# Equipment Disposal and Reuse Record: [Organization name]

> Procedure and log for sanitising, reusing and disposing of equipment
> and storage media so that no information can be recovered once an
> asset leaves its current use. It supports ISO/IEC 27001:2022 + Amd
> 1:2024 Annex A controls A.7.10 (storage media) and A.7.14 (secure
> disposal or re-use of equipment), with A.8.10 (information deletion)
> for logical storage. Sanitisation methods follow the clear, purge and
> destroy model of NIST SP 800-88 Rev. 2 (September 2025). Replace
> every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it for every asset that stores information: laptops, desktops,
  servers, phones, tablets, removable media, multifunction printers,
  network and OT devices with storage, and cloud or virtual volumes.
- Fill section 2 (method selection) first and have it approved: it
  tells technicians which method to use without asking each time.
- The main pitfall is a certificate of destruction from a disposal
  supplier with no serial numbers. Without serials you cannot prove
  that a given drive from the asset inventory was destroyed.
- NIST SP 800-88 Rev. 2 no longer gives media-specific technique
  tables. It points to industry standards such as IEEE 2883 and to the
  device manufacturer for techniques. Write your technique choices in
  section 3 with that in mind.
- Related templates: `isms/physical-security-policy`,
  `compliance/asset-inventory`, `data/data-retention-deletion-standard`,
  `security/cryptography-standard`, `isms/offboarding-security-checklist`,
  `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: The procedure part (sections 1 to 4) is controlled; the log (section 6) is a record that grows. Version the procedure, not each log entry. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-057 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@it-ops-lead] |
| Approvers/reviewers | [@isms-manager], [@ciso], [@data-protection-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, A.7.10, A.7.14, A.8.10; ISO/IEC 27002:2022; ISO/IEC 27040:2024; NIST SP 800-88 Rev. 2 |
| Next scheduled review | YYYY-MM-DD |
| Disposal suppliers | [Supplier ID in DOC-ISMS-066] |
| Parent policy | DOC-ISMS-055 Physical security policy |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Owner | [@it-ops-lead] | [Prepared] | YYYY-MM-DD |
| ISMS manager | [@isms-manager] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@it-ops-lead] | First issue |
| 1.1 *(Example)* | YYYY-MM-DD | [@it-ops-lead] | Updated to NIST SP 800-88 Rev. 2 method model; cryptographic erase preconditions added |

## 1. Process overview

<!-- Guidance: One flow from "asset retired" to "record closed". Questions to answer: who decides between reuse and disposal? Who verifies? Pitfall: devices waiting months in an unlocked store room before sanitisation. Auditor check: pick an asset marked disposed in the inventory and trace it to a log row and a certificate. -->

```mermaid
flowchart TD
  A["Asset retired or reassigned"] --> B["Update asset inventory: status Pending sanitisation"]
  B --> C["Secure storage in Z3 with custody log"]
  C --> D{"Destination?"}
  D -- "Reuse inside organization" --> E["Method per section 2"]
  D -- "Leaves organization control" --> E
  E --> F["Sanitise: clear, purge or destroy"]
  F --> G["Verify outcome"]
  G --> H{"Verification passed?"}
  H -- "No" --> F
  H -- "Yes" --> I["Validate and sign off"]
  I --> J["Certificate and log row"]
  J --> K["Update asset inventory: Reused or Disposed"]
```

Assets awaiting sanitisation are held in a locked Z3 store and logged
on the custody sheet. Target time from retirement to sanitisation:
[30 days] *(Example)*.

## 2. Method selection

<!-- Guidance: Decide by data classification and destination, as NIST SP 800-88 Rev. 2 recommends. Questions to answer: what is the highest classification the device may have held? Will it stay in the organization? Pitfall: choosing destroy for everything (wasteful, no reuse) or clear for everything (unsafe for devices leaving control). -->

| Highest classification held | Reuse inside organization | Leaves organization control (resale, donation, lease return, warranty swap) | End of life |
|---|---|---|---|
| Public or Internal | Clear | Purge | Purge, or destroy if purge cannot be verified |
| Confidential | Purge | Purge | Destroy |
| Restricted | Purge | Purge with second-person validation, or destroy | Destroy |

Notes:

