CC6.5 Disposal of physical assets: SOC 2 requirements

What CC6.5 disposal of physical assets asks for in SOC 2

When an auditor or customer asks how retired disks, laptops, servers and backup media are cleared, they are asking how you meet CC6.5 in practice. The criterion expects you to keep logical and physical protections on a physical asset until the data and software on it can no longer be read or recovered and are no longer needed. Its point of focus concerns removing that data and software before the asset leaves the organization's control, whether the device is resold, donated, returned to a leasing company, sent for repair or thrown away. The risk is simple: a drive that leaves your building with recoverable customer data, credentials or keys has left your control with the data still on it, and that exposure can happen long after the system itself was retired.

The difficulty is proving it after the fact. Auditors test a sample of disposals and ask for records, so the reader needs a trail that links each asset to its owner, its storage media, the sanitization method used and the person who approved release. Gaps usually appear in three places: asset registers that were never updated when a laptop was reassigned, cloud-managed hardware where the provider handles the physical disk and you hold no certificate of destruction, and untracked spares or backup tapes that sit in a cupboard and never enter the disposal process at all. Confirm early which of these apply to your environment, because each one changes whose records you must produce.

Start by answering three questions in writing: which asset classes hold data (endpoints, servers, network devices with stored configuration, removable and backup media), which party performs sanitization for each class, and what evidence that party gives you. Tools that inventory hardware can anchor the register. GLPI's Assets module records computers, network equipment and other hardware, and the Wazuh Syscollector module collects hardware and operating system details from each endpoint, which helps you reconcile what is deployed against what is recorded. Related disposal expectations appear in C1.2 for confidential information and P4.3 for personal information, so the same record should show whether a disposed asset held either type of data. Confirm with your auditor how they want that link demonstrated before you pick a method.

Which assets and teams fall under CC6.5 disposal

CC6.5 applies to any physical asset that stores data or software inside the system boundary, so the scoping decisions come before the disposal procedure. The cards below cover the asset classes that usually fall in scope, how cloud hosting moves part of the work to a provider, how confidentiality and personal information raise the bar, and which teams own each step.

Laptops and workstations

Employee laptops and desktops are the most common disposal events and often the most loosely tracked. They hold cached credentials, downloaded files and synced mail, so each device that leaves the organization needs a recorded wipe or destruction step. Check that the asset register matches what is actually issued, including devices returned by leavers and devices repaired under warranty, since a repair vendor may take custody of the disk.

Servers and hypervisor hosts

Physical servers in on-premises racks or co-location cages store production data, configuration and secrets, often on multiple drives. Disposal covers the drives, any hardware RAID or controller cache, and management interfaces such as out-of-band controllers that retain logs or credentials. Confirm who signs off when a server is retired, and that the decommission record links to the asset ID in the inventory.

Storage arrays and backup media

Storage arrays, SAN and NAS appliances and tape or removable backup media hold the largest concentrations of data. Controller-based encryption helps, but sanitization still needs to be verified against the vendor's guidance for the specific array. Backup media moved off site or to a vault should be on the same disposal register, because data often outlives the production system it came from.

Removable media and network gear

USB drives, optical discs and portable disks are easy to lose and easy to forget. Network switches, routers and firewalls store configurations, credentials and sometimes logs in their flash memory, so reset and configuration removal belong in the procedure too. Ask whether these devices appear in the inventory at all, since an asset that was never recorded cannot be shown to have been disposed of properly.

Cloud-hosted systems and provider controls

When the platform runs in a public cloud, the provider usually handles media sanitization for the physical drives under its own controls. The organization still owns disposal of virtual disks, snapshots, images and backups it created, and must deprovision them. Describe the split in the system description, and obtain the provider's current SOC report so the subservice organization controls can be referenced correctly.

Confidential and personal information

Where the system holds confidential information, C1.2 requires disposal once it is no longer needed. Where it holds personal information, P4.3 applies to secure disposal of that data. Either category sets a higher bar for verification, typically requiring a record that names the data types, the method and the destruction or certificate of erasure. Confirm whether these criteria are in scope before designing the disposal evidence.

