ISO 27001 Annex A 8.10 Audit Checklist

The ultimate audit guide to ISO 27001 Annex A 8.10 Information Deletion

1. Information Deletion Policy Formalisation Verified

Verification Criteria: A documented policy or standard operating procedure exists that explicitly defines the requirements for information deletion across all media and systems.

Required Evidence: Approved Data Retention and Disposal Policy with defined roles, responsibilities, and approved deletion methods.

Pass/Fail Test: If the organisation cannot produce a formal document specifying the technical requirements for secure deletion, mark as Non-Compliant.

2. Retention Period Alignment Confirmed

Verification Criteria: Information deletion activities are mapped directly to a formal retention schedule that justifies storage based on legal, regulatory, or business needs.

Required Evidence: Data Retention Schedule or Records Management Matrix showing specific disposal triggers (e.g., 7 years post-contract).

Pass/Fail Test: If information is found to be stored indefinitely without a documented retention justification or disposal trigger, mark as Non-Compliant.

3. Automated Deletion Mechanisms Validated

Verification Criteria: Technical controls, such as automated scripts, cron jobs, or built-in system retention policies, are active to purge data at end-of-life.

Required Evidence: Configuration logs of database cleanup scripts, email retention settings, or SaaS auto-archive/delete settings.

Pass/Fail Test: If deletion is purely manual and lacks a system-enforced mechanism for high-volume data (e.g., logs or PII), mark as Non-Compliant.

4. Physical Media Sanitisation Verified

Verification Criteria: Physical storage media (HDDs, SSDs, USBs) slated for disposal or reuse are sanitised using verified technical methods to prevent data recovery.

Required Evidence: Sanitisation logs using NIST 800-88 compliant software or Certificates of Destruction from a certified third-party vendor.

Pass/Fail Test: If retired hard drives are stored in unsecure areas without being physically destroyed or cryptographically erased, mark as Non-Compliant.

5. Cloud Resource Data Purging Confirmed

Verification Criteria: Terminated cloud resources (instances, buckets, or databases) have associated data volumes and snapshots purged in accordance with the deletion policy.

Required Evidence: CloudTrail logs (AWS) or Activity Logs (Azure) showing the terminal ‘Delete’ and ‘Purge’ actions for unattached storage volumes.

Pass/Fail Test: If unattached cloud storage volumes containing sensitive data remain accessible after the primary compute resource is terminated, mark as Non-Compliant.

6. Backup Data Removal Consistency Validated

Verification Criteria: Deletion workflows extend to backup repositories to ensure that data is not indefinitely retained within historical archives.

Required Evidence: Backup rotation schedules and retention settings showing the automated expiration of historical backup sets in line with production deletion.

Pass/Fail Test: If “deleted” production data persists in accessible backup archives for longer than the maximum retention period, mark as Non-Compliant.

7. Cryptographic Erasure (Crypto-shredding) Implementation Verified

Verification Criteria: Where cryptographic erasure is used, the organisation provides proof of the irreversible destruction of the encryption keys used to protect the data set.

Required Evidence: Key Management System (KMS) logs showing ‘Key Deletion’ or ‘Key Rotation with shredding’ events for specific data pools.

Pass/Fail Test: If the organisation relies on “deleting files” from encrypted volumes without verifying the destruction of the underlying keys, mark as Non-Compliant.

8. Third-Party Disposal Attestations Present

Verification Criteria: For data stored with SaaS or third-party providers, formal confirmation is obtained that data is deleted upon contract termination or specific request.

Required Evidence: Service Level Agreements (SLAs) or Data Processing Agreements (DPA) containing deletion clauses and post-contract certificates of erasure.

Pass/Fail Test: If there is no contractual or technical evidence that a third-party vendor has deleted organisational data following a service exit, mark as Non-Compliant.

9. Regulatory Deletion (Right to Erasure) Workflow Validated

Verification Criteria: A verified process exists for the timely deletion of specific individual records in response to legal or regulatory requests (e.g., GDPR/UK GDPR).

Required Evidence: Data Subject Access Request (DSAR) logs showing completed ‘Right to Erasure’ requests and technical confirmation of record removal.

Pass/Fail Test: If a sampled ‘Right to Erasure’ request was marked as ‘Done’ but the data remains visible in a secondary database or application, mark as Non-Compliant.

10. Deletion Verification Monitoring Records Present

Verification Criteria: Regular audits or technical scans are performed to verify that information has been successfully removed from systems and media as intended.

Required Evidence: Periodic audit reports or data discovery tool logs showing the absence of “stale” data in designated production zones.

Pass/Fail Test: If the organisation has no record of verifying that its automated deletion scripts are actually functioning as expected, mark as Non-Compliant.

About the author