By HTL 365 · · Updated
Every audit season, firms that did the hard work of protecting their data get stuck on something simple: they can’t prove what happened to the laptops and drives they retired last year.
Both ISO/IEC 27001 (Annex A control 7.14) and SOC 2 (criterion CC6.5) expect you to show that data on retired equipment was made unrecoverable before the equipment left your control. A line on a recycling invoice that says “50 laptops recycled” rarely satisfies that. The auditor wants a trail they can follow one device at a time.
The four records auditors ask for
1. A pickup manifest with serial numbers. When equipment leaves your office, each device should be listed by serial number, asset tag and type. This is the moment custody changes, so it’s the record auditors check first.
2. A certificate of destruction that matches the manifest. The certificate should list the same serial numbers, along with the date, location and method: wiped, degaussed or physically destroyed. If the serial numbers on the certificate don’t match the manifest, the trail breaks.
3. Wipe reports for anything reused or resold. If a drive is wiped instead of destroyed, keep the software report that shows the sanitization method and result for that serial number. Methods should follow NIST SP 800-88 Rev. 2: clear, purge or destroy, matched to the media and how sensitive the data was.
4. Chain of custody in between. Who picked the devices up, when, and how they were secured until destruction. Locked bins and signed handoffs are what make the other three records believable.
How the sample test works
Auditors often pick a few retired devices from your asset list, sometimes three to five from the last 12 months, and ask you to show the full story for each: the ticket or record that retired it, the pickup manifest line, and the certificate line. If you can pull those up in a few minutes, the control passes. If you’re digging through email for an old invoice, it becomes a finding.
Where firms usually get caught
- Devices retired by a well-meaning employee who took them to a big-box recycling bin
- A vendor certificate that lists weight or device counts, not serial numbers
- Laptops reassigned internally and never wiped between users
- Copiers and printers left off the asset list, even though their internal drives hold scanned documents
How we handle it
When HTL 365 picks up equipment, every device is logged by serial number before it leaves your office. Drives are wiped or destroyed following NIST SP 800-88 Rev. 2, and you receive a certificate listing each serial number, ready for the next sample request.