ISO 27001 Secure Disposal: Complete 2026 Requirements Guide

ISO 27001 secure disposal is not one control, and that single misunderstanding is responsible for more disposal findings than any technical failure. Most organizations write a “data destruction policy”, point the Statement of Applicability at it, and discover during stage 2 that the auditor is holding three separate control references and asking which of them the policy actually answers. In ISO/IEC 27001:2022 the disposal requirement is split across two Annex A themes — physical and technological — and each half is audited on its own evidence.

This guide maps the three ISO 27001 secure disposal controls, shows what changed when the 2013 Annex A was restructured, and sets out what an auditor expects to see in practice. It also covers something almost every competing page gets wrong: the technical standard that disposal policies have cited for a decade was superseded in September 2025.

What ISO 27001 secure disposal actually requires

Three Annex A controls carry the ISO 27001 secure disposal requirement. They sit in different themes, use different verbs, and produce different records.

Control	Theme	What it covers	2013 origin
A.7.10 Storage media	Physical	The whole life cycle of storage media: acquisition, use, transport and disposal, against your classification scheme	A.8.3.1 + A.8.3.2 + A.8.3.3 + A.11.2.5
A.7.14 Secure disposal or re-use of equipment	Physical	Verifying that equipment containing storage media has had sensitive data and licensed software removed before it leaves or is reissued	A.11.2.7
A.8.10 Information deletion	Technological	Deleting information held in systems, devices and media once it is no longer required	New in 2022

Read the themes rather than the numbers and the design becomes obvious. A.7.10 and A.7.14 are about things — the drive, the tape, the laptop, the multifunction printer. A.8.10 is about data, wherever it happens to live, including in systems you will never physically touch. A policy that only destroys hardware satisfies two thirds of the requirement and leaves the third unevidenced, which is exactly the shape of the nonconformity that gets raised.

Two neighbouring controls complete the picture without being disposal controls themselves. A.5.11 Return of assets (from 2013’s A.8.1.4) is the trigger event — a leaver hands back a laptop, and that is the moment A.7.14 starts. A.8.11 Data masking sits beside A.8.10 as the alternative when deletion is not available because the data still has a purpose. If you are building the wider document set, our ISO 27001 implementation guide shows where disposal fits in the sequence.

A.7.10 Storage media: a four-into-one merge

A.7.10 is the most heavily consolidated control in the ISO 27001 secure disposal family, and the one auditors open first. Four separate 2013 controls collapsed into it, and under the old Annex A each one was independently auditable.

ISO 27001:2013 control	Title	What it still demands under A.7.10
A.8.3.1	Management of removable media	Authorization, registration and handling rules for removable media by classification
A.8.3.2	Disposal of media	Formal, documented disposal procedures with records
A.8.3.3	Physical media transfer	Protection of media in transit, including to a destruction vendor
A.11.2.5	Removal of assets	Authorization before media or equipment leaves the site

The consequence is structural, not cosmetic. A.7.10 is now one line in your Statement of Applicability with one combined pass or fail. A removable-media register that lists who holds which encrypted USB stick looks complete until the auditor asks for the authorization record for the batch of decommissioned drives that went to the shredding contractor last quarter, and for the evidence those drives were protected in transit. Same control. Same finding.

The transport half of A.7.10 overlaps with A.5.14 Information transfer, which is where the 2013 physical-media-transfer requirement also has a foothold; our guide to ISO 27001 information transfer covers the courier, packaging and chain-of-custody side in detail. Keep one set of rules and cross-reference it rather than writing two.

A.7.14 and the word that catches everyone

A.7.14 kept its 2013 title and its 2013 number lineage, mapping one-to-one from A.11.2.7. What it asks is that equipment containing storage media is verified before disposal or re-use, to confirm sensitive data and licensed software have been removed or securely overwritten.

“Verified” is the operative word, and it is where ISO 27001 secure disposal programmes fail. Running a wipe is an activity. Verifying it is a control. If your process ends when the wiping tool reports success, you have no evidence that the tool addressed the whole device, and no evidence at all for the devices where it silently did not.

Three categories of equipment account for most ISO 27001 secure disposal gaps:

• Equipment nobody thinks of as storage. Multifunction printers, conference-room systems, network appliances, IP phones and badge readers all retain data on non-volatile memory.
• Composite devices. A single laptop can hold an SSD, an embedded controller, firmware configuration and a TPM, each needing a different approach.
• Leased and failed hardware. Lease returns and warranty replacements leave the building on someone else’s schedule, and a failed drive is the hardest case of all because the interface that your wiping tool needs may no longer respond.

