← ISO 27001 · A.7 — Physical
A.7.14 — Secure disposal or re-use of equipment
medium
media-disposaldata-deletion
Requirement
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
disposalre-usereusedecommissionwipeoverwritedispose
Required element 2 — any one of
verifiedcertificateconfirmedsanitis…sanitiz…
Supporting terms — specificity signals
nist 800-88crypto-erasedegauss…asset record updated
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| SOC 2 | CC6.5 | Disposal of physical and logical assets | media-disposal data-deletion |
| GLBA | 314.4(c)(6) | Secure disposal within two years and periodic review of retention | data-deletion media-disposal |
| GDPR | Art.5(1)(e) | Storage limitation | data-deletion |
| GDPR | Art.17 | Right to erasure (“right to be forgotten”) | data-deletion |
| CCPA/CPRA | 1798.105 | Right to delete | data-deletion |
| SOC 2 | C1.2 | Disposal of confidential information | data-deletion |
| PCI DSS 4.0.1 | 3.3 | Sensitive authentication data is not stored after authorisation | data-deletion |
| PCI DSS 4.0.1 | 9.4 | Media with cardholder data is secured and destroyed | media-disposal |