- **Clear:** logical overwrite of user-addressable storage, typically a
  single pass, or the manufacturer factory reset where rewriting is not
  supported. Multi-pass overwriting is not needed for modern media.
- **Purge:** techniques that also address areas not reachable by normal
  writes, such as a device's built-in sanitise command or cryptographic
  erase. Degaussing counts as purge for legacy magnetic media only.
- **Destroy:** physical destruction that makes the media unusable and
  recovery infeasible. NIST SP 800-88 Rev. 2 advises against relying on
  shredding or pulverising for anything but the lowest sensitivity,
  because modern high-density media can retain recoverable fragments;
  confirm the technique with your destruction supplier and IEEE 2883.
- **Cryptographic erase (CE)** may be used as purge only when the
  preconditions hold: encryption active from first use (no plaintext
  written before keys existed), algorithm strength of at least 128 bits
  and all copies of the media keys destroyed. For cloud and virtual
  storage, CE is often the only practical purge method; check the cloud
  agreement for key deletion evidence (DOC-ISMS-044).

## 3. Techniques by media type

<!-- Guidance: Record the technique your organization uses for each media type, from the manufacturer's documentation or IEEE 2883. Pitfall: forgetting printers, network devices and OT controllers, which often hold configuration secrets and cached documents. -->

| Media type | Clear technique *(Example)* | Purge technique *(Example)* | Destroy route | Notes |
|---|---|---|---|---|
| Hard disk drives (HDD) | Single-pass overwrite with approved tool | Drive sanitise command or degauss (legacy magnetic) | Supplier destruction, serial-level certificate | Remove from chassis for destroy |
| SSD and NVMe drives | Overwrite via approved tool | Sanitise command (block erase or crypto) supported by the drive | Supplier destruction suited to flash media | Check the drive reports sanitise completion |
| Laptops with encrypted SSD | Not used | CE plus device reset through MDM | As SSD | Confirm encryption was enabled from first use |
| Phones and tablets | Factory reset | MDM remote wipe with CE (device encryption by default) | Supplier destruction | Remove from MDM and account locks after wipe |
| USB drives and memory cards | Overwrite | Usually not verifiable | Destroy | Cheap media: destroy by default |
| Optical media | Not possible | Not possible | Destroy | Confidential waste supplier |
| Multifunction printers | Device data overwrite feature | Vendor secure erase of internal storage | Remove storage and destroy | Do this before lease return |
| Network and OT devices | Factory reset | Vendor secure erase where available | Destroy storage module | Revoke certificates and credentials first |
| Cloud volumes and object storage | Delete | CE through key deletion in the key management service | Not applicable | Record key IDs destroyed (DOC-ISMS-070) |
| Paper | Not applicable | Not applicable | Cross-cut shredding or confidential waste service | See DOC-ISMS-056 |

## 4. Verification, validation and chain of custody

<!-- Guidance: NIST SP 800-88 Rev. 2 separates verification (did the technique finish without error?) from validation (does the evidence meet the sensitivity, so the residual risk is accepted?). Auditor check: a sample of verification evidence, and who signed validation. -->

- **Verification:** the technician checks the tool or device report
  for successful completion on every item, and spot-reads a sample of
  [10%] *(Example)* of cleared or purged drives to confirm no readable
  data remains.
- **Validation:** for Confidential and Restricted items, a second
  person (IT operations lead or security team) reviews verification
  evidence and signs the log row.
- **Chain of custody:** every hand-over (user to IT, IT to store, store
  to supplier) is signed with date, time, asset tag and serial number.
  Supplier collections use locked containers with seal numbers.
- **Certificates:** a certificate of sanitisation (internal) or of
  destruction (supplier) lists, per item, asset tag, serial number,
  media type, method, technique, date, operator and verification
  result. Reject certificates that list only weights or counts.
- **Suppliers:** disposal suppliers are assessed with
  `compliance/supplier-security-assessment`, recorded in DOC-ISMS-066
  and contracted with audit rights and serial-level certificates.

## 5. Size tiers

<!-- Guidance: These are the library's working tiers. -->

| Topic | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Typical volume | Laptops and phones only; no servers (production is in the public cloud) | Laptops, colocation servers and drives, printers | All media types, including OT controllers at 3 plants |
| Main method | MDM wipe with CE, reuse internally; supplier destruction collection [twice a year], items awaiting it kept in the locked store and counted as open | Purge for reuse, supplier destruction quarterly with on-site witness | Site-level procedures, group framework contract with destruction suppliers, quarterly consolidated report |
| Cloud | CE through key deletion when tenants leave, evidence from provider and key logs | Same, plus colocation drive destruction | Same, plus data centre drive destruction programme |
| Validation | ISMS manager (0.5 FTE) signs Confidential rows | Security team member signs | Site IT lead signs, security office samples [5%] |

