ISO 27001 Annex A 7.14 Secure disposal or re-use of equipment
What it says
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure device data is erased or secured before disposal or reuse to prevent data breaches.
This control is about making sure that any device you want to throw away or give to someone else has all its data completely wiped clean. If you don't do this, someone could find your sensitive information and use it against you.
Free. Save your status, tasks and notes.
Why it matters
Failing to securely erase devices can cause data breaches or licensing issues, exposing sensitive information to unauthorised parties.
How to implement
IT Manager: Develop a clear process for wiping data from old computers, phones, or any other devices with storage before they leave the organisation.
Use software tools that overwrite data multiple times-this makes sure the data is not just 'deleted' but really gone.
Office Manager: Before you sell or donate any of your office equipment, make sure to check whether it still has storage media inside.
Remove any labels or stickers that say who owns it to keep this information private.
Procurement: Whenever you buy new equipment, ensure it comes with the tools and instructions needed for secure data wiping when it's time to replace it.
This helps plan for future secure disposal or re-use from the start.
HR Department: Make employees aware of the importance of secure data disposal.
Train them to report any old equipment so it can be handled correctly by the IT department.
Compliance Officer: Reference applicable local data protection laws like the Privacy Act 1988 and CPS 234 to ensure compliance with data handling requirements.
This will help avoid legal issues related to data breaches.
Keep it running
Train staff in secure disposal. Before re-use or disposal, verify data removal and use approved wiping or destruction methods; keep disposal logs and certificates from recyclers.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Evidence of a data disposal policy.
Look at
The specific steps outlined for data wiping and disposal.
Good evidence
Clear procedures with defined responsibilities and tools for secure data erasure.
- Check 2 of 5What an auditor asks for
Ask for
To see records of disposed equipment.
Look at
The method and date of data wiping entries.
Good evidence
A log that matches with the organisation's policy on data disposal.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the data wiping software.
Look at
How the software ensures data cannot be recovered.
Good evidence
A reputable tool with certifications or evaluations (e.g., ISO standards) showing it does a thorough data wipe.
- Check 4 of 5What an auditor asks for
Ask for
To see training records for employees on data disposal processes.
Look at
The frequency and content of the training sessions.
Good evidence
Regular, detailed sessions that cover the importance and methods of data wiping.
- Check 5 of 5What an auditor asks for
Ask for
To inspect the physical disposal or recycling facilities.
Look at
How and where equipment is stored before disposal.
Good evidence
Secure storage with access control until data is verified as wiped.
Mappings
Closest match in ASD Information Security Manual: ISM-0311, Ensuring sanitisation of IT equipment media, which asks for the same thing.
ASD Information Security Manual: 56 mappings
This control is equivalent to ISM-0311.
Annex A 7.14 and ISM-0311 both focus on ensuring sensitive data is not left on media through secure sanitisation processes. While ISM-0311 is more specific about the sanitisation methods, Annex A 7.14 includes verification requirements.
This control is broader than ISM-0312.
ISM-0312 requires that overseas IT equipment (including associated media) that has processed, stored or communicated AUSTEO or AGAO data and cannot be sanitised in situ is returned to Australia for destruction. Annex A 7.14 addresses secure disposal or re-use by requiring verification that sensitive data and licensed software are removed or securely overwritten prior to disposal or re-use. ISM-0312 is a specific procedural/geographical treatment for a high-sensitivity scenario, whereas Annex A 7.14 is a broader general requirement for disposal or re-use regardless of location.
This control is broader than ISM-0317.
ISM-0317 requires printing at least three full pages of random text (with no blank areas) on each colour printer cartridge or MFD print drum to purge residual image/data held on the consumable. This relates directly to Annex A 7.14, which requires verification that sensitive data has been removed or securely overwritten before equipment is disposed of or re-used, including components that can retain data. ISM-0317 is a very specific, prescriptive method for a particular device/medium, whereas Annex A 7.14 is broader and technology-neutral across equipment disposal and re-use.
This control is broader than ISM-0318.
