What A.7.14 asks for before a laptop or server leaves your control
An auditor asks how retired devices are cleared, and A.7.14 expects you to answer with proof rather than process. The control asks the organization to verify that any equipment containing storage media has had its sensitive data and licensed software removed or securely overwritten before the equipment is disposed of or re-used. The point is verification: a policy saying drives are wiped is not enough, and the auditor will look for a record that a specific device was checked before it left. The risk is data remanence, where information survives deletion or formatting on a drive, and license misuse, where installed commercial software is carried into a resale or a reuse pool it was never licensed for. Both risks are easy to miss because the device looks empty once it is powered on.
The work is hard for predictable reasons. Asset records often do not match physical units: a laptop may be listed under a former employee, a server may have been moved to another rack without an update, and spare drives may never have been logged at all. Devices also leave the building through third-party collectors, refurbishers or recyclers, where the chain of custody depends on contracts and certificates you did not write. Reuse pools add another gap, because a device returned to stock may be reissued before anyone confirms its wipe. Before you scope this control, confirm which of your devices contain storage media, which disposal routes exist, and who signs off each step.
The 2013 edition covered the same ground under A.11.2.7, and ISO/IEC 27002:2022 traces the current A.7.14 to that predecessor, so existing wiping records may still be relevant evidence. NIST's crosswalk relates A.7.14 to MP-6 (Media Sanitization) in SP 800-53 Rev. 5, but NIST cautions that mapped controls are not always equivalent, so do not assume that meeting one satisfies the other without checking the wording against your own evidence. Closely related controls such as A.7.10 Storage media and A.8.10 Information deletion will be examined alongside this one, so align the disposal register with them. Ask your certification body or independent auditor how they expect verification to be recorded before you design the process.
Which devices, media and disposal routes fall under A.7.14
A.7.14 applies wherever equipment holding storage media leaves the organization's control, whether it is reused internally, donated, sold, recycled or returned to a lessor. The cards below cover the equipment types, disposal routes and scoping decisions that change how much work the control requires. Scope is set by the organization and should be documented in the ISMS before the first disposal batch.
Workstations and laptops
Desktops, laptops and thin clients are the most frequent disposal items and usually carry local disks, cached credentials and installed licensed software. Record every asset with its serial number and storage type, including machines that were never issued to a user, such as spares and loaner stock. Check that the asset register and the disposal log match, because a device missing from the register is hard to show as sanitized.
Servers and storage arrays
Servers, disk shelves and storage arrays hold large volumes of data, sometimes across many drives and controller caches. Confirm whether the sanitization covers each drive, flash module, cache and boot device, not only the main volume. Arrays returned under a maintenance contract may need a separate written agreement covering drive retention or destruction.
Network devices and peripherals with memory
Firewalls, switches, routers, printers, multifunction devices and phones often store configurations, logs, address books, scanned images or credentials in internal memory. These items are easy to overlook in an asset inventory built only from computing hardware. Decide which of them count as storage media for A.7.14 and include their reset or sanitization steps in the disposal procedure.
Cloud-hosted and leased hardware
Virtual machines and cloud storage are normally not returned hardware, but leased equipment and colocation hardware may be. Decide who owns sanitization for each case: the organization, the provider, or a contracted third party. Ask providers to describe in writing how they wipe or destroy drives and what certificate they issue, and keep that evidence with your disposal records.
Disposal routes and custody
Each route changes the risk: internal reuse, donation, resale, recycling, leasing returns and third-party destruction each pass custody to a different party at a different time. Document the handover point, transport method and the party that verifies completion for every route. Recycling and destruction vendors should be assessed as suppliers, with their sanitization methods and certificates reviewed before use.
Overlap with A.7.10 and A.8.10
A.7.10 Storage media covers media management from acquisition through disposal, A.8.10 Information deletion covers deleting information held in systems, and A.7.14 covers verifying equipment before it leaves. A single disposal event can touch all three, so define which control owns each step and record the boundary in the Statement of Applicability. Scoping them inconsistently produces gaps where an auditor finds media disposed of under one control but not the others.