Teams that own each step

IT operations usually owns wiping, reimaging and removing devices from the inventory. Facilities controls physical custody, secure storage before pickup and destruction on site. Finance records write-offs and asset retirements, which should match the disposal log. Vendors that collect hardware own their own chain of custody, so their certificates of destruction become evidence the organization must retain and review.

How an assessor tests disposal of physical assets

This table walks through the test steps an assessor typically follows for CC6.5, with the evidence each step needs and the findings that appear most often. Read it as a checklist of what to prepare before fieldwork, since most disposal exceptions come from missing records rather than from weak sanitization itself.

Test step	Evidence the assessor expects	Common finding
Review the disposal policy	Written policy covering retirement, data removal, sanitization method by media type, destruction and approval, with an owner and review date	Policy exists but does not name media types, approvers or the method for drives in cloud or leased hardware
Obtain the population of retired assets	Export of assets marked retired, lost, returned or transferred during the observation period, ideally from the asset register	Asset register does not match retirement tickets, so the population cannot be shown to be complete
Select a sample of retired assets	Sample drawn from the complete population, covering laptops, servers, drives and removable media where applicable	Sample drawn only from a convenient list, or the population was never provided to the assessor
Trace each sample to a disposal record	Ticket or work order showing the request, the approver, the date and the asset identifier such as serial number	Assets with no disposal record, or records that cannot be linked to a specific asset
Confirm data removal or destruction	Sanitization log or tool report for the device, or a destruction record that matches the media type and method in the policy	Sanitization cannot be shown for a sampled item, or the log does not name the device
Verify handover to a third party	Chain-of-custody record, pickup manifest and the vendor's certificate of sanitization or destruction for each sampled item	Vendor certificate missing for a sampled item, or certificate does not list that serial number
Check that the asset left the control of the organization only after removal	Dated sequence showing sanitization before the asset was removed from the secure area, stored or shipped	Asset shipped or reissued before the sanitization date, or stored without a status change in the register
Confirm that removed assets are no longer in use	Register status change, decommissioned network and directory entries, and endpoint agent removal where the platform tracks it	Retired device still reporting to monitoring tools or still holding directory or certificate bindings

Implementing CC6.5 disposal step by step

This sequence turns CC6.5 into a repeatable record trail, so every physical asset that leaves the organization can be traced from its last use to verified sanitization or destruction.

Write the disposal procedure and sanitization methods
The organization writes a disposal procedure that names each media type in use, such as laptops, servers, drives, mobile devices and backup tapes, and states the sanitization or destruction method for each. Management approves the document and it is version controlled. The output the auditor looks for is an approved procedure that matches the media the organization actually retires, with a clear method for each type. The organization owns this procedure. An implementation partner can draft the method matrix from the organization's asset types, but the approval and the decisions stay with management.
Register every asset before it is retired
Each physical asset that stores data or software is recorded in an asset register before it is retired, with its owner, location, asset type and the systems or data it held. Inventory tools can populate this register from discovery, for example GLPI's Assets module, which tracks computers, network equipment and other hardware entered manually or pushed by the GLPI Agent. Wazuh's Syscollector can also show hardware and installed software on monitored endpoints. The output is a register where every retired item has a traceable entry. Confirm with your tool vendor which asset types and fields each product captures in your version.
Assign approval for release and disposal
A named role approves each asset's release from service and its disposal method before any sanitization starts. The approver should be independent of the person who runs the work, so one person does not both authorize and confirm destruction. The output is a signed or system-recorded approval linked to the asset register entry, showing who approved, when, and which method applies. Your procedure should say who holds this authority and what happens when the normal approver is unavailable.
Sanitize or destroy and verify the result
Staff or a qualified technician removes data and software using the method in the procedure, such as a validated overwrite, cryptographic erase or physical destruction. Verification confirms that data and software can no longer be read or recovered, using a documented check that matches the method. The output is a sanitization record with the asset identifier, method, operator, date and verification result. Any asset that fails verification stays in the process until it passes or is destroyed. Confirm the verification approach with the standard or method your organization adopts.
Record the handover to a disposal vendor
When an external disposal or recycling vendor takes custody, the organization records the transfer with a chain-of-custody document listing each asset identifier, quantity, transport method and receiving party. The vendor's certificate of destruction, where provided, is filed against the register entries. The output is a traceable custody record from the organization to the vendor and a certificate linked to each asset. Ask the vendor in writing what it certifies, how it tracks assets between sites and whether it subcontracts any step. The organization keeps accountability for the vendor's handling under its vendor management controls.
Close each disposal record
Once sanitization or vendor destruction is verified, the register entry is closed with its final status, the evidence references and the date of closure. Open records are reviewed periodically so that no asset remains in an unknown state. The output is a closed record for every retired asset that links the approval, the sanitization or destruction evidence and the custody documents. Auditors often sample these closed records against the register, so each entry should be complete on its own without relying on memory or email threads.

