How to Make Sure Old Kit Doesn’t Leak Your Data
ISO 27001 Control 7.14 Secure disposal or re-use of equipment is all about what happens when equipment reaches the end of its life – or just gets handed to someone else.
Laptops, servers, phones, network kit, printers, CCTV systems… most of them contain storage media or configuration data that can reveal far more about your organisation than you’d like. If you don’t deal with that properly, your old equipment can quietly become a data breach.
This guide explains what ISO 27001 Control 7.14 is really asking for, and how to build a simple, practical process so that equipment can be resold, donated, returned, or scrapped without taking your information with it.
What ISO 27001 Control 7.14 Actually Requires
In plain English, ISO 27001 Control 7.14 – Secure disposal or re-use of equipment expects you to:
- Identify when equipment contains storage media or sensitive configuration data.
- Make sure data is securely wiped, destroyed, or removed before disposal or re-use.
- Remove or neutralise identifying markings and security controls that could help an attacker.
- Use trusted disposal partners where you outsource destruction.
- Maintain an audit trail so you can prove what happened to decommissioned equipment.
This is a preventive control focused mainly on confidentiality – stopping information from leaking out of your environment when equipment leaves your control.
Step 1 – Know Which Equipment Can Hold Data
Before you can apply ISO 27001 Control 7.14, you need to know which types of equipment can store information.
It’s not just laptops and servers. Think about:
- Desktop PCs, laptops, tablets and smartphones
- Servers, SAN/NAS devices and hypervisors
- Network equipment (firewalls, routers, switches, Wi-Fi controllers)
- Multi-function printers and scanners
- CCTV and access control systems (cameras, NVRs, door controllers)
- Industrial or IoT devices with internal storage or logs
Build this into your asset management process so that when something is marked as “end-of-life” or “to be re-used”, you automatically treat it as potentially holding sensitive data or configurations.
Step 2 – Decide the Secure Outcome: Re-Use, Resale, Return or Destruction
For each item, decide what’s actually going to happen to it:
- Internal re-use
– Reallocated to another staff member or team.
– Used as a spare, lab device, or training kit. - External re-use
– Resold, donated, or returned to a leasing company.
– Returned to a supplier under RMA or buy-back schemes. - Final disposal
– Recycled or destroyed, either in-house or via a specialist provider.
ISO 27001 Control 7.14 doesn’t say which option you must choose; it just requires that information is protected before the equipment leaves your control or changes hands.
Step 3 – Verify Whether Equipment Contains Storage Media
Before disposal or re-use, you should check what’s inside:
- Identify all storage components:
- Hard drives (HDD), solid-state drives (SSD)
- NVMe drives, SD cards, USB modules
- Internal flash memory in appliances (firewalls, printers, IoT devices)
- Don’t forget:
- Local logs, configuration backups, authentication databases
- Cached documents on printers and scanners
- Footage stored on CCTV systems and NVRs
Document a simple checklist per device type (e.g. “before disposing of a firewall, remove/erase: internal flash, removable cards, USB storage, configuration backups”).
This step is critical for ISO 27001 Control 7.14: if you don’t know which components store data, you can’t reliably remove or protect it.
Step 4 – Apply Secure Data Destruction, Not Just “Delete”
Standard delete and quick format operations are not enough. Control 7.14 expects you to use secure methods that make data non-recoverable, appropriate to the sensitivity of the information.
Options include:
- Secure wiping / overwriting
– Use certified wiping tools to overwrite disks and SSDs.
– Keep logs or certificates of completion for higher-risk assets. - Cryptographic erase
– If full-disk encryption has been in place with strong keys, and keys are securely destroyed, this may be enough for some risk levels.
– Document when and how keys are destroyed. - Physical destruction
– Shredding, crushing, degaussing, or drilling for drives and media that held sensitive or regulated information.
– Often the preferred option for damaged drives or where you cannot trust logical wiping. - Appliance and device resets
– For printers, firewalls, switches, and similar devices, perform a secure factory reset that wipes logs, configurations, and user data.
– Confirm that no local admin accounts, credentials, or keys remain.
The more sensitive the data stored, the more you should lean towards stronger destruction methods. For anything that held highly confidential or regulated data, ISO 27001 Control 7.14 will be easiest to demonstrate if you physically destroy the storage media or have robust evidence of secure wiping.
Step 5 – Remove Identifying Information and Security Artefacts
Even if you’ve wiped the storage, equipment can still reveal too much about you.
Before equipment is resold, donated, or discarded:
- Remove labels and markings that show:
- Company name and logo
- Asset numbers that link back to internal systems
- Network names, IP schemes, VLANs, or system roles
- Security classifications
- Clear configurations that could help an attacker:
- Firewall rules, VPN profiles, and access control lists
- Wireless SSIDs, pre-shared keys, and certificate references
- Usernames and access lists on door controllers or cameras
- De-register devices from:
- Cloud management portals
- MDM or EDR tools
- Licence servers where appropriate
ISO 27001 Control 7.14 is about protecting information, not just hardware. Removing identifying information and configuration data is a key part of that.