How sanitization and destruction differ by media type
Traditional spinning hard disk drives store data as magnetic patterns on platters that can be addressed block by block. Overwriting with a verified pass can remove data from ordinary addressable sectors, which is why it has long been the common method for drives that will be reused. Degaussing applies a strong magnetic field to destroy the platter data, but it is not suitable for every drive type, and it does not reset the drive for reuse. Physical destruction, such as shredding or disintegration, is typically used when a drive has failed, is damaged or cannot be overwritten reliably.
- Overwriting: Confirm that the tool writes to every addressable sector, including reallocated sectors where the drive exposes them.
- Degaussing: Check that the drive type is one the degausser manufacturer supports, since some media are not affected.
- Physical destruction: Record the destruction method, the operator and the serial numbers of the drives destroyed.
- Verification: Sample overwritten drives and confirm that a read-back shows no residual data.
- Failed drives: Plan for drives that cannot be written to, because overwriting may fail silently.
Confirm method suitability with the drive vendor and your own risk assessment before you adopt a single approach for magnetic media.
Solid-state drives and flash media manage storage through controllers that remap blocks, wear-level writes and reserve spare capacity. Data may therefore sit in areas that a normal overwrite never reaches, so a standard overwrite does not give the same assurance it gives on magnetic disks. Vendors commonly provide sanitize commands or secure erase functions that instruct the controller to clear the media internally. Cryptographic erase, which destroys the encryption keys for data written with full-disk encryption, is often used where the drive was encrypted from the start. Degaussing has no effect on flash, so physical destruction remains the fallback.
- Vendor sanitize commands: Use the manufacturer's supported sanitize function and record the command and result.
- Cryptographic erase: Confirm that all data was encrypted from first write and that keys are destroyed and not copied elsewhere.
- Overwrite limits: Do not rely on software overwrite alone, because remapped and spare areas may keep data.
- Degaussing: Do not use it for flash, since it does not affect solid-state storage.
- Verification: Ask the vendor what evidence its sanitize function produces, since a status message may be the only output.
Confirm with the controller vendor which sanitize method it supports and how it reports completion.
Phones and tablets combine flash storage, a hardware-backed key store and operating system encryption, so the platform usually controls sanitization. The common approach is a factory reset on a device whose storage was encrypted from the start, which discards the keys that protect user data. Mobile device management can issue remote wipes and report their status, and this helps when a device is lost, returned or retired. Devices that cannot be reset or whose state is unknown usually go to physical destruction. Because the reset runs inside the platform, the evidence is typically a management record rather than a read-back of the storage.
- Encrypted reset: Confirm that device encryption was enabled before the device was issued.
- Remote wipe: Record the command, the time it was issued and whether the device confirmed completion.
- SIM and removable cards: Remove and destroy or return storage cards and SIMs separately.
- Accounts: Unlink cloud and corporate accounts and remove activation locks before handover.
- Unknown state: Route devices that cannot be confirmed to physical destruction.
Confirm with your mobile device management and device vendors what their reset and wipe actually guarantee for your models.
Virtual disks and cloud volumes do not map to a physical drive you can hold, so sanitization happens at the platform layer. The most common practice is to delete the volume and rely on the provider to erase the underlying blocks before reallocation, combined with encryption whose keys are destroyed on deletion. Hypervisor and storage snapshots, backups and replicas can keep copies outside the volume you delete, so they must be included in the process. The assessor's question shifts from what happened to a disk to whether the platform's controls and records show the data cannot be recovered.
- Key destruction: Use customer-managed keys where the platform supports them, and schedule key deletion after the volume is removed.
- Snapshots and backups: Inventory every copy and remove or expire it within the same process.
- Provider assurance: Obtain the provider's documented sanitization statement and the scope it covers.
- Shared hosts: Confirm how the provider prevents residual data from reaching another tenant.