Evidence that passes a CC6.5 disposal test

A CC6.5 test follows one asset from the moment it leaves service to the moment its data is gone. The cards below are the records that connect those steps, and an assessor will expect each one to match the others for the same asset. Keep them linked by asset ID so a single sample can be traced end to end.

Disposal policy and procedure

This is the written standard that tells staff how retired devices, drives and removable media must be handled before they leave the organization's control. It should name the approved sanitization methods for each media type, who may authorize disposal, and when a device must be held instead of released. Check that the procedure matches what staff actually do, because an assessor will compare the two. Review it at least once a year and record the approval date.

Retirement ticket

Each asset that leaves service needs a ticket that records the request, the reason for retirement, the approver and the date the asset was removed from production. The ticket is the starting point of the trail, so it should carry the asset ID that appears in every later record. Tickets opened without an asset ID are a common gap, because the assessor cannot link them to the sanitization record.

Sanitization or destruction record

This record states which method was used, such as overwriting, cryptographic erase or physical destruction, and the tool or procedure that performed it. It must also show how the result was verified, for example by a read-back check or a log of the wipe tool's exit status. Name the person who performed the step and the date it was completed. A record that says only "wiped" will not show the data is unrecoverable.

Vendor certificate of destruction

When a third party shreds, degausses or recycles media, the organization needs a certificate from that vendor. It should list the serial numbers or asset IDs received, the destruction method, the date and a signed statement of completion. Confirm the vendor's own controls with a due diligence review, and treat a certificate that lists only a count of items as insufficient. The vendor's assurance reports, where offered, belong in the third-party file.

Chain-of-custody forms

Between the moment a device is collected and the moment it is sanitized or destroyed, each handoff should be signed by the sender and the receiver. The form shows who held the asset, where it was stored and when custody changed. Gaps in custody are often where an assessor finds exceptions, so store locked containers and transport records alongside the forms. Keep these records for the same retention period as the disposal file.

Closed asset register entry

The asset register should show the final status of each device as disposed, with the disposal date and a reference to the sanitization record and certificate. An entry that still reads "in stock" or "unknown" for an asset that was destroyed is an exception waiting to be found. Open-source inventory tools such as GLPI's Assets module can hold these fields, and the Wazuh Syscollector inventory can confirm that a retired endpoint has stopped reporting. Reconcile the register against the disposal log at each review.

How GLPI and Wazuh produce disposal evidence

The most useful thing GLPI and Wazuh do for CC6.5 is help you prove that every storage-bearing asset has a recorded end of life. Neither tool sanitizes media or verifies that data is unrecoverable. Sanitization, and the proof that it worked, sits with your own procedure and tooling. What these platforms give an assessor is a register that shows what existed, who owned it, where it went and whether it is still reporting on your network.