ISM-0318 requires destruction of printer cartridges or print drums when sanitisation is not possible to prevent residual data exposure. This aligns with Annex A 7.14, which requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use. Annex A 7.14 is broader in covering all equipment with storage media and allowing sanitisation/overwrite approaches, while ISM-0318 specifies destruction for these printer components when sanitisation cannot be performed.
This control is broader than ISM-0351.
ISM-0351 requires volatile media to be sanitised by removing power for at least 10 minutes. Annex A 7.14 requires equipment containing storage media to be verified to ensure sensitive data is removed or securely overwritten before disposal or re-use. ISM-0351 can contribute to meeting the 'data removed' expectation for volatile memory components, but Annex A 7.14 is broader and is primarily oriented to disposal/re-use verification rather than prescribing a volatile-memory-specific technique.
This control is broader than ISM-0352.
ISM-0352 mandates a specific sanitisation technique for SECRET and TOP SECRET volatile media: full overwrite with random data followed by verification. Annex A 7.14 requires equipment with storage media to be verified as having sensitive data removed or securely overwritten prior to disposal or re-use, which is the same end-goal of making data unrecoverable. ISM-0352 is narrower because it prescribes the overwrite-and-verify approach (and applies to volatile media and certain classifications), while Annex A 7.14 is broader and allows multiple secure removal methods and applies to disposal/re-use contexts generally.
This control is broader than ISM-0354.
ISM-0354 mandates a specific, verifiable overwriting process to sanitise non-volatile magnetic media so that prior data cannot be accessed. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data has been removed or securely overwritten before equipment disposal or re-use, directly aligning with the intent of sanitisation. ISM-0354 is narrower because it prescribes detailed overwrite pass counts and read-back verification for magnetic media, while Annex A 7.14 applies more generally to any equipment with storage media and allows multiple secure removal approaches.
This control is broader than ISM-0357.
ISM-0357 requires a specific sanitisation method for non-volatile EPROM media, including extended UV erasure and a full overwrite with verification. Annex A 7.14 requires equipment containing storage media to be verified as having sensitive data removed or securely overwritten before disposal or re-use, which is the broader lifecycle/disposal requirement that EPROM sanitisation can satisfy. ISM-0357 is technology- and method-specific (EPROM + UV + overwrite), while Annex A 7.14 is media-agnostic and outcome-focused.
This control is broader than ISM-0359.
ISM-0359 offers a detailed approach for flash memory sanitisation, supporting the overall data removal goals of Annex A 7.14.
This control is broader than ISM-0361.
ISM-0361 focuses on ensuring effective destruction of magnetic media, thereby supporting Annex A 7.14's goal of preventing data leakage during disposal or re-use.
This control is broader than ISM-0362.
ISM-0362 ensures quality control in degaussing as a sanitisation method, which supports the broader data removal requirement of Annex A 7.14.
This control is broader than ISM-0368.
ISM-0368 requires physical destruction of media such that waste particles are no larger than 9 mm to prevent data recovery. This relates to Annex A 7.14 because secure disposal/re-use of equipment includes ensuring storage media is sanitised so sensitive data cannot be recovered. Annex A 7.14 is broader (it allows secure overwrite/verification and covers re-use as well as disposal), while ISM-0368 is a specific physical destruction criterion.
This control is broader than ISM-0836.
Annex A 7.14 requires ensuring sensitive data is removed or securely overwritten from storage media before equipment disposal or re-use. ISM-0836 provides a specific sanitisation method for non-volatile EEPROM (overwrite with random pattern and verify by read-back) that implements Annex A 7.14 for that media type. ISM-0836 does not cover other media types, procedural verification for all equipment, or licensed software removal explicitly mentioned in Annex A 7.14.
This control is broader than ISM-1065.
ISM-1065 requires organisations to reset the host-protected area (HPA) and device configuration overlay (DCO) on non-volatile magnetic hard drives before sanitisation so that hidden regions are not missed. Annex A 7.14 requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use, which is strengthened by ensuring the entire disk is addressable and included in the wipe. Annex A 7.14 is broader and outcome-focused across equipment disposal, while ISM-1065 is a specific technical pre-sanitisation step for certain hard drive features.