- Records: Keep deletion events from the audit log as evidence, linked to the asset record.
Confirm with each cloud provider which erasure guarantees apply to your services and how deletions are logged.
How an assessor tests A.7.14 and what they request
This table lists the test steps an assessor typically runs for A.7.14, the evidence each step asks for, and the findings that often come up when disposal records do not match the asset register. Read each row as a question the assessor will ask and prepare the matching record before fieldwork begins.
| Test step | Evidence requested | Common findings (illustrative) |
|---|---|---|
| Disposal procedure walkthrough | Written disposal and re-use procedure, sanitization method by media type, approval steps, and the owner of each step | Procedure covers laptops but not servers, network appliances or printers with internal storage |
| Sample of disposed or reused devices traced to records | Selected device records from the asset register, disposal or re-use tickets, handover forms and dates of removal from service | Devices leave the building with no ticket, or the ticket has no serial number to match |
| Verification of sanitization or destruction evidence | Sanitization logs or certificates, overwrite tool output, degaussing or shredding records, and who verified the result | Logs exist but do not name the device, or verification was never recorded as a separate check |
| Third-party disposal contracts and certificates | Signed contract or service terms, chain-of-custody documents, certificates of destruction and the disposal vendor's data handling terms | Certificates list batch counts without serial numbers, or the contract does not require destruction evidence |
| Asset register reconciliation | Asset register extract, disposal log, stock counts and a reconciliation showing each retired item's final status | Register still lists retired devices as in use, or devices in the disposal log are missing from the register |
| Handling of devices that failed sanitization | Exception records, re-processing or quarantine logs, escalation to the owner and the final disposal evidence | Failed devices are returned to stock without re-testing or a documented decision |
Implementing A.7.14 in six steps
This sequence turns A.7.14 from a policy statement into a repeatable chain of decisions, checks and records, so that every device leaving the organization can be traced to a documented sanitization result. Each step produces an artifact an independent auditor can sample.
Define sanitization standards per media class
Start by listing every type of equipment that can hold storage media, such as laptops, servers, network appliances, printers with disks, phones and removable drives. For each class, the information security owner documents which sanitization method applies (overwrite, cryptographic erase, degaussing or physical destruction) based on the data classification it may hold. The output is a sanitization standard approved by the control owner. It is done when every media class maps to one method and the approval is dated and versioned.
Set the disposal and reuse gate
Create a gate checklist that every item must pass before it is released for resale, donation, reassignment or scrap. The checklist confirms the item is identified, the storage media status is known, the sanitization method from step one is recorded, and licensed software has been removed or the license has been released. IT operations completes the checklist and a second person approves it. The gate is working when no device can leave the inventory without a signed checklist.
Tie each device to an asset record
Link every device to its asset record before it enters the gate, using a unique identifier such as the serial number and the storage media serial where available. In a GLPI-based setup, the Assets module can hold computers, monitors, software, network equipment and other items, populated manually or through the GLPI Agent's native inventory. Wazuh Syscollector inventory can confirm installed software and hardware on enrolled endpoints. The output is an asset-to-record link that shows what was disposed of and where it was held. Confirm the exact fields your inventory tool supports before you design the record.
Perform and verify sanitization
Run the approved method on each device and capture the evidence, including the tool or procedure used, the operator, the date and the device identifier. Verification matters as much as the wipe, so a second check confirms that the data cannot be recovered by the method's own standard, for example by sampling or by checking that encryption keys were destroyed. Destruction of a drive should be recorded with the destruction vendor's certificate. The output is a verification log entry for each device. It is done when every log entry is complete and reviewed.
Handle exceptions and failures
Some devices will fail sanitization, be unreadable, or be required in a state that the standard does not allow. Record each case in an exception register with the device, the failure, the risk assessment, the interim control such as physical destruction or quarantine, and the approver. Items in the register stay out of the gate until the exception closes. The output is a register that shows how the organization decided each unusual case. An auditor usually samples this register to test whether exceptions were handled rather than ignored.