Step 6 – Handle Leased, Returned, or Building-Based Equipment
Control 7.14 also covers situations where you don’t own the facility or equipment outright, but your data has lived there.
Examples:
- Office or data centre leases where:
- Access control systems store your user lists and logs
- CCTV systems store footage of your staff, visitors, or operations
- Leased equipment (servers, laptops, printers, phone systems) that must be returned.
For these:
- Build secure disposal or reset into your exit or relocation checklist:
– Wipe or remove storage before returning leased devices.
– Remove your user data and logs from building systems where the landlord keeps the hardware. - Check lease agreements:
– Some contracts require you to return premises “as found” and remove your own security controls.
– Make sure you either decommission controls securely or re-use them at your new location, without leaving data behind for the next tenant.
This is all in scope for ISO 27001 Control 7.14 because your information may still be present even when the hardware technically belongs to someone else.
Step 7 – Manage Damaged Equipment and Aggregation Risk
Damaged devices and piles of “old kit” can be surprisingly risky.
Damaged equipment
For equipment that is faulty, dead, or physically damaged:
- Assess whether it can be securely wiped
– If you can’t reliably access the storage to erase it, treat it as high-risk.
– In many cases, direct physical destruction of the storage component is the safest route. - Avoid sending damaged drives or devices with intact storage back to generic repair centres without clear contractual controls and a destruction plan.
Aggregation risk
Even if each individual device only holds low-sensitivity data, a large box full of them can:
- Provide a rich source of information on your systems and environment.
- Reveal patterns, configurations, or internal structure.
ISO 27001 Control 7.14 expects you to recognise that aggregated low-level information can become sensitive. Don’t leave piles of old kit lying around for months “until we get round to it”. Treat them as a single high-value disposal batch with appropriate controls.
Step 8 – Use Trusted Disposal Partners and Keep an Audit Trail
Most organisations will use external companies for recycling and destruction at some point. For ISO 27001 Control 7.14, you should:
- Select reputable providers
– Check certifications, references, and security practices.
– Ensure contracts clearly state responsibilities for secure handling and destruction. - Control the chain of custody
– Keep records of what was handed over (asset IDs, serial numbers, quantities).
– Use sealed containers or tamper-evident methods for higher-risk items. - Obtain evidence of destruction
– Certificates of destruction, shredding logs, or video evidence where justified by risk.
– Link this evidence back to your asset register.
Internally, maintain an audit trail for equipment disposal and re-use:
- What was disposed of or re-used
- When it happened
- Who approved it
- How data was protected (wipe method, destruction method, provider used)
This makes it straightforward to show an auditor that you’ve implemented ISO 27001 Control 7.14 in a controlled, accountable way.
Step 9 – Train Staff and Make the Process Simple to Follow
Even the best policy will fail if staff don’t understand it.
For ISO 27001 Control 7.14:
- Include in awareness training:
- Why simply binning or selling old kit is risky
- The basic steps for secure disposal or re-use
- Who to contact when they have equipment to get rid of
- Provide a clear, simple process:
- One internal contact or form for “equipment disposal / re-use request”
- A standard path for how items are collected, wiped, and logged
- Train IT, facilities, and procurement teams:
- How to apply the wiping and destruction procedures
- How to work with disposal providers
- How to maintain records and link them to the asset register
If the process is easy and clearly owned, people will follow it – and ISO 27001 Control 7.14 becomes much easier to evidence.
Quick Implementation Checklist for ISO 27001 Control 7.14
Use this checklist to test your current approach:
- ISO 27001 Control 7.14 (Secure disposal or re-use of equipment) is documented in your ISMS policies/procedures.
- You know which equipment types contain storage media or sensitive configuration data.
- There is a defined process for secure disposal and internal re-use of equipment.
- All equipment is checked for data-bearing components before disposal or re-use.
- Secure wiping or physical destruction is used instead of standard delete/format.
- Labels, markings and configuration data that identify the organisation are removed before equipment leaves your control.
- Damaged devices are risk assessed, with physical destruction used where secure wipe isn’t reliable.
- Leased/returned/building-based equipment and security systems are covered in exit and relocation procedures.
- External disposal providers are vetted, contracted, and provide evidence of destruction.
- An audit trail exists for disposed or re-used equipment (what, when, how, by whom).
- Staff involved in disposal and re-use are trained and aware of their responsibilities.
Bringing It All Together
ISO 27001 Control 7.14 – Secure disposal or re-use of equipment – is about making sure that when equipment leaves your control, your information doesn’t go with it.
If you:
- Identify which equipment holds data,
- Apply proper wiping or destruction methods,
- Remove identifying details and configurations, and
- Keep a clear audit trail supported by trained staff and trusted partners,
you’ll significantly reduce the risk of data leakage via discarded or re-used equipment – and you’ll have exactly the kind of structured, evidence-based approach that ISO 27001 auditors look for.
Explore the ISO 27001 Control Group Purposes