This control is broader than ISM-1067.
Annex A 7.14 requires ensuring sensitive data is removed or securely overwritten from storage media prior to disposal or re-use. ISM-1067 specifies a particular technical method (ATA secure erase plus block overwriting) to ensure non-volatile magnetic HDD defect areas are overwritten, which is one way to meet Annex A 7.14 for that media type. ISM-1067 does not address broader equipment classes, reuse/disposal processes, or licensed software removal beyond the data sanitisation technique.
This control is broader than ISM-1076.
ISM-1076 requires televisions and computer monitors with minor burn-in or image persistence to be sanitised by displaying a solid white image for an extended period. This is a specific sanitisation technique for removing residual sensitive information from display equipment, which aligns with the Annex A 7.14 requirement to verify that sensitive data has been removed or overwritten before equipment is disposed of or re-used. Annex A 7.14 covers all equipment containing storage media, while ISM-1076 addresses only residual images on displays.
This control is broader than ISM-1160.
Annex A 7.14 requires ensuring sensitive data is removed or securely overwritten before equipment containing storage media is disposed of or re-used. ISM-1160 specifies a particular requirement for degaussing-based media destruction-use NSA-evaluated degaussers-which is one acceptable destruction approach consistent with Annex A 7.14's intent. ISM-1160 is limited to one destruction tool class and does not cover reuse, broader sanitisation methods, or licensed software removal.
This control is broader than ISM-1218.
ISM-1218 requires IT equipment (and associated media) located overseas that has handled AUSTEO or AGAO data to be sanitised in situ. ISO/IEC 27001:2022 Annex A 7.14 covers secure disposal or re-use of equipment by verifying sensitive data is removed or securely overwritten before disposal or re-use, which includes sanitisation outcomes. ISM-1218 is a specific situational requirement (overseas location + particular Australian government data types + in situ sanitisation), while Annex A 7.14 is broader and not location- or classification-specific.
This control is broader than ISM-1219.
ISM-1219 requires MFD print drums and image transfer rollers to be inspected and destroyed if remnant toner cannot be removed or an image is visible, to prevent unintended disclosure of printed information. Annex A 7.14 requires secure disposal or re-use of equipment by ensuring sensitive data is removed or overwritten from storage media prior to disposal or re-use. ISM-1219 is a specific, printer-component implementation of secure disposal/sanitisation concepts, but it focuses on non-traditional "residual image/toner" leakage rather than general storage media handling.
This control is broader than ISM-1220.
ISM-1220 requires organisations to inspect printer and MFD platens and destroy them if any text or images are retained. This relates to Annex A 7.14 because retained images on a platen represent residual sensitive information on equipment that must be removed or securely eliminated before disposal or re-use. Annex A 7.14 is broader, covering all equipment containing storage media and the full disposal/re-use process, whereas ISM-1220 is a specific physical residual-information control for printer platen surfaces.
This control is broader than ISM-1221.
Annex A 7.14 requires verification that sensitive data is removed prior to disposal or re-use of equipment containing storage media. ISM-1221 (as stated) requires printers/MFDs be checked for trapped pages due to paper jams, which supports secure disposal/reuse by ensuring residual sensitive hardcopy output is not left inside devices. ISM-1221 addresses physical page remnants rather than sanitising digital storage media or removing licensed software, so it is supportive rather than directly equivalent to Annex A 7.14.
This control is broader than ISM-1222.
ISM-1222 requires televisions and computer monitors that cannot be sanitised to be physically destroyed to prevent residual data compromise. Annex A 7.14 requires secure disposal or re-use of equipment by verifying sensitive data and licensed software are removed or securely overwritten before disposal or re-use. ISM-1222 is a specific, stricter end-of-life treatment for a particular equipment class when sanitisation is not possible, whereas Annex A 7.14 covers broader equipment disposal scenarios and includes re-use/overwrite pathways.
This control is broader than ISM-1223.