Retain disposal records
Store the completed gate checklists, verification logs, exception register entries and any third-party destruction certificates together, indexed by asset identifier and date. Set a retention period that your legal and contractual obligations require, and confirm it with counsel, since no retention period is set by the standard itself. Access to these records should be restricted and their integrity protected. The output is a retained record set that lets you reconstruct any disposal on request. It is done when a sample device can be traced from its asset record to its destruction or reuse proof within a short search.
Evidence that passes an A.7.14 audit
An auditor testing A.7.14 follows a single piece of equipment from the asset register through disposal or reuse and checks that each step left a record. The cards below cover the documents and records that connect those steps, and the routine checks that keep them accurate between audits.
Disposal procedure
A written procedure sets out who decides whether a device is disposed of or reused, which sanitization method applies to each media type, who performs the work, and who signs off. Assessors check that the procedure names the roles that actually do the work and that staff follow it. Confirm that the procedure covers equipment returned by leasing vendors, warranty replacements and devices with failed drives, since those cases are often missed.
Sanitization standard per media type
Define one approved method for each class of storage: spinning disks, solid-state drives, mobile devices, network appliances and removable media. Record which standard or vendor tool the method follows and what verification step proves the overwrite or cryptographic erase succeeded. Assessors look for methods chosen by media type, not a single generic instruction applied to everything.
Asset register entries linked to disposal tickets
Each disposed or reused item should have an asset record that carries its serial number, storage media, owner and status, and that record should link to the ticket that authorized the disposal. An auditor will pick a device from a disposal log and trace it back to the register, then forward to the ticket. GLPI's Assets module can hold these records, and its native inventory can keep hardware data current when devices are entered or pushed automatically.
Sanitization and destruction logs
The log records the date, device identifier, method used, the person who performed it, the verification result and any failure or retry. Logs written by hand after the fact are weaker evidence than entries captured at the time of the work. Check that every line can be matched to a register entry and that failed sanitizations were escalated rather than silently closed.
Third-party certificates of destruction
When a disposal contractor destroys or wipes media, the organization still owns the outcome, so the certificate must name the serial numbers or batch covered, the method, the date and the facility. Confirm the scope on each certificate matches the items handed over, and keep the contract clause that requires the vendor to provide them. Ask vendors to confirm which destruction standard they follow and whether they accept audit visits.
Reuse approval records
Before a device goes back into service, a named approver should confirm that sensitive data and licensed software were removed or overwritten and that the reuse matches the asset's classification. Record the approval with the sanitization log reference. Assessors often find reuse approvals missing for devices that were quietly reassigned by an IT technician, so check whether reassignment in the service desk triggers a reuse check.
Exception logs and routine reconciliation
Record any device that could not be sanitized as planned, such as a failed drive or a unit held under legal hold, together with the risk decision, compensating control and approver. Between audits, sample a set of disposed items and reconcile the register against current inventory and open tickets, so that missing devices are found before the assessor finds them. Schedule the sampling and record its results as evidence in its own right.
What meeting A.7.14 costs in money and effort
This table breaks the cost of meeting A.7.14 into its components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No figures are given because none are supplied for this control, so use the table to structure requests for quotes and internal budgets. The main takeaway is that disposal volume and the choice between in-house and outsourced destruction drive most of the variable spend.
