All 93 controls · Physical controls
Control 7.14
Secure disposal or re-use of equipment
What ISO/IEC 27002:2022 control 7.14 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Before equipment containing storage media is disposed of or reused, it is to be checked to confirm that sensitive data and licensed software have been removed or securely overwritten. Purpose: stop information leaking from equipment that is disposed of or reused. Guidance: check whether equipment contains storage media before disposal or reuse. Where media hold confidential or copyright material, either the media are destroyed physically or the data is destroyed, deleted or overwritten with techniques that make it unrecoverable instead of a standard delete (see 7.10 for media disposal and 8.10 for deletion). Remove labels and markings that identify the organization or show classification, owner, system or network before disposal, including resale or charitable donation. At the end of a lease or when moving out, consider removing security controls such as access control or surveillance equipment, depending on lease terms to restore the premises, the chance that systems holding sensitive data are left behind such as user access lists or video for the next tenant, and whether the controls can be reused elsewhere. Other information: damaged equipment with storage media may need a risk assessment to decide between destruction and repair or discard; careless disposal or reuse compromises information; full-disk encryption reduces disclosure risk if it covers the whole disk including slack space and swap, uses keys long enough to resist brute force, and keeps the keys confidential and off the same disk (8.24); overwriting techniques depend on the media technology and classification, so tools should be checked for suitability; ISO/IEC 27040 covers media sanitization methods.
Purpose in the standard’s terms, in our words: Prevents leakage of information from equipment that is disposed of or reused.
Attribute values in one line: Preventive; Confidentiality; Protect; Physical security, Asset management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | Confidentiality |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- A disposal and reuse procedure requiring verification that equipment is checked for storage media and sanitized
- Sanitization or destruction certificates identifying each device, method used and verifier
- Evidence that sanitization tools were validated for the media technology (for example SSD versus HDD)
- Records showing organizational labels and classification markings removed before resale or donation
- Full-disk encryption configuration and key management evidence for devices being redeployed
- Premises exit checklists covering removal of access control and surveillance systems holding sensitive data
Where audits commonly find gaps
- Devices are resold or donated after a standard format only
- SSDs are wiped with tools designed for spinning disks
- Printers, copiers and network devices with internal storage are overlooked
- Access control systems with user lists are left behind at the end of a lease
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.2.7) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.