ISM-1223 requires network device memory to be sanitised using device-specific evaluation guidance, vendor sanitisation guidance, or a dummy configuration plus factory reset and firmware reinstallation. Annex A 7.14 requires verifying that sensitive data and licensed software have been removed or securely overwritten prior to disposal or re-use of equipment containing storage media. ISM-1223 is a specific sanitisation method set for network devices, while Annex A 7.14 is broader across equipment types and disposal/re-use scenarios.
This control is broader than ISM-1641.
ISM-1641 requires that after degaussing, magnetic media is physically damaged (e.g. deforming internal platters) to prevent any possibility of data recovery. This relates to Annex A 7.14 because secure disposal/re-use requires ensuring storage media does not retain sensitive data when equipment is disposed or re-used, and physical destruction is one recognised method for meeting that outcome. Annex A 7.14 is broader and technology-agnostic (covering various sanitisation methods and equipment types), while ISM-1641 is a specific, prescriptive requirement for degaussed magnetic media.
This control is broader than ISM-1726.
ISM-1726 requires optical disks to be physically destroyed using specific methods (e.g. incineration, disintegration, grinding or cutting) to ensure data is unreadable. ISO/IEC 27001:2022 Annex A 7.14 requires storage media in equipment to have sensitive data removed or securely overwritten before disposal or re-use, which can be achieved via destruction for applicable media types. ISM-1726 is a specific, prescriptive implementation focused on optical disks, whereas Annex A 7.14 is broader and technology-agnostic across equipment and media types.
This control is broader than ISM-1727.
ISM-1727 requires semiconductor memory to be physically destroyed using specialised destruction methods (e.g., furnace/incinerator, hammer mill, or disintegrator) to prevent data recovery. Annex A 7.14 mandates that sensitive data and licensed software be removed or securely overwritten before equipment is disposed of or re-used. It can be achieved via destruction where overwrite is not feasible. Annex A 7.14 is broader because it covers disposal and re-use of equipment generally, while ISM-1727 is a specific, prescriptive method for destroying semiconductor memory.
This control partially meets ISM-0373.
ISM-0373 requires personnel supervising destruction of media storing accountable material to supervise handling through to destruction, verify destruction success, and sign a destruction certificate. This relates to Annex A 7.14 because both address secure disposal/handling of equipment and media to prevent residual sensitive data exposure. Annex A 7.14 is broader, covering verification of removal/secure overwrite prior to disposal or re-use, whereas ISM-0373 is specifically about supervised destruction of accountable material and formal certification of that destruction.
This control partially overlaps ISM-0161.
ISM-0161 requires IT equipment and media to be secured when not in use to prevent unauthorised access. ISO/IEC 27001:2022 Annex A 7.14 overlaps by addressing secure disposal or re-use of equipment containing storage media, ensuring data is removed or overwritten when equipment leaves service. ISM-0161 is about safeguarding assets during periods of non-use, whereas Annex A 7.14 is about end-of-life and transition controls rather than day-to-day physical security.
This control partially overlaps ISM-0307.
ISM-0307 requires sanitising IT equipment and any associated media before maintenance or repair when the technician is not appropriately cleared. This overlaps with Annex A 7.14, which requires verifying that sensitive data is removed or securely overwritten before equipment is disposed of or reused. However, ISM-0307 is triggered by third-party/uncleared maintenance access, while Annex A 7.14 is about end-of-life or reallocation.
This control partially overlaps ISM-0313.
ISM-0313 requires organisations to develop, implement and maintain IT equipment sanitisation processes and procedures. Annex A 7.14 overlaps by requiring verification that sensitive data and licensed software are removed or securely overwritten before equipment disposal or re-use, which is a core sanitisation outcome. ISM-0313 is more procedure/process-governance oriented (including maintaining sanitisation procedures), while Annex A 7.14 is more outcome/verification oriented specifically at the disposal or re-use point.
This control partially overlaps ISM-0315.
