SOC 2 CC6.5: Logical and Physical Access - Logical Access to Protected Assets

Write a formal asset disposal and data destruction policy covering all media types: hard drives, SSDs, backup tapes, USB drives, mobile devices, virtual machines, and cloud storage. Specify approved destruction methods for each media type and data classification level. Choose destruction methods based on the media and data sensitivity. Degaussing or physical destruction works for magnetic media. SSDs need cryptographic erasure or physical destruction since traditional overwriting can miss storage cells. For cloud resources, delete data from all instances, backups, and replicas, then destroy the encryption keys. Set up a chain of custody for assets waiting to be destroyed. Store them securely with limited access. Keep a log of everything in the disposal queue - asset identifiers, data classification, and who's responsible. Get certificates of destruction for every disposed asset. If you use a third-party vendor, make sure their certificates identify the specific assets, the method used, and the date of destruction. Vet the vendor's qualifications before handing them anything. Don't forget cloud resource decommissioning. When you shut down instances, databases, or storage buckets, delete data from all regions and availability zones, remove snapshots and backups, rotate or destroy encryption keys, and fully deprovision the resource. Audit the disposal process periodically. Check that every decommissioned asset has proper destruction documentation and that your active asset inventory reconciles with disposal records.