Secure disposal or re-use of equipment

Plain-language summary

Making sure that any equipment with storage in it — laptops, servers, phones, printers, network devices — has its sensitive data and licensed software removed or destroyed before it is thrown away, returned, sold or handed to someone else.

What the clause is really asking

Old equipment leaks data long after anyone thinks about it: the second-hand laptop with payroll files, the leased printer returned with every scanned page on its hard drive. This control asks you to check, item by item, that any device holding storage has had its sensitive data and licensed software removed, by secure overwriting, cryptographic erasure or physical destruction, before it is disposed of or put back into use. The method should match the sensitivity, with destruction for damaged drives or highly sensitive data, and each item needs a record. The misunderstanding is that deleting files or formatting a drive is enough; it is not. Scope includes multifunction printers, network devices, phones and tablets, and the industrial PCs and controllers on the production floor. Reissuing a laptop to a new employee is reuse and needs the same wipe. Your ISO 14001 waste process probably already sends electronic waste to a licensed recycler; add data destruction and certificates to that contract, and remember that a device discarded with personal information on it is a POPIA section 19 failure.

What auditors look for

Auditors ask for the disposal and reuse procedure and the list of equipment disposed of in the period, then trace a sample from the asset register to the wipe or destruction record and certificate. They ask how leased printers and copiers are cleared before return and how laptops are prepared for reissue. They read the e-waste or IT asset disposal contract for data destruction terms and look at the provider's certificates. They look at old equipment waiting for disposal and how it is stored. The hard question: show me the certificate for the server you replaced last year.

Typical evidence

Secure disposal and reuse procedure; asset register updated on disposal; wipe or erasure logs per device; certificates of destruction listing serial numbers; e-waste or IT asset disposal contract with data destruction clauses; drive clearing records for leased printers; laptop reissue checklist; locked storage for equipment awaiting disposal.

How to comply — recommendations

Write a one-page procedure: every device leaving use goes to a locked store, is logged against the asset register, is wiped with an approved tool or destroyed, and the record is attached to the asset. Use an erasure method aligned to a recognised standard such as NIST SP 800-88 and keep the logs. Contract a licensed e-waste provider that issues certificates listing serial numbers. Include multifunction printers, phones and production PCs. When leasing equipment, require the lessor to clear the drives or hand them over at return. Reissue laptops only after a full wipe and rebuild.

Common nonconformities

Equipment disposed of with no record of data removal; drives formatted rather than wiped; leased printers returned with drives intact; disposal provider issues no certificates, or certificates lack serial numbers; laptops reissued without wiping; equipment awaiting disposal stored in an unlocked area; asset register not updated on disposal.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.