ISM-0315 requires that high assurance IT equipment is destroyed prior to disposal to prevent any data leakage. Annex A 7.14 requires verification that sensitive data and licensed software have been removed or securely overwritten before equipment disposal or re-use. They align on secure end-of-life handling to prevent information compromise, but ISM-0315 is stricter and specific to high assurance equipment destruction, whereas Annex A 7.14 allows secure sanitisation and also covers re-use.
This control partially overlaps ISM-0316.
ISM-0316 requires that, after sanitisation, destruction or declassification, a formal administrative decision authorises releasing IT equipment (or its waste) into the public domain. ISO/IEC 27001:2022 Annex A 7.14 directly relates by requiring verification that sensitive data and licensed software are removed/securely overwritten before disposal or re-use. They overlap on preventing data leakage during disposal, but ISM-0316 uniquely emphasises the formal release decision step, while Annex A 7.14 uniquely emphasises the technical verification of data/software removal.
This control partially overlaps ISM-0321.
ISM-0321 requires the organisation to contact ASD for disposal requirements when disposing of emanation security (TEMPEST-like) equipment. ISO/IEC 27001:2022 Annex A 7.14 focuses on verifying that sensitive data and licensed software are removed or securely overwritten before equipment disposal or re-use. They overlap in the disposal assurance objective, but ISM-0321 is about obtaining ASD-mandated handling requirements for specialised equipment (which may include physical destruction or controlled processes), while Annex A 7.14 is specifically about data/software sanitisation verification.
This control partially overlaps ISM-0330.
ISM-0330 requires that before media is reclassified to a lower sensitivity or classification, it is sanitised or destroyed and a formal administrative decision is made to reclassify it. ISO/IEC 27001:2022 Annex A 7.14 aligns with the sanitisation aspect by requiring verification that sensitive data is removed or securely overwritten prior to disposal or re-use of equipment containing storage media. However, Annex A 7.14 is focused on disposal/re-use scenarios and does not include the ISM-0330 requirement for a formal decision to downgrade classification.
This control partially overlaps ISM-0350.
ISM-0350 mandates destruction of media that cannot be sanitised before disposal. Annex A 7.14 requires equipment with storage media to be verified for data removal or secure overwriting prior to disposal or re-use. Both controls focus on preventing data remanence at end-of-life. ISM-0350 specifically mandates destruction for unsanitizable media, whereas Annex A 7.14 supports verification and allows for re-use by removal or overwriting.
This control partially overlaps ISM-0360.
ISM-0360 requires that sanitised SECRET and TOP SECRET flash media still retains its classification and must continue to be treated and controlled as classified. This overlaps with ISO/IEC 27001:2022 Annex A 7.14 because it addresses secure disposal or re-use of equipment by verifying sensitive data has been removed or securely overwritten prior to disposal or re-use. The key difference is that Annex A 7.14 assumes sanitisation enables declassification for disposal/re-use decisions, whereas ISM-0360 explicitly prevents declassification for SECRET/TOP SECRET flash media even after sanitisation.
This control partially overlaps ISM-0363.
ISM-0363 requires media destruction processes and supporting procedures to be developed, implemented and maintained so media is securely destroyed when no longer required. ISO/IEC 27001:2022 Annex A 7.14 relates by requiring verification that sensitive data (and licensed software) is removed or securely overwritten prior to equipment disposal or re-use, which is a common output of media destruction procedures. ISM-0363 is broader in emphasising organisational process maturity (process/procedure lifecycle), while Annex A 7.14 is narrower and focused on end-of-life disposal/reuse checks for equipment.
This control partially overlaps ISM-0371.
ISM-0371 requires personnel to supervise the handling of media through to destruction and verify that destruction is completed successfully. Annex A 7.14 relates by requiring verification that sensitive data (and licensed software) is removed or securely overwritten before equipment is disposed of or re-used, which commonly includes destruction or sanitisation steps. The ISO control focuses on the technical/verification outcome for disposal or re-use, whereas ISM-0371 focuses on human supervision and chain-of-handling assurance during destruction activities.
This control partially overlaps ISM-0374.
