How to Audit ISO 27001 Annex A 8.10 Information Deletion: An ISO 27001 Lead Auditor’s Guide

Auditing ISO 27001 Annex A 8.10 Information Deletion is the technical verification of data removal processes across the entire organisational lifecycle. The Primary Implementation Requirement is the use of automated mechanisms and verified sanitisation, providing the Business Benefit of significant reduction in storage overhead and regulatory non-compliance.

ISO 27001 Annex A 8.10 Information Deletion Audit Checklist

This technical verification tool is designed for lead auditors to establish the efficacy of data lifecycle management and risk minimisation. Use this checklist to validate compliance with ISO 27001 Annex A 8.10.

1. Information Deletion Policy Formalisation Verified

Verification Criteria: A documented policy or standard operating procedure exists that explicitly defines the requirements for information deletion across all media and systems.

Required Evidence: Approved Data Retention and Disposal Policy with defined roles, responsibilities, and approved deletion methods.

Pass/Fail Test: If the organisation cannot produce a formal document specifying the technical requirements for secure deletion, mark as Non-Compliant.

2. Retention Period Alignment Confirmed

Verification Criteria: Information deletion activities are mapped directly to a formal retention schedule that justifies storage based on legal, regulatory, or business needs.

Required Evidence: Data Retention Schedule or Records Management Matrix showing specific disposal triggers (e.g., 7 years post-contract).

Pass/Fail Test: If information is found to be stored indefinitely without a documented retention justification or disposal trigger, mark as Non-Compliant.

3. Automated Deletion Mechanisms Validated

Verification Criteria: Technical controls, such as automated scripts, cron jobs, or built-in system retention policies, are active to purge data at end-of-life.

Required Evidence: Configuration logs of database cleanup scripts, email retention settings, or SaaS auto-archive/delete settings.

Pass/Fail Test: If deletion is purely manual and lacks a system-enforced mechanism for high-volume data (e.g., logs or PII), mark as Non-Compliant.

4. Physical Media Sanitisation Verified

Verification Criteria: Physical storage media (HDDs, SSDs, USBs) slated for disposal or reuse are sanitised using verified technical methods to prevent data recovery.

Required Evidence: Sanitisation logs using NIST 800-88 compliant software or Certificates of Destruction from a certified third-party vendor.

Pass/Fail Test: If retired hard drives are stored in unsecure areas without being physically destroyed or cryptographically erased, mark as Non-Compliant.

5. Cloud Resource Data Purging Confirmed

Verification Criteria: Terminated cloud resources (instances, buckets, or databases) have associated data volumes and snapshots purged in accordance with the deletion policy.

Required Evidence: CloudTrail logs (AWS) or Activity Logs (Azure) showing the terminal ‘Delete’ and ‘Purge’ actions for unattached storage volumes.

Pass/Fail Test: If unattached cloud storage volumes containing sensitive data remain accessible after the primary compute resource is terminated, mark as Non-Compliant.

6. Backup Data Removal Consistency Validated

Verification Criteria: Deletion workflows extend to backup repositories to ensure that data is not indefinitely retained within historical archives.

Required Evidence: Backup rotation schedules and retention settings showing the automated expiration of historical backup sets in line with production deletion.

Pass/Fail Test: If “deleted” production data persists in accessible backup archives for longer than the maximum retention period, mark as Non-Compliant.

7. Cryptographic Erasure (Crypto-shredding) Implementation Verified

Verification Criteria: Where cryptographic erasure is used, the organisation provides proof of the irreversible destruction of the encryption keys used to protect the data set.

Required Evidence: Key Management System (KMS) logs showing ‘Key Deletion’ or ‘Key Rotation with shredding’ events for specific data pools.

Pass/Fail Test: If the organisation relies on “deleting files” from encrypted volumes without verifying the destruction of the underlying keys, mark as Non-Compliant.

8. Third-Party Disposal Attestations Present

Verification Criteria: For data stored with SaaS or third-party providers, formal confirmation is obtained that data is deleted upon contract termination or specific request.

Required Evidence: Service Level Agreements (SLAs) or Data Processing Agreements (DPA) containing deletion clauses and post-contract certificates of erasure.

Pass/Fail Test: If there is no contractual or technical evidence that a third-party vendor has deleted organisational data following a service exit, mark as Non-Compliant.

9. Regulatory Deletion (Right to Erasure) Workflow Validated

Verification Criteria: A verified process exists for the timely deletion of specific individual records in response to legal or regulatory requests (e.g., GDPR/UK GDPR).

Required Evidence: Data Subject Access Request (DSAR) logs showing completed ‘Right to Erasure’ requests and technical confirmation of record removal.

Pass/Fail Test: If a sampled ‘Right to Erasure’ request was marked as ‘Done’ but the data remains visible in a secondary database or application, mark as Non-Compliant.

10. Deletion Verification Monitoring Records Present

Verification Criteria: Regular audits or technical scans are performed to verify that information has been successfully removed from systems and media as intended.

Required Evidence: Periodic audit reports or data discovery tool logs showing the absence of “stale” data in designated production zones.

Pass/Fail Test: If the organisation has no record of verifying that its automated deletion scripts are actually functioning as expected, mark as Non-Compliant.

About the author