A manufacturer’s Statement of Volatility — a specification listing a device’s volatile and non-volatile memory, what is stored in it, and how it can be erased — is the document that answers the first two categories. Asking for one before purchase, rather than at decommissioning, is a cheap way to avoid buying equipment you cannot lawfully dispose of.

A.8.10 Information deletion is new, and nothing in your 2013 file answers it

A.8.10 is one of the eleven controls introduced in the 2022 edition. It has no 2013 ancestor, which has a practical consequence for any organization that transitioned: there is a legacy document sitting behind almost every other control in your SoA, and nothing behind this one.

The control requires that information stored in information systems, devices or other storage media is deleted when it is no longer required. Its stated purpose is to prevent unnecessary exposure of sensitive information and to meet legal, statutory, regulatory and contractual deletion obligations. That second half is why A.8.10 cannot be answered by a hardware process. The data you are obliged to delete is in a database, an object store, a backup set, a log pipeline, a SaaS tenant and an analytics warehouse — and in most cases you do not own the media it sits on. That is the half of ISO 27001 secure disposal no shredder can reach.

What an ISO 27001 secure disposal audit looks for against A.8.10:

• Retention periods that are defined, approved and mapped to the systems that hold the data.
• A deletion mechanism per system, named and tested — not “the vendor handles it”.
• Contractual deletion terms with every processor and cloud provider, plus the evidence they produce on exit.
• Deletion of obsolete copies: snapshots, dev refreshes, exports, temporary files and the spreadsheet somebody keeps on a share.
• Records showing deletion actually happened, for the cases where you have a legal duty to show it.

A.8.10 is also where deletion and leakage prevention meet. Data you cannot find is data you cannot delete, so discovery and classification underpin both; our guide to ISO 27001 data leakage prevention covers the A.8.11 and A.8.12 side of that boundary.

What NIST SP 800-88 Rev. 2 changed for ISO 27001 secure disposal

Annex A states no ISO 27001 secure disposal technique. It never says “three passes”, never names a tool, and never sets a shred particle size. Those numbers come from an external standard you choose and justify — and the standard almost every disposal policy cites has changed.

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was published in September 2025 and supersedes Rev. 1 of December 2014. If your policy cites “NIST SP 800-88 Appendix A” for its technique tables, it is citing a superseded document, because Rev. 2 deliberately removed that material. Technology-specific techniques are now out of scope apart from cryptographic erase, and the publication defers to IEEE 2883, the IEEE Standard for Sanitizing Storage, which was approved in June 2022 and published that August.

Rev. 2’s centre of gravity moved from a menu of techniques to running a programme. It keeps the three methods, and the hierarchy between them matters for every ISO 27001 secure disposal decision.

Method	What it does	Media left usable?	Resists lab recovery?	Typical use
Clear	Logical techniques over the user-facing interface — overwrite of user-addressable space, or a factory reset where rewriting is not supported	Yes	Not assured	Internal re-use of lower-sensitivity media
Purge	Logical or physical techniques that make recovery infeasible using state-of-the-art laboratory techniques, while keeping the media potentially reusable — block erase, device sanitize commands, cryptographic erase	Potentially	Yes	The default where the media supports it
Destroy	Disintegrate, incinerate, melt, pulverize or shred, to the point that recovery is infeasible and the media can no longer store data	No	Yes	Failed, obsolete or highest-sensitivity media

Four points from Rev. 2 will change most ISO 27001 secure disposal policies:

• Purge should be preferred over clear where the media supports it. Clear protects against simple, non-invasive recovery through the normal interface; it is not assured against a laboratory.
• Shredding and pulverizing are not automatically the gold standard. As data density and material hardness rise, Rev. 2 advises that pulverize and shred techniques for storage media should be avoided for anything but the lowest security categories of data. Particle size has to be matched to the medium, which is why “we shred everything” is a weaker answer than it sounds.
• Degaussing is not a destroy technique and does not work on flash. Rev. 2 notes that at the time of writing degaussing is not considered an approved destroy technique, that many existing degaussers lack the force for modern high-coercivity media, and that degaussing can render a device inoperable while failing to sanitize the data. A degausser run against an SSD can complete successfully and sanitize nothing.
• The multi-pass overwrite is folklore. Rev. 2 records that historical practice ranged from one pass to 39, largely on the strength of DoD 5220.22-M — and notes that DoD removed overwriting specifications from the NISPOM in 2006. For devices with overprovisioning, such as SSDs, it advises those practices be avoided because very little confidentiality protection is achieved.

