ISO 27001:2022 Annex A 7.14 – Secure Disposal or Re-Use of Equipment

• See ISO 27002:2022 Control 7.14 for more information.
• See ISO 27001:2013 Annex A 11.2.7 for more information.

ISO 27001 Annex A 7.14: Best Practices for Secure Equipment Disposal and Reuse

IT equipment that is no longer needed must be either destroyed, returned to the leaser, passed to a third party, recycled, or reused for other business operations.

Organisations should safeguard information and licensed software by ensuring it is wiped off or overwritten prior to disposal or reuse of the equipment. This will help protect the confidentiality of the data stored on the device.

If an organisation employs an external IT asset disposal service provider to transfer outdated laptops, printers and external drives, this provider may gain unauthorised access to data hosted on the equipment.

ISO 27001:2022 Annex A 7.14 deals with how organisations can preserve the confidentiality of data stored on equipment designated for disposal or reuse, by implementing effective security measures and procedures.

Purpose of ISO 27001:2022 Annex A 7.14

ISO 27001:2022 Annex A 7.14 enables organisations to preclude unauthorised access to delicate data by verifying that all information and software licensed on equipment is irrevocably erased or overwritten before the equipment is discarded or handed to a third party for reuse.

Ownership of Annex A 7.14

In compliance with ISO 27001:2022 Annex A 7.14, an organisation-wide data disposal-reuse procedure must be established, including the identification of all equipment and the implementation of suitable technical disposal mechanisms and reuse processes.

The Chief Information Officer should be accountable for setting up, enacting, and sustaining systems and processes for discarding and re-utilising equipment.

Guidance on ISO 27001:2022 Annex A 7.14 Compliance

ISO 27001:2022 Annex A 7.14 specifies four essential considerations for compliance that organisations should bear in mind:

Adopting a Proactive Stance Is Advisable

Prior to disposal or reuse, organisations must ascertain whether the equipment includes any information assets and licensed software and ensure these are permanently erased.

Physical Destruction or Irretrievable Erasure of Data

ISO 27001:2022 Annex A 7.14 states that two approaches can be taken to ensure secure and permanent erasure of information on equipment:

• Equipment that holds storage media devices that contain information should be physically destroyed.
• Organisations should refer to Annex A 7.10 and Annex A 8.10 concerning Storage Media and Information Deletion, respectively, in order to ensure all data stored on equipment is erased, overwritten or destroyed in a manner that precludes retrieval by malicious parties.

All Labels and Markings Should Be Taken Off

Equipment components and the data they contain can be labelled or marked to identify the organisation or reveal the asset owner, network, or classification level of the information. All these labels and markings should be permanently destroyed.

Removal of Controls

Organisations may consider uninstalling security controls, such as access restrictions or surveillance systems, when vacating facilities, given the following conditions:

• The lease agreement stipulates the requirements for the return of the property.
• Mitigating the risk of any unauthorised access to sensitive information by the future tenant is essential.
• Can the current controls be utilised at the upcoming facility.

Supplementary Guidance on Annex A 7.14

In addition to the General Guidance, ISO 27001:2022 Annex A 7.14 provides three specific recommendations for organisations.

Damaged Equipment

When equipment containing data is sent for repairs, it may be vulnerable to unauthorised access from third parties.

Organisations should perform a risk evaluation, taking into account the level of sensitivity of the data, and contemplate if destroying the equipment would be a more viable choice than repair.

Full-Disk Encryption

Ensuring full-disk encryption meets the highest standards is essential to safeguarding the confidentiality of data. It should be noted that the following ought to be adhered to:

• Encryption is reliable and safeguards every aspect of the disk, including leftover space.
• Cryptographic keys should be of length sufficient to thwart brute force attacks.
• Organisations should protect the secrecy of their cryptographic keys. For instance, the encryption key should not be stored on the same hard drive.

Overwriting Tools

Organisations should select an overwriting approach while considering the following criteria:

• The information asset has been granted a certain level of classification.
• The type of storage media where the information is kept is known.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 7.14 replaces ISO 27001:2013 Annex A 11.2.7 in the revised standard. The ISO 27001:2022 version replaces the ISO 27001:2013 version of the standard, with the most recent version including updates to Annex A 7.14.

ISO 27001:2022 Annex A 7.14 is much like its 2013 equivalent. However, the 2022 version has more comprehensive requirements in the general guidance.

In comparison to ISO 27001:2013, the 2022 version brings these demands:

• Organisations should erase all signs and tags that specify their organisation, network, and classification level.
• Organisations should contemplate eliminating any controls they have established at a facility when they depart.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.Online provides a comprehensive approach to ISO 27001:2022 implementation. It offers a streamlined process, allowing users to quickly and effectively meet the standards of the international security standard. With its user-friendly interface, it makes it easy for organisations to establish and maintain a robust Information Security Management System.

This web-based system enables you to demonstrate that your ISMS meets the specified criteria, through effective processes, procedures and checklists.

Contact us now to arrange a demonstration.