Equipment Disposal and Reuse Record Template (ISO/IEC 27001 A.7.14)

Equipment Disposal and Reuse Record: [Organization name]

Procedure and log for sanitising, reusing and disposing of equipment and storage media so that no information can be recovered once an asset leaves its current use. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.7.10 (storage media) and A.7.14 (secure disposal or re-use of equipment), with A.8.10 (information deletion) for logical storage. Sanitisation methods follow the clear, purge and destroy model of NIST SP 800-88 Rev. 2 (September 2025). Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

1. Process overview

Assets awaiting sanitisation are held in a locked Z3 store and logged on the custody sheet. Target time from retirement to sanitisation: [30 days] (Example).

2. Method selection

Notes:

• Clear: logical overwrite of user-addressable storage, typically a single pass, or the manufacturer factory reset where rewriting is not supported. Multi-pass overwriting is not needed for modern media.
• Purge: techniques that also address areas not reachable by normal writes, such as a device's built-in sanitise command or cryptographic erase. Degaussing counts as purge for legacy magnetic media only.
• Destroy: physical destruction that makes the media unusable and recovery infeasible. NIST SP 800-88 Rev. 2 advises against relying on shredding or pulverising for anything but the lowest sensitivity, because modern high-density media can retain recoverable fragments; confirm the technique with your destruction supplier and IEEE 2883.
• Cryptographic erase (CE) may be used as purge only when the preconditions hold: encryption active from first use (no plaintext written before keys existed), algorithm strength of at least 128 bits and all copies of the media keys destroyed. For cloud and virtual storage, CE is often the only practical purge method; check the cloud agreement for key deletion evidence (DOC-ISMS-044).

3. Techniques by media type

4. Verification, validation and chain of custody

• Verification: the technician checks the tool or device report for successful completion on every item, and spot-reads a sample of [10%] (Example) of cleared or purged drives to confirm no readable data remains.
• Validation: for Confidential and Restricted items, a second person (IT operations lead or security team) reviews verification evidence and signs the log row.
• Chain of custody: every hand-over (user to IT, IT to store, store to supplier) is signed with date, time, asset tag and serial number. Supplier collections use locked containers with seal numbers.
• Certificates: a certificate of sanitisation (internal) or of destruction (supplier) lists, per item, asset tag, serial number, media type, method, technique, date, operator and verification result. Reject certificates that list only weights or counts.
• Suppliers: disposal suppliers are assessed with compliance/supplier-security-assessment, recorded in DOC-ISMS-066 and contracted with audit rights and serial-level certificates.

5. Size tiers

6. Disposal and reuse log

6.1 Quarterly summary

Report the summary to the ISMS manager for the measurement programme (DOC-ISMS-080). Items = clear + purge + destroy.

7. Records and evidence

8. References

Related templates: isms/physical-security-policy, compliance/asset-inventory, data/data-retention-deletion-standard, isms/cryptographic-key-register, isms/supplier-register, compliance/supplier-security-assessment, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.7.10, A.7.14 and A.8.10, and based on the public NIST SP 800-88 Rev. 2 method model. The procedure, tables and examples are original wording; no ISO/IEC or NIST text is reproduced. You need the official standards to apply the controls: https://www.iso.org/standard/82875.html. Check the current edition of each reference before use. Quillmere names are fictional. Template licence: MIT.