Skip to main content
All measures

Measure · ISO 27001 and other standards

Transfer and retire devices and media securely

Maintain devices and media from approved use through transport and handover to checked reuse or disposal. Use existing inventory, handling rules and deletion procedures.

Accountable: Asset owners and authorised operations rolesReviewed

Reuse existing records

Use existing inventory, issue, repair and retirement records. The information protection policy remains the leading source for classification and retention; the deletion concept records the actual deletion run. No second return list or disposal policy is needed.

What to do

  1. 1

    Clarify use and required handling

    Identify the device or medium, information held, permitted purpose and responsible person. Include paper when considering media. Before acquisition or use, clarify approved devices and media, required access protection, marking and encryption where needed under the existing handling rule. Use suitable storage and manufacturer conditions. For required long-term retention, ensure readability, suitable copies and necessary transfer to new media.

  2. 2

    Protect off-site use and handovers

    Clarify approved use, transport, packaging and a suitable recipient or carrier. Do not leave devices and media unprotected in public places. At a change between people or parties, record in the existing case which asset is handed to whom and which organisation, and when. Remove information not needed for transfer through the existing deletion route. Include approved private devices. For permanently off-site equipment, check physical and logical access, tamper protection and environmental impacts. Use the known reporting route for loss or suspected tampering.

  3. 3

    Decide on repair, reuse or disposal

    Before transfer, check storage, sensitive information, licensed software and required retention or holds. Decide on necessary data transfer, permitted reuse and a deletion or destruction method approved for the medium and protection needs. Keep damaged devices containing sensitive data protected until suitable handling is decided. For external services, choose a suitable supplier and agree scope and required evidence. Returns remain in the existing return record.

  4. 4

    Verify the work and close the inventory record

    Have the authorised function perform the selected method. Match the result log or destruction record to the specific media ID and intended method. Release the equipment after successful execution and verification. Ordinary file deletion or arbitrary multiple overwrites do not establish safe sanitisation of every medium. Use appropriate manufacturer and operating procedures; the deletion concept keeps scope, method, execution, verification and exceptions together. Before reuse or release, also check sensitive markings and necessary licence handling. Maintain handovers, relevant disposal evidence and actual inventory status in the existing record.

Worked example

A notebook with an SSD will be sold

Fictional example: A retired notebook contains customer data and licensed software. It has an SSD.

Sanitise appropriately and actually verify
DecisionThe authorised function clarifies retention and necessary data transfer, uses an approved method suitable for this SSD and checks the result. If reliable sanitisation is not possible, the medium remains protected or is suitably destroyed.
EvidenceExisting retirement and deletion record with asset reference, decision, medium, method, actual result and checked inventory closure.

Record the result

  • Existing asset or handover record with purpose, responsibility, protection and traceable transfers.
  • Checked deletion or retirement evidence identifying the medium, actual work, result and necessary inventory or licence changes.

Common implementation mistakes

Only emptying the recycle bin

Choose a method suitable for the technology and protection needs and verify the result.

Equating retention with device possession

Required information can be appropriately transferred. Clarify retention and secure sanitisation separately before releasing the device.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.7.9 · Sicherheit von Vermögenswerten außerhalb der GeschäftsräumeGerman guide

    Approved use, off-site protection and traceable transfers between people or parties are maintained in the existing asset workflow.

  • A.7.10 · SpeichermedienGerman guide

    The work connects acquisition and permitted use to storage, transport, readability and safe end-of-life handling according to classification and media type, including paper.

  • A.7.14 · Sichere Entsorgung oder Wiederverwendung von BetriebsmittelnGerman guide

    Storage, sensitive information and licensed software are checked and appropriately sanitised before reuse or disposal; actual execution and result are verified.

  • TISAX · 3.1.3

    VDA ISA 6.0.3 · Partial overlap

    The workflow supports handling during transport, storage, repair, loss, return and disposal of supporting assets. Actual implementation and specific ISA requirements, such as disposal standards for high protection needs, are not established in full.

    Reference

Templates for your implementation

Related resources

Sources and further reading