| Cost component | One-time or recurring | Who is paid or who bears the effort | What drives it up or down |
|---|---|---|---|
| Sanitization tooling or licenses | Recurring if licensed per device or per year, one-time if a perpetual tool is bought | Software vendor, or internal IT staff who run the tool | Number of devices per year, mix of drive types, and whether free or open-source wiping tools meet your method |
| Engineering and IT staff time | Recurring | Internal IT, desktop or platform engineers who sanitize, reimage and log each item | Device volume, number of exceptions such as failed wipes, and whether sanitization is scripted |
| Asset record upkeep | Recurring | Asset manager or IT operations staff who link each disposal to a record | How many systems hold asset data, and whether inventory is pushed automatically by an agent or entered by hand |
| Third-party destruction fees | Recurring per collection or per unit, sometimes with one-time setup | Certified destruction or recycling vendor | Whether drives are wiped and reused or physically destroyed, and the certificate detail the vendor provides |
| Verification sampling | Recurring | Internal security or compliance staff who check records against physical or logged outcomes | Sample size you set, number of disposal sites, and how often verification runs |
| Auditor sampling time | Recurring, at each audit cycle | Independent certification body, billed to your organization | Number of disposal events in the audit period and how well records are organized before the visit |
| Outsourced readiness support | One-time for setup, optional recurring for reviews | Implementation partner, billed under a written scope | Number of systems in scope and whether procedures and records need building from scratch |
Open-source tools that keep disposal evidence in order
How does GLPI Assets record equipment and track disposal status?
GLPI Assets keeps an inventory of computers, monitors, software, network equipment, peripherals, printers, phones and racks, so each item can carry a status that shows whether it is in use, in storage, awaiting disposal or disposed of. Records can be entered manually or pushed automatically by the GLPI Agent through the native inventory built into GLPI since version 10. For A.7.14, the useful part is linking each asset to its sanitization record, the method used, the person who verified it and the disposal or re-use date. GLPI is licensed under GPL-3.0-or-later. GLPI does not wipe drives itself, so the sanitization evidence must come from the tool or process your team uses, and you should confirm how GLPI fields and statuses map to your own disposal workflow before relying on them.
Can Wazuh Syscollector confirm that a retired device is no longer active?
Wazuh Syscollector collects hardware, operating system, installed software, network interfaces, open ports, running processes, services, users and groups, and Windows updates from each endpoint, then stores them in the Wazuh indexer for inventory views and reports. Comparing that inventory against your disposal register shows whether an asset marked as disposed is still reporting in, which is a useful reconciliation check for an auditor. Wazuh is licensed under GPL-2.0-only. It does not verify that storage media has been overwritten or destroyed, and it cannot see devices that never had the agent installed. Confirm agent coverage for your fleet, including servers and laptops that leave the network, before presenting it as a control.
How can Zammad tie disposal requests to an auditable ticket trail?
Zammad is a web-based helpdesk that brings email, chat, telephone and social media messages into one ticket system, so a disposal request raised by a department can be logged as a ticket and carried through approval, sanitization and closure. Each step, the approver, the assigned technician and the closing note stay attached to the same record, which gives an assessor a single chain to follow. Zammad is licensed under AGPL-3.0-only. It does not sanitize media or generate certificates of destruction, so those documents must be attached or linked from your own process. Check the ticket states, roles and attachment handling against your approval rules during setup.
Do any of these open-source tools sanitize storage media?
No. GLPI, Wazuh and Zammad record, inventory and route work, but none of them performs sanitization, overwriting, degaussing or physical destruction. A.7.14 asks the organization to verify that sensitive data and licensed software have been removed or securely overwritten before equipment is disposed of or re-used, so the sanitization itself must be carried out by a validated method that your team selects and documents. The tools support the evidence around that step. Ask your sanitization vendor or internal team to state the method used for each media type and to produce a record that can be linked to the asset in GLPI.
Which evidence should link an asset record to a disposal certificate?
An assessor will usually expect a traceable chain: the asset identifier, its classification and storage media type, the disposal or re-use request, the sanitization method and its result, the verifier's name and date, and the final disposal or re-use outcome. Keep the asset ID consistent across GLPI, the Wazuh inventory and the Zammad ticket so that a single identifier can be followed through all three. Where a third party collects or destroys equipment, the vendor's certificate of destruction should be stored with the ticket and referenced in the asset record. Confirm with your certification body which records it expects for your scope, since the Statement of Applicability and your own procedures determine what is required.
How much effort do these tools take to set up and run?
