Verify that any sensitive data and licensed software is securely removed or destroyed before equipment is disposed of or reused, so nothing recoverable leaves your control.
Mapping at a glance
A.7.14Secure disposal or re-use of equipmentISO/IEC 27001:2022
What an auditor, or Sekit's evidence engine, asks for.
Data retention and disposal procedure
The rules on how long data is kept and how it is securely destroyed when no longer needed.
From the Sekit evidence catalog
In practice
The moment this control gets tested is when a laptop is sold, donated or returned to a leasing company, and auditors want proof that whatever was on it is gone before it left the building. A stated retention and disposal schedule is not enough on its own; the practical requirement is a wipe report or destruction certificate tied to a specific device, kept somewhere retrievable. The common gap is devices moving fast, an employee laptop reassigned the same week someone leaves, with the wipe step skipped under time pressure.
Common gaps
A leased laptop was returned to the vendor at the end of its term without a documented wipe, so there is no proof company data did not leave with the device.
The retention schedule states how long data is kept, but disposal of the underlying devices is not tracked against it, so old equipment accumulates past its stated retention period.
A reassigned laptop was handed to a new employee the same day the previous user left, with no record that a wipe or reimage happened in between.
Questions your auditor will ask
What happens to data on a device before it is sold, donated or returned?
Wiping or cryptographic-erasure tooling produces a verifiable record for every storage device destroyed or repurposed, per the data retention and disposal procedure.
How do you decide when data and the devices holding it should be destroyed?
An approved retention schedule states how long each category of data is kept and the legal minimums that apply, and the secure method used to destroy it afterward.
Are disposals logged with evidence, or only described in policy?
Disposals run on the retention schedule and cover paper, devices and digital records, with a record kept of what was destroyed, when and how.
Where regulation demands it
NIS2 art. 12.5 requires the return or secure deletion of assets when they are no longer used.
ENS mp.si.2 requires criptografía to protect information held on storage media, covering data at rest before equipment is reused or disposed of.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.