reuse or disposal.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.14 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Wiping records or certificates of destruction.
- Asset inventory entries showing disposed items were marked as disposed.
- Your agreement with any disposal company.
Things you should be able to show or explain
- Be able to explain how drives are wiped before reuse.
How much to show: A handful of disposed or reused devices.
Common mistakes
- No proof data was wiped.
- Disposal company never checked.
- Old laptops sold or donated without wiping.
- No proof of destruction.
- Tip: Get certificates of destruction from disposal vendors.
Policies & documents to have
- Asset Management Policy
- Data Management Policy
FAQ
Is A.7.14 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.14?
Be ready to explain how the control works in your organisation and to provide things like: Your process for securely wiping or destroying equipment before reuse or disposal…