Information deletion

What the control asks

Information held in systems, devices or any other storage media is to be deleted once it is no longer needed. Purpose: avoid sensitive information being exposed unnecessarily and meet legal, regulatory and contractual deletion requirements. Guidance: sensitive information should not be kept longer than necessary, to limit unwanted disclosure. When deleting from systems, applications and services, choose a method such as electronic overwriting or cryptographic erasure that fits business needs and the law, record the results as evidence, and obtain evidence of deletion from any deletion service provider. Where an outside party holds the organization's information for it, consider writing deletion requirements into the agreements for the period of service and its end. In line with the data retention policy and the law, delete sensitive information that is no longer needed by configuring systems to destroy it securely (for example after a retention period or on a subject access request); clearing out old versions, duplicates and temporary files in every location; using approved secure deletion software so that specialist recovery or forensic tools cannot retrieve it; using approved, certified disposal providers; and using mechanisms suited to the media, such as degaussing magnetic drives. For cloud services, check whether the provider's deletion method is acceptable and use it or ask the provider to delete, automating deletion under policy where possible, with logs to track or verify deletion depending on sensitivity. Remove hard drives and memory from equipment returned to vendors before it leaves the premises. Because some devices such as smartphones can only be securely wiped by destruction or built-in reset functions, choose the method according to the classification of what they hold, and apply 7.14 when destroying devices physically. A formal deletion record helps when investigating a possible leak. Other information: ISO/IEC 27017 addresses user data deletion in cloud services and ISO/IEC 27555 addresses PII deletion.

Purpose in the standard’s terms, in our words: Prevents unnecessary exposure of sensitive information and meets legal and contractual deletion requirements.

Attribute values in one line: Preventive; Confidentiality; Protect; Information protection, Legal and compliance; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The data retention topic-specific policy with deletion triggers per information type
• Configuration of automated deletion after retention periods or on data subject requests
• Deletion logs or certificates as evidence, including from deletion service providers
• Approved secure deletion tools and methods matched to media type (overwriting, cryptographic erasure, degaussing)
• Contract clauses requiring deletion by third parties and cloud providers during and at the end of service, and confirmation records
• Procedure for removing storage and memory from equipment returned to vendors

Where audits commonly find gaps

• Information is deleted from the primary system but copies remain in backups, exports and temporary files
• No evidence of deletion is kept, so completion cannot be demonstrated
• Cloud providers' deletion methods are accepted without assessment
• Devices go back to vendors under warranty with drives still installed

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.34 Privacy and protection of PII
• 8.1 User endpoint devices
• 8.11 Data masking

Read the five attributes All 93 controls