Equipment Disposal and Reuse Record Template (ISO/IEC 27001 A.7.14)

Sanitisation method by classification and destination, techniques by media type, verification and validation, chain of custody, certificates, disposal log

ISMS 与 ISO/IEC 27001标准ISO/IEC 27001:2022 + Amd 1:2024 A.7.10, A.7.14, A.8.10 (cited only); NIST SP 800-88 Rev. 2equipment disposal reuse record更新于 2026年11月1日

在编辑器中打开下载 .md

使用方法: Use it for every asset that stores information when it is reused, returned or disposed of. Fill the method selection matrix first so technicians know which method applies. The main pitfall is accepting destruction certificates without serial numbers, which cannot be traced to the asset inventory.

预览

Equipment Disposal and Reuse Record: [Organization name]

Procedure and log for sanitising, reusing and disposing of equipment and storage media so that no information can be recovered once an asset leaves its current use. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A controls A.7.10 (storage media) and A.7.14 (secure disposal or re-use of equipment), with A.8.10 (information deletion) for logical storage. Sanitisation methods follow the clear, purge and destroy model of NIST SP 800-88 Rev. 2 (September 2025). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-057
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@it-ops-lead]
Approvers/reviewers	[@isms-manager], [@ciso], [@data-protection-lead]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024, A.7.10, A.7.14, A.8.10; ISO/IEC 27002:2022; ISO/IEC 27040:2024; NIST SP 800-88 Rev. 2
Next scheduled review	YYYY-MM-DD
Disposal suppliers	[Supplier ID in DOC-ISMS-066]
Parent policy	DOC-ISMS-055 Physical security policy

Approvals

Role	Name	Decision	Date
Owner	[@it-ops-lead]	[Prepared]	YYYY-MM-DD
ISMS manager	[@isms-manager]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	YYYY-MM-DD	[@it-ops-lead]	First issue
1.1 (Example)	YYYY-MM-DD	[@it-ops-lead]	Updated to NIST SP 800-88 Rev. 2 method model; cryptographic erase preconditions added

1. Process overview

Assets awaiting sanitisation are held in a locked Z3 store and logged on the custody sheet. Target time from retirement to sanitisation: [30 days] (Example).

2. Method selection

Highest classification held	Reuse inside organization	Leaves organization control (resale, donation, lease return, warranty swap)	End of life
Public or Internal	Clear	Purge	Purge, or destroy if purge cannot be verified
Confidential	Purge	Purge	Destroy
Restricted	Purge	Purge with second-person validation, or destroy	Destroy

Notes:

Clear: logical overwrite of user-addressable storage, typically a single pass, or the manufacturer factory reset where rewriting is not supported. Multi-pass overwriting is not needed for modern media.
Purge: techniques that also address areas not reachable by normal writes, such as a device's built-in sanitise command or cryptographic erase. Degaussing counts as purge for legacy magnetic media only.
Destroy: physical destruction that makes the media unusable and recovery infeasible. NIST SP 800-88 Rev. 2 advises against relying on shredding or pulverising for anything but the lowest sensitivity, because modern high-density media can retain recoverable fragments; confirm the technique with your destruction supplier and IEEE 2883.
Cryptographic erase (CE) may be used as purge only when the preconditions hold: encryption active from first use (no plaintext written before keys existed), algorithm strength of at least 128 bits and all copies of the media keys destroyed. For cloud and virtual storage, CE is often the only practical purge method; check the cloud agreement for key deletion evidence (DOC-ISMS-044).

3. Techniques by media type

Media type	Clear technique (Example)	Purge technique (Example)	Destroy route	Notes
Hard disk drives (HDD)	Single-pass overwrite with approved tool	Drive sanitise command or degauss (legacy magnetic)	Supplier destruction, serial-level certificate	Remove from chassis for destroy
SSD and NVMe drives	Overwrite via approved tool	Sanitise command (block erase or crypto) supported by the drive	Supplier destruction suited to flash media	Check the drive reports sanitise completion
Laptops with encrypted SSD	Not used	CE plus device reset through MDM	As SSD	Confirm encryption was enabled from first use
Phones and tablets	Factory reset	MDM remote wipe with CE (device encryption by default)	Supplier destruction	Remove from MDM and account locks after wipe
USB drives and memory cards	Overwrite	Usually not verifiable	Destroy	Cheap media: destroy by default
Optical media	Not possible	Not possible	Destroy	Confidential waste supplier
Multifunction printers	Device data overwrite feature	Vendor secure erase of internal storage	Remove storage and destroy	Do this before lease return
Network and OT devices	Factory reset	Vendor secure erase where available	Destroy storage module	Revoke certificates and credentials first
Cloud volumes and object storage	Delete	CE through key deletion in the key management service	Not applicable	Record key IDs destroyed (DOC-ISMS-070)
Paper	Not applicable	Not applicable	Cross-cut shredding or confidential waste service	See DOC-ISMS-056

4. Verification, validation and chain of custody

Verification: the technician checks the tool or device report for successful completion on every item, and spot-reads a sample of [10%] (Example) of cleared or purged drives to confirm no readable data remains.
Validation: for Confidential and Restricted items, a second person (IT operations lead or security team) reviews verification evidence and signs the log row.
Chain of custody: every hand-over (user to IT, IT to store, store to supplier) is signed with date, time, asset tag and serial number. Supplier collections use locked containers with seal numbers.
Certificates: a certificate of sanitisation (internal) or of destruction (supplier) lists, per item, asset tag, serial number, media type, method, technique, date, operator and verification result. Reject certificates that list only weights or counts.
Suppliers: disposal suppliers are assessed with compliance/supplier-security-assessment, recorded in DOC-ISMS-066 and contracted with audit rights and serial-level certificates.