## 6. Disposal and reuse log

<!-- Guidance: One row per item. Link the asset tag to the asset inventory (DOC-ISMS-012). Keep the log tamper-evident (append-only sheet, ticketing system or asset tool). Pitfall: one row for "box of 40 drives". -->

| Log ID | Date | Asset tag | Serial | Media type | Highest class | Destination | Method | Technique | Verified by | Validated by | Certificate | Inventory updated |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DSP-001 *(Example)* | 2027-02-03 | LT-0412 | [serial] | Laptop SSD | Confidential | Reuse inside | Purge | CE plus MDM reset | [@tech-a] | [@it-ops-lead] | CERT-INT-0091 | Yes |
| DSP-002 *(Example)* | 2027-02-03 | PH-0177 | [serial] | Phone | Internal | Reuse inside | Clear | Factory reset via MDM | [@tech-a] | Not required | CERT-INT-0092 | Yes |
| DSP-003 *(Example)* | 2027-02-17 | SRV-0031-D2 | [serial] | Server HDD | Restricted | End of life | Destroy | Supplier destruction, witnessed | [@tech-b] | [@security-analyst] | CERT-SUP-2027-014 line 7 | Yes |
| DSP-004 *(Example)* | 2027-03-09 | MFP-0004 | [serial] | Printer internal storage | Confidential | Lease return | Purge | Vendor secure erase | [@tech-b] | [@it-ops-lead] | CERT-INT-0097 | Yes |
| DSP-005 *(Example)* | 2027-03-22 | VOL-PRD-118 | [key ID] | Cloud volume | Restricted | Decommissioned | Purge | CE: key destroyed in key management service | [@cloud-engineer] | [@security-analyst] | KMS deletion log | Yes |
| [DSP-NNN] | YYYY-MM-DD | [tag] | [serial] | [type] | [class] | [destination] | [method] | [technique] | [@name] | [@name] | [ref] | [Yes / No] |

### 6.1 Quarterly summary

| Quarter | Items | Clear | Purge | Destroy | Verification failures re-done | Open over 30 days |
|---|---|---|---|---|---|---|
| 2027 Q1 *(Example)* | 64 | 18 | 31 | 15 | 2 | 1 |

Report the summary to the ISMS manager for the measurement programme
(DOC-ISMS-080). Items = clear + purge + destroy.

## 7. Records and evidence

<!-- Guidance: Map each record in the control evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033). -->

| Record | Owner | Location | Retention |
|---|---|---|---|
| Disposal and reuse log (section 6) | IT operations lead | [Asset tool or ticketing system] | [6 years] *(Example, align with the retention schedule)* |
| Tool and device sanitisation reports | Technician | Attached to log row | Same as log |
| Certificates of sanitisation and destruction | IT operations lead | [Document system] | Same as log |
| Chain of custody sheets and seal numbers | IT operations lead | [Document system] | Same as log |
| Supplier assessment and contract | Supplier owner | DOC-ISMS-066, DOC-ISMS-067 | Contract plus [3 years] |

## 8. References

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 2024-02-23 | A.7.10, A.7.14, A.8.10. https://www.iso.org/standard/82875.html |
| ISO/IEC 27002:2022 | 2022 | Control guidance. https://www.iso.org/standard/75652.html |
| ISO/IEC 27040:2024 | 2024 | Storage security, sanitisation. https://www.iso.org/standard/80194.html |
| NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization | September 2025 (FAQ July 2026) | Sanitisation programme, clear, purge, destroy, verification and validation. https://csrc.nist.gov/pubs/sp/800/88/r2/final |
| IEEE 2883 | Check the current edition | Media-specific sanitisation techniques referenced by NIST SP 800-88 Rev. 2 |

Related templates: `isms/physical-security-policy`,
`compliance/asset-inventory`, `data/data-retention-deletion-standard`,
`isms/cryptographic-key-register`, `isms/supplier-register`,
`compliance/supplier-security-assessment`, `isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex
A controls A.7.10, A.7.14 and A.8.10, and based on the public NIST SP
800-88 Rev. 2 method model. The procedure, tables and examples are
original wording; no ISO/IEC or NIST text is reproduced. You need the
official standards to apply the controls:
https://www.iso.org/standard/82875.html. Check the current edition of
each reference before use. Quillmere names are fictional. Template
licence: MIT.