None of this is an ISO 27001 requirement. It is the external baseline you name in your ISO 27001 secure disposal policy so that your method choices are defensible rather than inherited, and it is the kind of evidence that turns an auditor’s “why this technique?” into a short conversation.

Cryptographic erase, cloud storage and the control you do not own

In ISO 27001 secure disposal terms, cryptographic erase — destroying the key rather than the ciphertext — is a purge technique, and Rev. 2 is notably clear that for logical or virtual storage such as cloud object storage it may be the only viable purge option. The underlying physical media is abstracted away, you have no access to it, and destroy is not an applicable method at all.

That has three consequences for an ISO 27001 secure disposal policy with cloud in scope:

• The effectiveness of cryptographic erase depends on the quality of the encryption and key management underneath it, and on conditions being met before the data was ever written. Encryption switched on after the fact does not retroactively make deletion verifiable.
• Escrowed, backed-up or externally managed keys undermine the whole mechanism. If a key management system holds a recoverable copy, the key was not sanitized. Rev. 2 is explicit that the documentation must address those other key locations.
• Your evidence becomes contractual. What you can show an auditor is the provider’s deletion commitment, its sanitization attestation, and the exit records — not a certificate you produced yourself.

Treat the provider’s statement as a supplier assurance artefact and keep it with the rest of your third-party evidence, alongside your asset management records so that each decommissioned asset ties to a disposal outcome.

Building an ISO 27001 secure disposal policy that passes audit

Rev. 2 lists what a sanitization policy should address, and it reads almost as a template for ISO 27001 secure disposal — the document an auditor wants to see. Mapped onto Annex A:

Policy element	What to state	Control evidenced
Classification to method mapping	Minimum acceptable method — clear, purge or destroy — for each classification level	A.7.10, A.8.10
Disposal and re-use rules	What happens on internal reissue, sale, donation, lease return and warranty replacement	A.7.14
Accepted techniques	The named external standard you follow and the techniques it permits per media type	A.7.10, A.7.14
Authorization and transport	Who approves removal from site, and how media is protected in transit	A.7.10, A.5.14
Retention and deletion	Retention periods per system and the deletion mechanism for each	A.8.10
Roles and competence	Who performs, who verifies, who validates, and the training behind it	A.7.10, A.6.3
Tools and equipment	Approved tools and versions, plus calibration, testing and maintenance of destruction equipment	A.7.14
Vendor assurance	Assurances the equipment vendor and the destruction supplier must provide	A.5.19, A.5.21
Records	The record set, retention of the records themselves, and who holds them	A.7.10, A.8.10

Note the separation Rev. 2 draws between two steps that most ISO 27001 secure disposal policies merge. Verification inspects the outcome — did the tool complete, were there errors or anomalies, what do the destruction remnants look like. Validation is the decision that the target data was effectively sanitized given its sensitivity, and it can reject a technically successful operation. Rev. 2’s own example is a shredder that produces optical-disc fragments 50% larger than the organization accepts: the operation completed, and it is still not effective. Writing those as two signatures on one ISO 27001 secure disposal record is the cleanest way to evidence it.

Equally useful is the point that elaborate sampling of a drive’s contents after clear or purge is not necessary unless your own policy demands it. Plenty of organizations have built an expensive forensic read-back step that no external baseline asks for.

The evidence an auditor will ask for

ISO 27001 secure disposal is audited almost entirely on records, because the asset is gone by the time anyone looks. Rev. 2 recommends a certificate of sanitization per item, and its field list is a good specification for your own register.

Field	Why the auditor cares
Manufacturer, model, serial number	Ties the record to one physical item, not a quantity
Internal asset or property number	Reconciles to the asset inventory, which is how completeness is tested
Media type and source	Shows the method was chosen for the medium, and which system it came from
Pre-sanitization classification	Justifies the method against your own classification-to-method mapping
Method and technique	Separates the decision (purge) from the execution (block erase, cryptographic erase, degauss)
Tool and version	Lets a finding be scoped if a tool is later found defective
Verification method	Evidences A.7.14’s “verified”, which is the control’s actual requirement
Name, title, date, location, signature	Accountability, and the date that must sit inside the window the asset left the inventory

Two refinements matter more than the fields themselves. First, completeness is tested by reconciliation: records that only exist at the destruction vendor’s end show that specific items were sanitized, not that every item introduced to your estate was accounted for. Keep a record at acquisition, at the point the asset leaves its last location, and at the post-sanitization destination. Second, if sanitization lowers an item’s confidentiality level, remove the markings that still claim the old one.