5. Size tiers

Topic	Small: Quillmere Analytics Ltd	Medium: Quillmere Health Systems	Large: Quillmere Group
Typical volume	Laptops and phones only; no servers (production is in the public cloud)	Laptops, colocation servers and drives, printers	All media types, including OT controllers at 3 plants
Main method	MDM wipe with CE, reuse internally; supplier destruction collection [twice a year], items awaiting it kept in the locked store and counted as open	Purge for reuse, supplier destruction quarterly with on-site witness	Site-level procedures, group framework contract with destruction suppliers, quarterly consolidated report
Cloud	CE through key deletion when tenants leave, evidence from provider and key logs	Same, plus colocation drive destruction	Same, plus data centre drive destruction programme
Validation	ISMS manager (0.5 FTE) signs Confidential rows	Security team member signs	Site IT lead signs, security office samples [5%]

6. Disposal and reuse log

Log ID	Date	Asset tag	Serial	Media type	Highest class	Destination	Method	Technique	Verified by	Validated by	Certificate	Inventory updated
DSP-001 (Example)	2027-02-03	LT-0412	[serial]	Laptop SSD	Confidential	Reuse inside	Purge	CE plus MDM reset	[@tech-a]	[@it-ops-lead]	CERT-INT-0091	Yes
DSP-002 (Example)	2027-02-03	PH-0177	[serial]	Phone	Internal	Reuse inside	Clear	Factory reset via MDM	[@tech-a]	Not required	CERT-INT-0092	Yes
DSP-003 (Example)	2027-02-17	SRV-0031-D2	[serial]	Server HDD	Restricted	End of life	Destroy	Supplier destruction, witnessed	[@tech-b]	[@security-analyst]	CERT-SUP-2027-014 line 7	Yes
DSP-004 (Example)	2027-03-09	MFP-0004	[serial]	Printer internal storage	Confidential	Lease return	Purge	Vendor secure erase	[@tech-b]	[@it-ops-lead]	CERT-INT-0097	Yes
DSP-005 (Example)	2027-03-22	VOL-PRD-118	[key ID]	Cloud volume	Restricted	Decommissioned	Purge	CE: key destroyed in key management service	[@cloud-engineer]	[@security-analyst]	KMS deletion log	Yes
[DSP-NNN]	YYYY-MM-DD	[tag]	[serial]	[type]	[class]	[destination]	[method]	[technique]	[@name]	[@name]	[ref]	[Yes / No]

6.1 Quarterly summary

Quarter	Items	Clear	Purge	Destroy	Verification failures re-done	Open over 30 days
2027 Q1 (Example)	64	18	31	15	2	1

Report the summary to the ISMS manager for the measurement programme (DOC-ISMS-080). Items = clear + purge + destroy.

7. Records and evidence

Record	Owner	Location	Retention
Disposal and reuse log (section 6)	IT operations lead	[Asset tool or ticketing system]	[6 years] (Example, align with the retention schedule)
Tool and device sanitisation reports	Technician	Attached to log row	Same as log
Certificates of sanitisation and destruction	IT operations lead	[Document system]	Same as log
Chain of custody sheets and seal numbers	IT operations lead	[Document system]	Same as log
Supplier assessment and contract	Supplier owner	DOC-ISMS-066, DOC-ISMS-067	Contract plus [3 years]

8. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	2022, Amd 1 2024-02-23	A.7.10, A.7.14, A.8.10. https://www.iso.org/standard/82875.html
ISO/IEC 27002:2022	2022	Control guidance. https://www.iso.org/standard/75652.html
ISO/IEC 27040:2024	2024	Storage security, sanitisation. https://www.iso.org/standard/80194.html
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization	September 2025 (FAQ July 2026)	Sanitisation programme, clear, purge, destroy, verification and validation. https://csrc.nist.gov/pubs/sp/800/88/r2/final
IEEE 2883	Check the current edition	Media-specific sanitisation techniques referenced by NIST SP 800-88 Rev. 2

Related templates: isms/physical-security-policy, compliance/asset-inventory, data/data-retention-deletion-standard, isms/cryptographic-key-register, isms/supplier-register, compliance/supplier-security-assessment, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.7.10, A.7.14 and A.8.10, and based on the public NIST SP 800-88 Rev. 2 method model. The procedure, tables and examples are original wording; no ISO/IEC or NIST text is reproduced. You need the official standards to apply the controls: https://www.iso.org/standard/82875.html. Check the current edition of each reference before use. Quillmere names are fictional. Template licence: MIT.