Before equipment containing storage media is disposed of or reused, it is to be checked to confirm that sensitive data and licensed software have been removed or securely overwritten. Purpose: stop information leaking from equipment that is disposed of or reused. Guidance: check whether equipment contains storage media before disposal or reuse. Where media hold confidential or copyright material, either the media are destroyed physically or the data is destroyed, deleted or overwritten with techniques that make it unrecoverable instead of a standard delete (see 7.10 for media disposal and 8.10 for deletion). Remove labels and markings that identify the organization or show classification, owner, system or network before disposal, including resale or charitable donation. At the end of a lease or when moving out, consider removing security controls such as access control or surveillance equipment, depending on lease terms to restore the premises, the chance that systems holding sensitive data are left behind such as user access lists or video for the next tenant, and whether the controls can be reused elsewhere. Other information: damaged equipment with storage media may need a risk assessment to decide between destruction and repair or discard; careless disposal or reuse compromises information; full-disk encryption reduces disclosure risk if it covers the whole disk including slack space and swap, uses keys long enough to resist brute force, and keeps the keys confidential and off the same disk (8.24); overwriting techniques depend on the media technology and classification, so tools should be checked for suitability; ISO/IEC 27040 covers media sanitization methods.
This control maps to 61 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 7.14 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 61 it maps to, and the evidence behind each claim, over MCP and REST.