Effort depends on the number of assets, the number of sites, how much inventory is automated and how many disposal routes exist. Setup usually covers installing and configuring the GLPI Agent and Wazuh agents, defining asset statuses and disposal fields, creating a ticket workflow in Zammad, and agreeing the naming of asset identifiers. Costs are mainly internal staff time, hosting in your own infrastructure and any external help with configuration. Software licensing is not a cost for these three tools because they are open source, but you still pay for the infrastructure, storage and operations work. Ask any implementation partner for a written scope that lists the tools, the number of endpoints, the integrations and the deliverables, since no fixed effort figure can be stated here without that detail.
Can DeployOpen set up these tools inside our own infrastructure?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, so GLPI, Wazuh and Zammad can be deployed there and connected to your existing asset and disposal processes. DeployOpen prepares the systems and evidence for an assessment, but it does not issue audit reports or certificates, and the organization still owns its controls and its sanitization decisions. Engagements are normally fixed-scope, with the scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
What should we confirm before choosing these tools for disposal records?
Confirm that each tool supports the fields, statuses and integrations your process needs, and test them on a sample of assets before rollout. Check agent support for every operating system in your fleet, the retention settings for inventory and ticket data, and how access to disposal records is restricted. Confirm the licence terms with each project, since GLPI uses GPL-3.0-or-later, Wazuh uses GPL-2.0-only and Zammad uses AGPL-3.0-only, and each has different obligations if you modify or distribute the software. Finally, agree with your auditor how the records will be sampled and presented, so the evidence matches what the assessment will test.
Who owns disposal evidence, who can help and what the auditor checks
Your organization owns A.7.14. Leadership must decide how equipment leaves the estate, who approves each disposal or re-use, and which sanitization method applies to each class of device and media. The control is not met by a vendor contract alone, and an auditor will look for proof that your own staff ran the process and kept records.
- Procedure and approvals: Write the disposal and re-use procedure, name the approvers, and define when a device must be sanitized before it leaves a secure area.
- Sanitization standard: Choose the methods (overwrite, cryptographic erase, physical destruction) and decide which devices and storage media each method covers.
- Disposal records: Keep a per-item record showing the asset, the person who verified data removal, the method used and the date.
- Third-party disposal terms: If a recycler or reseller handles equipment, your contract should require certificates of destruction or sanitization and the right to audit the provider.
- Ongoing ownership: Assign a named owner who reviews exceptions, such as devices that failed sanitization, and reports them.
Before engaging anyone, confirm that a named owner, a written procedure and a complete disposal log already exist, because an auditor tests those first.
An implementation partner prepares the systems and evidence that support the control. DeployOpen, for example, can set up the asset records, ticket workflow and evidence templates that the organization then operates. The partner does not decide the disposal policy, approve disposals or certify anything, and its work is documented in a fixed-scope agreement agreed in writing before work starts.
- Asset linkage: Connect the asset inventory to disposal tickets so each retired device has one traceable record from decommissioning to destruction.
- Ticket workflow: Configure approval and close-out steps in a self-hosted helpdesk so verification cannot be skipped silently.
- Evidence templates: Build forms for sanitization method, verifier, date and exceptions, and set retention rules for them.
- Tooling integration: Use inventory data from the organization's own platforms to confirm that devices in the disposal queue match records.
- Handover: Train the staff who will run the process and document how the evidence is produced.
Ask any partner to state in the scope which deliverables it will produce and which steps remain with your staff.
The independent auditor tests whether A.7.14 operates in practice. An auditor reviews the procedure, then selects a sample of disposal and re-use events and traces each one back to the asset record, the verification step and the final disposal evidence. Testing is performed by an independent assessor, and only the accredited certification body issues the ISO/IEC 27001 certificate, based on its own audit.
- Sampling: The auditor chooses items from the disposal log and from the asset inventory, so records must be complete enough to sample from.
- Tracing: For each sampled item, the auditor expects evidence that sensitive data and licensed software were removed or overwritten before disposal or re-use.
