ISO 27001 A.7.14: Verify secure equipment disposal and reuse

What A.7.14 requires in practice

A.7.14 applies to any item of equipment that contains storage media and is about to be disposed of or given a new use. The control asks for verification, which is more than an instruction to wipe. Before the item leaves its current owner, someone must check that sensitive data and any licensed software have been removed or securely overwritten.

Read in practice, the control has three parts:

• know which equipment holds storage, including items nobody thinks of as computers;
• apply a treatment that suits the medium and the sensitivity of what it held;
• confirm the result before release, whether the destination is resale, donation, return to a lessor, destruction or internal reassignment.

The outputs are an authorised release decision for each item and evidence that treatment worked. The clause text speaks of removal or secure overwriting; the choice of method is the organisation's. One way Sterling's teams approach it is to tie each retired asset to a short outcome record, but that record format is a method and not a stated obligation.

Identify what the equipment retains

Start by determining whether the equipment contains storage and what information may remain. Obvious computers are only part of the population. Shared office devices, network equipment and security systems can retain records, configuration details or credentials. A device's inability to start normally does not establish that its stored information is inaccessible.

Identify information that must be preserved before treatment. Retirement should not destroy records subject to a valid retention need or hold. Confirm the destination too: internal reuse, return to a lessor, resale, donation and destruction create different circumstances. Reassignment within the same company can still expose information to an unauthorised user.

Select a suitable treatment and verify it

Choose the method using the medium, sensitivity, technical condition and intended destination, with competent advice where necessary. Ordinary file deletion or an unverified reset should not be assumed sufficient. Different storage technologies and failure conditions can affect the available treatment and the evidence needed to establish its result.

Verification should answer whether the identified item received the intended treatment successfully. Decide who can confirm the result and who can authorise release. The task is not complete simply because a tool ran or a disposal provider collected the equipment. Failed treatment or uncertain evidence needs an explicit decision, with the item kept under suitable control meanwhile.

Why verified disposal matters to the business

Retired equipment is one of the quietest routes by which customer, staff and commercial information leaves a business. A resold laptop, a returned printer or a donated tablet can expose records long after the project that created them has finished. Customers increasingly ask suppliers how end-of-life equipment is handled, and a weak answer can end a tender. A single recovered disk can trigger notification duties, contractual claims and reputational harm that dwarf the value of the equipment itself. Licensed software left on a device can also create commercial disputes with vendors. For an auditor, disposal is easy to test: a sample of retired items either has verification evidence or does not, and the gap is hard to explain away.

How to implement A.7.14

Start from the assets you already track and build a release routine that nobody can bypass by accident.

1. List every equipment type that can hold stored data, including copiers, network devices, phones and test hardware, not only computers.
2. Agree the possible destinations, such as resale, donation, lessor return, destruction or internal reassignment, and note the handling conditions each needs.
3. Check first whether any information must be kept for legal or business reasons, and preserve it before treatment begins.
4. Pick treatments by storage type and sensitivity, with competent technical input for damaged, encrypted or unusual media.
5. Give a defined role the task of confirming each result, separate from the person who carried out the treatment where practical.
6. Hold items in a controlled place until verification is complete, and decide in advance what happens to items where treatment fails.
7. Reconcile the asset list against treatment outcomes at release, and revisit the routine after any supplier or process change.

Illustrative IT example: laptops donated after replacement

Illustrative construction example: leaving a project office

A hypothetical contractor vacates a temporary project office and returns leased equipment. The team removes its laptops but overlooks an access-control unit and a multifunction device that hold user details and scanned information. The lease handover focuses on physical condition rather than information remaining in the equipment.

The closeout team identifies retained information, agrees the permitted treatment with the lessor and verifies completion before handover. It also reviews labels and markings that reveal unnecessary system or organisational details. Evidence connects the specific equipment with the agreed action and release decision. A site-wide “office cleared” statement would not demonstrate those checks.

Control custody until the final decision

Items awaiting sanitisation or destruction still require protection. A pile of retired devices in an open storeroom can aggregate substantial sensitive information. Define who can move the items, how they are identified and what happens when a planned collection is delayed.

Where a supplier performs treatment, evaluate its suitability and agree the service clearly. Reconcile collection and completion evidence with the equipment handed over, and investigate discrepancies. A general recycling certificate may demonstrate that some waste was processed without establishing the treatment of your identified storage devices.

Include software and residual system information

Relevant licensed software needs attention alongside business data. Determine what may lawfully and appropriately remain or transfer, using the organisation's licence arrangements and competent advice where needed. Do not assume that possession of the hardware automatically transfers every software entitlement.

Credentials, device registrations and system references can also remain relevant after the physical item leaves. Coordinate the retirement with the owners of associated services and access. The physical disposal decision should connect with the wider asset lifecycle so that a retired item does not remain trusted by another system.

Evidence and frequent failure modes