ISM-0374 requires organisations to develop, implement and maintain media disposal processes and supporting procedures. Annex A 7.14 specifically requires verification that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or reused, which is a key part of media disposal. Annex A 7.14 is narrower and focused on data sanitisation on equipment for disposal/reuse, whereas ISM-0374 covers end-to-end organisational procedures (e.g. roles, authorisation, chain-of-custody, approved destruction methods and service providers) for media disposal more broadly.
This control partially overlaps ISM-0375.
ISM-0375 requires that after sanitisation, destruction or declassification, an authorised administrative decision is formally made before releasing storage media (or its waste) into the public domain. Annex A 7.14 requires verification that sensitive data and licensed software have been removed or securely overwritten prior to equipment disposal or re-use, which is a key precondition to safe public release. The ISO control focuses on technical/verification steps before disposal or re-use, whereas ISM-0375 focuses on governance and authorisation to release media/waste to the public after those steps are completed.
This control partially overlaps ISM-0378.
ISM-0378 requires removal of labels/markings from media before disposal so the media cannot be linked to an owner, classification, or prior sensitive use. ISO/IEC 27001:2022 Annex A 7.14 requires verifying that sensitive data (and licensed software) has been removed or securely overwritten before equipment disposal or re-use, addressing residual information on the media itself. Both address secure end-of-life handling, but ISM-0378 targets external identifiers on the media, whereas Annex A 7.14 targets the data content remaining on the storage media.
This control partially overlaps ISM-0835.
ISM-0835 requires that, even after sanitisation, TOP SECRET volatile media may retain its TOP SECRET classification where data persistence risk remains due to long duration or repeated writes to the same locations. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data is removed/securely overwritten before equipment disposal or re-use, which aligns with the underlying concern that sanitisation may not fully eliminate recoverable information. ISM-0835 is more specific about residual classification decisions for volatile media at TOP SECRET, whereas Annex A 7.14 is broader and focused on disposal/re-use handling rather than classification retention outcomes.
This control partially overlaps ISM-0839.
ISM-0839 requires that the destruction of media storing accountable material is not outsourced. Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten before equipment is disposed of or re-used, which addresses secure sanitisation outcomes. They overlap on the objective of preventing data exposure at end-of-life, but Annex A 7.14 does not address who performs destruction, and ISM-0839 does not specify sanitisation/verification methods like overwriting.
This control partially overlaps ISM-0947.
ISM-0947 requires that when data is manually transferred between systems in different security domains, any rewritable transfer media is sanitised after each transfer. Annex A 7.14 requires sensitive data be removed or securely overwritten from equipment/storage media prior to disposal or re-use, which aligns with the need to prevent residual data remaining on media. The key difference is that ISM-0947 is an operational, per-transfer requirement for cross-domain movement, whereas Annex A 7.14 is triggered by end-of-life or re-use events and is not specific to domain separation.
This control partially overlaps ISM-1217.
ISM-1217 requires labels and markings that could identify the owner, sensitivity or classification of IT equipment to be removed before disposal. Annex A 7.14 requires verifying that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or re-used. They overlap as both are disposal-time controls intended to prevent information compromise from disposed assets, but ISM-1217 focuses on removing visible identifiers while Annex A 7.14 focuses on sanitising storage media contents.
This control partially overlaps ISM-1361.
Annex A 7.14 requires verification that data and licensed software are removed or securely overwritten before equipment is disposed of or re-used. ISM-1361 focuses on using SCEC-approved or ASIO-approved equipment when destroying media, which is one disposal/sanitisation pathway that can satisfy the secure removal intent of Annex A 7.14. ISM-1361 is narrower (destruction only and tooling approval), while Annex A 7.14 also covers secure overwrite/erasure, reuse scenarios, and explicitly mentions licensed software.
This control partially overlaps ISM-1550.
ISM-1550 requires organisations to develop, implement and maintain IT equipment disposal processes and supporting procedures. Annex A 7.14 specifically requires verification that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or re-used, which is a core step that disposal procedures under ISM-1550 should mandate. ISM-1550 is broader in focusing on end-to-end procedural governance for disposal, while Annex A 7.14 is narrower and technically focused on sanitisation and software/licensing removal.