- Exceptions: The auditor checks how failed sanitizations were handled and whether they were escalated.
- Third-party proof: Certificates from recyclers or destruction providers are checked against the items they claim to cover.
- Certificate authority: Only the certification body grants certification, so confirm its accreditation before relying on any claim.
Before the audit, run a internal sample yourself and confirm that every item traces from start to finish.
Where A.7.14 evidence usually breaks down
Most A.7.14 findings are not about the disposal vendor. They come from gaps before and after the physical act: the asset register, the verification step, the paperwork that follows and the hardware nobody counted. Each card below names one place the evidence trail usually fails and the check that closes it.
Asset register missing serial numbers
An asset record that says "laptop, finance team" cannot prove which device left the building. Without a serial number, asset tag or device identifier, an assessor cannot match a disposal record to a register entry or confirm that every storage-bearing device was accounted for. Check that each device with storage has a unique identifier recorded at intake and that the register is reconciled against what is actually on the disposal manifest. Inventory tools such as GLPI can hold these fields, but the organization must enter or import them.
Reuse without a verification step
Equipment is often reissued or redeployed after a quick reimage without anyone confirming that sanitization actually ran. A.7.14 asks the organization to verify that sensitive data and licensed software were removed or securely overwritten before reuse, so the verification itself is the evidence. Check that every reuse path, including internal redeployment and donation, requires a named person to sign off a recorded verification result before the device returns to stock.
Destruction certificates that do not name devices
A generic certificate stating that "all media from batch 12 was destroyed" does not show which devices were in the batch or which method was applied to each. Assessors commonly ask for a record that lists each serial number, the sanitization or destruction method, the date and the operator. Check that the vendor's certificate references the same identifiers as your disposal log, and that you can trace one device from the register to the certificate without relying on the vendor's word.
Cloud and leased hardware not covered
Storage that the organization does not physically own, such as cloud volumes, managed database snapshots, leased laptops and returned rental servers, often sits outside the disposal procedure. The lessor or provider typically controls the physical sanitization, so the organization must obtain its evidence contractually. Check the lease or cloud provider terms for sanitization commitments and for a way to obtain written confirmation, and confirm that these assets appear in the register at all.
Failed sanitizations with no follow-up
A wipe that reports an error, a drive that fails verification or a unit with unreadable sectors is often moved to scrap without a record of the failure. That gap leaves the organization unable to show that the item was escalated, destroyed by a different method or excluded from disposal. Check that the disposal workflow has a defined failure path that routes the device to physical destruction, records the exception and ties it to a ticket with an owner who closes it.
How much does A.7.14 cost, and can we do it ourselves?
What drives the cost of meeting A.7.14 secure disposal?
The cost depends on how many devices and storage media you retire each year, how many sites and vendors handle them, and how much of the disposal gate is automated. A.7.14 does not set a price. It asks you to verify that sensitive data and licensed software were removed or securely overwritten before equipment leaves your control. The main cost components are staff time to define the procedure, tooling to record asset state, sanitization tools or services, and the time an auditor or your own team spends sampling records. Ask any provider for a quote built from a written scope that states your asset volumes, disposal routes and the records you expect to keep.
How long does it take to build a disposal gate?
The timeline depends on how much of your asset inventory is already reliable and how many disposal routes you use. A gate is a checkpoint: equipment cannot leave the asset register or a site until sanitization is verified and recorded. Most of the effort goes into agreeing the rules, mapping asset types to sanitization methods, and wiring the checkpoint into existing ticketing and inventory processes. Confirm the expected duration with any implementation partner in writing, and confirm internally how long your change approval and procurement cycles take, since those often set the real pace.
Can our in-house team run A.7.14 without outside help?
Often yes, if you have a clear asset inventory, a named owner for disposal, and staff who can verify sanitization. A small team can manage the gate with a register, a documented method for each media type and a simple record template. Outside help makes most sense when asset data is scattered, when you lack anyone who can check sanitization tools or logs, or when you need the procedure built into systems you already run. An in-house team still owns the control. Whatever you choose, the records must show who verified each disposal and when.
