Implementing ISO 27001 Annex A 8.10 is a vital compliance activity ensuring the secure and permanent information deletion of obsolete data. By automating retention schedules and utilizing secure wiping tools, organizations eliminate forensic recovery risks, thereby reducing liability and preventing unauthorized access to discarded storage media.
ISO 27001 Annex A Information Deletion Implementation Checklist
Use this implementation checklist to achieve compliance with ISO 27001 Annex A 8.10. True compliance requires the irreversible destruction of data, preventing forensic recovery, rather than simply hiding files in a ‘Recycle Bin’.
1. Automate Data Retention Policies
Control Requirement: Information must be deleted when no longer required for business or legal reasons.
Required Implementation Step: Configure automated retention tags in your file servers and cloud repositories (e.g., Microsoft 365 Retention Policies, AWS S3 Lifecycle Rules). Set specific timeframes (e.g., “Delete after 7 years”) to force the purging of data without relying on human memory.
Minimum Requirement: “Keep Forever” is not a policy; automated deletion rules must be active.
2. Implement Secure Deletion Tools (Wiping)
Control Requirement: Deletion must ensure data cannot be easily recovered.
Required Implementation Step: Deploy secure deletion utilities (e.g., SDelete, BleachBit) on endpoints to overwrite file space with random data (DoD 5220.22-M standard) rather than just removing the file pointer. Integrate this into the context menu for sensitive file handling.
Minimum Requirement: Standard OS “Delete” is insufficient for PII or Confidential data.
3. Enforce Crypto-Shredding for Cloud Data
Control Requirement: Ensure deletion of data stored in shared/cloud environments.
Required Implementation Step: When decommissioning a cloud instance or storage bucket, delete the encryption key associated with that specific data set (Key Management Service). This renders the data mathematically unrecoverable, even if the physical disk is not destroyed by the provider.
Minimum Requirement: Deletion of the key is the only verification you have in the cloud.
4. Configure Database Pruning Jobs
Control Requirement: Remove obsolete records from application databases.
Required Implementation Step: Write and schedule SQL Agent jobs to TRUNCATE or DELETE rows older than the retention period. Ensure “Soft Delete” flags (e.g., is_deleted=true) are followed by a hard delete process after a 30-day recovery window.
Minimum Requirement: Databases must not grow indefinitely; old customer data must be purged.
5. Define Backup “Aging Out” Procedures
Control Requirement: Address deleted data existing in backups.
Required Implementation Step: Document the “Aging Out” process. You generally cannot open a tape to delete one file. Instead, formally state that the data will remain in backups until the media is overwritten or destroyed at the end of the backup retention cycle (e.g., 12 months).
Minimum Requirement: Explicit policy stating deleted production data persists in backups until rotation.
6. Sanitise Sandbox and Dev Environments
Control Requirement: Prevent accumulation of live data in test systems.
Required Implementation Step: Configure a script to wipe Development and Staging environments after every sprint or release cycle. Ensure that any production data copied for testing is anonymised or deleted immediately after the test concludes.
Minimum Requirement: Test data must not become permanent shadow data.
7. Secure Physical Media Destruction
Control Requirement: Destroy physical media containing obsolete information.
Required Implementation Step: Contract a certified destruction partner for hard drives, tapes, and USBs. Require a Certificate of Destruction detailing the serial numbers of every destroyed asset. For on-site paper, use cross-cut shredders (P-4 security level or higher).
Minimum Requirement: Degaussing or drilling drives is required before they leave the building.
8. Implement “Legal Hold” Overrides
Control Requirement: Prevent deletion when litigation is pending.
Required Implementation Step: Configure a “Legal Hold” mechanism in your email and file archival systems. This technical control must freeze the deletion schedule for specific users or datasets, overriding the rules set in Step 1.
Minimum Requirement: Ability to instantly stop automated deletion for specific custodians.
9. Obtain Destruction Certificates from Third Parties
Control Requirement: Verify deletion of data shared with external vendors.
Required Implementation Step: Upon termination of a SaaS or vendor contract, formally request a “Data Destruction Certificate” or a contractual statement confirming that all your data has been purged from their systems. Do not assume they deleted it.
Minimum Requirement: Silence from a vendor equals data retention; demand written confirmation.
10. Verify Deletion Effectiveness
Control Requirement: Validate that deletion controls are working.
Required Implementation Step: Conduct a spot check using forensic recovery software (e.g., Recuva) on a re-imaged laptop or a “wiped” USB drive. If you can recover the files, your deletion process (Step 2 or 7) has failed.
Minimum Requirement: Proof that “Deleted” actually means “Gone”.
ISO 27001 Annex A 8.10 SaaS / GRC Platform Implementation Failure Checklist
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Automated Retention | GRC tool asks: “Is there a retention policy?” (Yes/No). | You uploaded a PDF policy, but your S3 buckets are set to “Retain Indefinitely.” You are paying to store liability. |
| Secure Wiping | “We format drives before disposal.” | Standard formatting leaves data recoverable. Without a 3-pass overwrite or physical shredding, the data is still there. |
| Cloud Deletion | “We deleted the VM.” | You deleted the instance, but the unencrypted EBS volume snapshots are still sitting in the storage account, readable by anyone with keys. |
| Backup Data | “We delete customer data immediately upon request.” | You deleted it from the App, but it exists on 12 months of backup tapes. You have no process to track this if a restore happens. |
| Vendor Termination | “We cancelled the subscription.” | The vendor kept your data in their “freemium” tier or archive “just in case you return.” You never asked them to wipe it. |
| Soft Deletion | “The database flag is set to deleted.” | The data is still in the table. A simple SQL injection or insider query can still export the entire “deleted” dataset. |
| Hardware Reuse | “We pass old laptops to new staff.” | You didn’t secure wipe the SSD. The new junior employee runs a recovery tool and finds the CEO’s old payroll documents. |
DO IT YOURSELF ISO 27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
About the author