This control partially overlaps ISM-1599.
ISM-1599 requires IT equipment handling according to sensitivity or classification. ISO/IEC 27001:2022 Annex A 7.14 addresses secure disposal or re-use of storage media-containing equipment, ensuring sensitive data removal-a component of sensitivity-appropriate handling. Annex A 7.14 is narrower, focused on disposal/re-use, while ISM-1599 covers broader handling scenarios.
This control partially overlaps ISM-1642.
ISM-1642 requires media to be sanitised before it is reused in a different security domain to prevent data leakage across domains. Annex A 7.14 similarly requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use, which includes storage media. Annex A 7.14 is broader in covering disposal and also explicitly mentions licensed software, while ISM-1642 is specifically focused on reuse across security domains.
This control partially overlaps ISM-1724.
ISM-1724 requires magnetic hard disks to be physically destroyed using approved methods to prevent data recovery. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten prior to equipment disposal or reuse. They overlap on ensuring data is not recoverable when disposing of equipment with storage media, but ISM-1724 is specifically about destruction methods for magnetic HDDs, while Annex A 7.14 includes reuse scenarios and allows non-destructive approaches (e.g., secure overwrite) with an explicit verification requirement.
This control partially overlaps ISM-1729.
ISM-1729 specifies how destroyed TOP SECRET media waste particles must be classified, stored, and handled after destruction based on particle size. Annex A 7.14 addresses secure disposal or re-use of equipment by ensuring sensitive data is removed or securely overwritten prior to disposal or re-use. They overlap in the disposal end-state and the need to prevent compromise during disposal, but ISM-1729 is about post-destruction waste handling classification, while Annex A 7.14 focuses on sanitisation prior to disposal/re-use rather than how destruction residues are classified and stored.
This control partially overlaps ISM-1735.
ISM-1735 requires that media which cannot be successfully sanitised is destroyed prior to disposal. Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten before equipment disposal or re-use. They overlap on preventing residual data exposure at end-of-life, but ISM-1735 uniquely mandates physical destruction where sanitisation is not achievable, while Annex A 7.14 focuses on data removal/overwriting and includes re-use scenarios.
This control partially overlaps ISM-1741.
ISM-1741 requires organisations to develop, implement and maintain end-to-end IT equipment destruction processes and supporting procedures. Annex A 7.14 requires secure disposal or re-use of equipment by verifying sensitive data and licensed software is removed or securely overwritten before disposal or re-use, which directly intersects with destruction activities for data-bearing assets. ISM-1741 is broader in procedural governance of destruction (e.g., methods, chain-of-custody, assurance, and ongoing maintenance of procedures), while Annex A 7.14 also covers re-use scenarios where destruction may not occur.
This control partially overlaps ISM-1742.
ISM-1742 requires that IT equipment that cannot be sanitised is destroyed to prevent residual data compromise. This overlaps with Annex A 7.14, which requires verification that sensitive data and licensed software are removed or securely overwritten prior to disposal or re-use, and implicitly requires secure handling when sanitisation is not feasible. Annex A 7.14 is broader across both disposal and re-use and focuses on verification and secure overwriting, whereas ISM-1742 is a specific mandate to destroy when sanitisation cannot be achieved.
This control depends on ISM-0370.
ISM-0370 requires media destruction to be supervised by at least one cleared person. Supervision by a cleared person provides assurance that media holding sensitive data is actually destroyed, which supports the Annex A 7.14 requirement to verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use. Annex A 7.14 focuses on verification of data removal across equipment, while ISM-0370 addresses only who must oversee destruction.
This control depends on ISM-0372.
ISM-0372 requires the destruction of media storing accountable material to be supervised by at least two cleared personnel. Dual supervision gives assurance that the media and its sensitive contents are actually destroyed, supporting the Annex A 7.14 requirement to verify sensitive data is removed or securely overwritten before disposal or re-use. Annex A 7.14 covers verification across all equipment containing storage media, while ISM-0372 addresses only oversight of destruction for accountable material.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.