What does the work need from IT and facilities?
A.7.14 spans two groups. IT owns the asset inventory, sanitization method, verification and records. Facilities owns physical custody, secure storage before collection, and handover to disposal or recycling vendors. The gate only works if both groups agree on the hand-off point: no item leaves the building without a completed and signed-off sanitization record. IT typically needs an accurate list of devices, their storage media and installed software. Facilities needs locked holding areas and a documented chain of custody. Agree these responsibilities in writing before the first disposal batch.
Is an implementation partner worth the cost for A.7.14?
A partner is worth considering when the cost of building the gate and its evidence exceeds the cost of an external checkpoint, or when your team cannot dedicate time to it. DeployOpen can plan, implement and document a disposal workflow inside your own infrastructure, including asset tooling such as GLPI and endpoint inventory from Wazuh, and prepare the records an auditor will sample. DeployOpen does not verify sanitization on your behalf in a way that replaces your own control, and it does not issue audit reports or certifications. Scope and deliverables are agreed in writing before work starts, and a quote follows from that scope.
How does an auditor sample disposal records for A.7.14?
An auditor usually starts from a population of disposals over the audit period, then selects a sample to test. Sampling methods vary by auditor and by the assurance level your certification body applies, so confirm the approach with them. For each selected item, the auditor typically looks for an asset register entry, a sanitization or destruction record, evidence that the record was verified, and a chain of custody to the final disposal or re-use. Keep a complete population: if your records only cover some disposals, the sample will expose the gap. Ask your certification body how they select samples before the audit.
What is a sanitization record and what should it contain?
A sanitization record shows that a specific device or medium was cleared of sensitive data and licensed software, by which method and by whom. At minimum it should identify the asset, its serial number or inventory tag, the sanitization or destruction method, the tool or vendor used, the verifier and the date. For third-party disposal, add the vendor's certificate of destruction and the chain of custody. Illustrative example: a laptop record lists its inventory tag, the overwrite method used, the verifier's name and a link to the collection receipt. Confirm the exact fields your certification body expects.
Which costs recur after the disposal gate is built?
Recurring costs come from running the gate every time equipment is retired. These include staff time to verify each batch, updates to the asset register, vendor fees for collection or destruction, and periodic review of the procedure. Tooling may carry licence or hosting costs, and open-source platforms still need maintenance time. Ask your provider to separate one-time build costs from ongoing support, and to state whether any retainer covers reviews of disposal records before each audit cycle.
How DeployOpen prepares A.7.14 evidence in your environment
DeployOpen works on A.7.14 Secure disposal or re-use of equipment as part of a wider implementation inside your own infrastructure. We prepare the systems that track equipment and sanitization records and the evidence an independent auditor will review. The organization keeps ownership of its disposal decisions, and only the certification body issues a certificate.
How we scope
- The written scope names which equipment classes, sites and disposal routes fall under A.7.14 before any work starts.
- Scope lists the storage media categories, re-use paths and third-party disposal providers the sanitization records must cover.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing and a quote that follows from that scope.
How we build
- We configure an asset register in GLPI so each computer, storage device and network device carries a traceable record.
- We deploy the Wazuh Syscollector module to collect hardware and installed software inventory, showing what each endpoint holds before disposal.
- We set up Zammad tickets as the workflow for each disposal request, with fields for sanitization method, verifier and sign-off.
How we hand over
- You receive documented procedures for verifying removal of sensitive data and licensed software before disposal or re-use.
- Handover includes sample disposal records, tied to asset IDs, showing the sanitization method and who verified it.
- We document the configuration so your internal team or an independent assessor can reproduce and review the evidence trail.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- A retainer can cover periodic review of asset inventory against disposal tickets, so gaps surface before an audit.
- Confirm with your auditor which records and sampling they expect for A.7.14 before we finalize the evidence format.
