In this ultimate how to implement guide to ISO 27001 Annex A 8.10 Information Deletion, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
- 1. Automate Data Retention Policies
- 2. Implement Secure Deletion Tools (Wiping)
- 3. Enforce Crypto-Shredding for Cloud Data
- 4. Configure Database Pruning Jobs
- 5. Define Backup “Aging Out” Procedures
- 6. Sanitise Sandbox and Dev Environments
- 7. Secure Physical Media Destruction
- 8. Implement “Legal Hold” Overrides
- 9. Obtain Destruction Certificates from Third Parties
- 10. Verify Deletion Effectiveness
1. Automate Data Retention Policies
Control Requirement: Information must be deleted when no longer required for business or legal reasons.
Required Implementation Step: Configure automated retention tags in your file servers and cloud repositories (e.g., Microsoft 365 Retention Policies, AWS S3 Lifecycle Rules). Set specific timeframes (e.g., “Delete after 7 years”) to force the purging of data without relying on human memory.
Minimum Requirement: “Keep Forever” is not a policy; automated deletion rules must be active.
2. Implement Secure Deletion Tools (Wiping)
Control Requirement: Deletion must ensure data cannot be easily recovered.
Required Implementation Step: Deploy secure deletion utilities (e.g., SDelete, BleachBit) on endpoints to overwrite file space with random data (DoD 5220.22-M standard) rather than just removing the file pointer. Integrate this into the context menu for sensitive file handling.
Minimum Requirement: Standard OS “Delete” is insufficient for PII or Confidential data.
3. Enforce Crypto-Shredding for Cloud Data
Control Requirement: Ensure deletion of data stored in shared/cloud environments.
Required Implementation Step: When decommissioning a cloud instance or storage bucket, delete the encryption key associated with that specific data set (Key Management Service). This renders the data mathematically unrecoverable, even if the physical disk is not destroyed by the provider.
Minimum Requirement: Deletion of the key is the only verification you have in the cloud.
4. Configure Database Pruning Jobs
Control Requirement: Remove obsolete records from application databases.
Required Implementation Step: Write and schedule SQL Agent jobs to TRUNCATE or DELETE rows older than the retention period. Ensure “Soft Delete” flags (e.g., is_deleted=true) are followed by a hard delete process after a 30-day recovery window.
Minimum Requirement: Databases must not grow indefinitely; old customer data must be purged.
5. Define Backup “Aging Out” Procedures
Control Requirement: Address deleted data existing in backups.
Required Implementation Step: Document the “Aging Out” process. You generally cannot open a tape to delete one file. Instead, formally state that the data will remain in backups until the media is overwritten or destroyed at the end of the backup retention cycle (e.g., 12 months).
Minimum Requirement: Explicit policy stating deleted production data persists in backups until rotation.
6. Sanitise Sandbox and Dev Environments
Control Requirement: Prevent accumulation of live data in test systems.
Required Implementation Step: Configure a script to wipe Development and Staging environments after every sprint or release cycle. Ensure that any production data copied for testing is anonymised or deleted immediately after the test concludes.
Minimum Requirement: Test data must not become permanent shadow data.
7. Secure Physical Media Destruction
Control Requirement: Destroy physical media containing obsolete information.
Required Implementation Step: Contract a certified destruction partner for hard drives, tapes, and USBs. Require a Certificate of Destruction detailing the serial numbers of every destroyed asset. For on-site paper, use cross-cut shredders (P-4 security level or higher).
Minimum Requirement: Degaussing or drilling drives is required before they leave the building.
8. Implement “Legal Hold” Overrides
Control Requirement: Prevent deletion when litigation is pending.
Required Implementation Step: Configure a “Legal Hold” mechanism in your email and file archival systems. This technical control must freeze the deletion schedule for specific users or datasets, overriding the rules set in Step 1.
Minimum Requirement: Ability to instantly stop automated deletion for specific custodians.
9. Obtain Destruction Certificates from Third Parties
Control Requirement: Verify deletion of data shared with external vendors.
Required Implementation Step: Upon termination of a SaaS or vendor contract, formally request a “Data Destruction Certificate” or a contractual statement confirming that all your data has been purged from their systems. Do not assume they deleted it.
Minimum Requirement: Silence from a vendor equals data retention; demand written confirmation.
10. Verify Deletion Effectiveness
Control Requirement: Validate that deletion controls are working.
Required Implementation Step: Conduct a spot check using forensic recovery software (e.g., Recuva) on a re-imaged laptop or a “wiped” USB drive. If you can recover the files, your deletion process (Step 2 or 7) has failed.
Minimum Requirement: Proof that “Deleted” actually means “Gone”.
About the author