Common ISO 27001 secure disposal findings

• A hardware-only ISO 27001 secure disposal policy. Nothing answers A.8.10 for cloud and SaaS data. The most common finding of the three.
• A superseded technical citation. A policy naming NIST SP 800-88 Rev. 1 Appendix A, or DoD 5220.22-M passes, invites a question the organization cannot answer.
• No reconciliation. Certificates exist but cannot be matched back to the asset inventory, so completeness is unprovable.
• Method chosen by habit. Everything shredded, or everything “wiped”, with no mapping from classification to method.
• No verification step. Tool output filed as proof, with nobody signing that the outcome was inspected.
• Transport ignored. Pallets of drives leave on an unvetted courier with no authorization record and no chain of custody.
• Leavers’ equipment. Returned assets sit in a drawer for months with no disposal decision, which fails A.5.11 and A.7.14 together. The acceptable use and return-of-assets boundary is worth documenting explicitly.
• Retention periods that exist only on paper. A schedule with no deletion mechanism behind it is a finding against A.8.10 and, separately, a privacy exposure.

Where ISO 27001 secure disposal meets privacy law

A.8.10’s purpose explicitly includes legal, statutory, regulatory and contractual deletion obligations, which is the bridge to privacy law. Under the GDPR, Article 5(1)(e) limits storage of personal data to no longer than is necessary for the purpose, and Article 17 gives data subjects a right to erasure. Neither names a sanitization technique, and neither needs to, because ISO 27001 secure disposal is the mechanism by which those duties are actually discharged, and the records are what you produce when a regulator asks.

The practical overlap is the retention schedule. One schedule should drive both the privacy answer and the A.8.10 deletion mechanism. Where organizations run two — a records-management schedule written by legal and a technical deletion configuration written by engineering — they diverge inside a year, and the ISMS inherits the gap.

Frequently asked questions

Is a disposal policy a mandatory document under ISO 27001?

No. ISO 27001’s mandatory documented information sits in clauses 4 to 10, and a disposal policy is not on that list. In practice it is unavoidable: three Annex A controls have to be evidenced, and excluding them in the Statement of Applicability is not credible for any organization that owns a laptop. Clause 6.1.3 requires the SoA to justify inclusions and exclusions, so a one-line exclusion will be challenged.

Does ISO 27001 require a specific number of overwrite passes?

No. ISO/IEC 27001:2022 Annex A states no pass count, no particle size and no technique anywhere. Your ISO 27001 secure disposal policy chooses an external baseline — NIST SP 800-88 Rev. 2 and IEEE 2883 are the usual pair — and justify your choice against the classification of the data. The multi-pass overwrite comes from DoD 5220.22-M, and the Department of Defense removed overwriting specifications from the NISPOM in 2006.

Can we use a third-party destruction service?

Yes, and most organizations should. It does not transfer the ISO 27001 secure disposal obligation. You remain responsible for authorizing removal from site, protecting the media in transit, defining the acceptable method, and reconciling the certificates you receive against your own inventory. The destruction supplier becomes a supplier-assurance case like any other, with contractual terms and evidence you review rather than file.

How does ISO 27001 secure disposal work for cloud data we cannot touch?

Through A.8.10 rather than A.7.10 or A.7.14, and through contracts rather than certificates. Cryptographic erase may be the only purge technique available for virtual storage, and the evidence is the provider’s deletion commitment, its sanitization attestation and the exit records. Establish what the provider will actually do and prove before you store sensitive data with them, not at termination.

Do we need to keep disposal records forever?

No, but keep ISO 27001 secure disposal records well beyond the certification cycle. A three-year certification cycle plus surveillance means an auditor can sample a disposal from two years ago, so records must outlive the audit window and any statutory retention period attached to the data that was destroyed. Set the retention period for the records in the same policy that sets it for the data.

Getting the documents in place

ISO 27001 secure disposal is a documentation problem wearing a hardware costume. The physical destruction is usually outsourced and usually competent; what fails audit is the policy that maps classification to method, the register that reconciles to the asset inventory, and the verification signature that proves someone looked at the outcome. Three controls, three evidence trails, one set of documents.

If you would rather start from a drafted baseline than a blank page, the ISO 27001 Toolkit ($149) includes 165 templates covering the Annex A control set alongside the clause 4 to 10 documentation, so the disposal policy, asset register and records arrive pre-aligned with the Statement of Applicability rather than being retro-fitted to it. The full standard, including the climate amendment, is available from ISO.