ISO 27001 A.7.14: Secure disposal or re-use of equipment

Write a secure disposal and reuse policy that defines sanitisation requirements for every equipment type. Align the requirements with information classification and follow a recognised standard like NIST SP 800-88. Define approved sanitisation methods by equipment type. For HDDs: use certified wiping software that overwrites the entire drive (multiple passes for higher-sensitivity data), degauss with certified equipment, or physically shred or crush the drive. For SSDs: use the manufacturer's secure erase function, apply cryptographic erasure (destroy the encryption key), or physically destroy - standard overwriting is unreliable on SSDs due to wear-levelling. For printers and copiers: factory reset to clear internal storage, or remove and destroy the internal hard drive. For mobile devices: ensure the device is encrypted, then factory reset and verify the reset completed properly. For network equipment: clear all configuration data including stored credentials, certificates, and VPN keys. Set up a clear disposal workflow. Raise a disposal request with the equipment identifier, reason for disposal, and data classification. Confirm all data has been backed up or migrated before sanitisation begins. Perform sanitisation using the approved method. Verify success with a verification tool - do not just trust that it worked. Document everything: method used, date, who did it, verification result. Update the asset register to reflect the disposal. For third-party disposal, choose reputable providers with certifications like ADISA or NAID. Put security requirements in the contract. Require destruction certificates for every item. Audit your disposal provider periodically. Decide whether the risk warrants on-site destruction or whether off-site processing is acceptable given the provider's controls. Do not forget software licences. Recover and reassign licences where permitted. Remove licence keys and deactivate registrations. Follow the software vendor's terms regarding transfer or disposal.