GLPI's Assets module can hold the asset register for computers, monitors, network equipment, peripherals, printers, phones and racks. Storage-bearing devices such as laptops, workstations, servers and removable drives can be entered manually or pushed automatically by the GLPI Agent through native inventory, which GLPI has included since version 10 (GPL-3.0-or-later). Decide which asset types must carry a disposal state, such as in stock, in use, awaiting sanitization, sanitized, or transferred to a vendor, and record the date and responsible person at each transition. Confirm with your GLPI administrator that the disposal state is captured through a field, status or ticket workflow that survives audit export, and keep the sanitization certificate or vendor receipt attached to the asset record. For more on the module, see the GLPI Assets documentation.

Wazuh's Syscollector module reports hardware, operating system, installed software, network interfaces and other inventory from each endpoint to the Wazuh indexer, where the dashboard displays it (GPL-2.0-only). Reconcile the two sources. Any asset marked as sanitized or retired in GLPI that still appears as active in Wazuh signals either a missed step or a stale record, and an assessor will test exactly that gap. Set a review cadence and log the result of each reconciliation, including exceptions and who closed them. Confirm whether your agent deployment covers every device class you have listed, since devices without an agent will not appear in Wazuh and need evidence from another source. The Wazuh system inventory documentation describes what each endpoint reports.

What CC6.5 disposal costs to meet

This table breaks down the cost components of meeting CC6.5 for asset disposal, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. No price figures are supplied for these components, so use the table to structure your own estimates and quote requests. Read the rows top to bottom to see where open-source tooling reduces spend and where it does not.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it up or down
Asset register tooling	Software vendor or self-hosted platform team	Recurring if licensed, one-time setup if self-hosted	Self-hosted open-source inventory such as GLPI removes license spend but keeps hosting and upkeep costs
Register and integration engineering	Implementation partner or internal platform engineers	One-time, with later maintenance	Number of asset types, depth of automated inventory feeds, and how many systems the register must reconcile with
Sanitization hardware or vendor fees	Internal team for tooling, or a certified destruction vendor	Per retirement or per batch, or one-time if purchased	Media types, volume of retirements per year, and whether sanitization happens in-house or off-site
Certificate of destruction	Destruction vendor or internal operations staff	Recurring per disposal batch	Number of batches, required detail on each certificate, and whether vendor fees bundle certificates
Staff time for each retirement	Internal IT and operations staff	Recurring with each asset retired	Fleet size, retirement frequency, and how much of the workflow is ticketed and automated
Evidence upkeep	Internal compliance or security staff	Recurring across the observation period	How much disposal evidence is captured automatically and how well records link asset IDs to certificates
Auditor sampling effort	Independent CPA firm, with internal staff preparing samples	Recurring each examination period	Number of disposals in the period, quality of records, and how quickly staff can produce samples

Where disposal evidence usually breaks down

Disposal evidence rarely fails at the moment of wiping. It fails earlier, when an asset never enters the register, and later, when the paperwork cannot tie a sanitized device to a specific record. The cards below cover the gaps assessors most often find, and the fix an organization can put in place before the examination window opens.

Retired hardware missing from the register

Servers, laptops and storage arrays that leave service often disappear from the asset list before anyone records their removal. An assessor who samples disposed items and then checks the inventory will find gaps the moment a serial number has no matching entry. Before the window opens, require that every retirement starts with a register update and a ticket, and reconcile the register against endpoint inventory from GLPI, with the GLPI Agent or Wazuh Syscollector data, at a fixed cadence. An asset with no retirement record is treated as unaccounted for.

Cloud volumes deleted without records

Deleting an EBS volume, a managed disk or an object storage bucket feels like disposal, but the platform rarely produces a sanitization record. Snapshots and replicas can also survive the deletion. Ask the team to document which volumes held regulated or customer data, what deletion or cryptographic erasure method the provider applies, and where the deletion event is logged. Confirm with the cloud provider how the platform handles overwriting and key destruction, because the answer determines what evidence you can show.

Vendor certificates that omit serial numbers

When a disposal vendor issues a certificate that lists a batch count or a pallet reference, the organization cannot link any single device to a destruction event. Assessors want each serial number traced from the register to the certificate. Before engaging a vendor, specify in the contract that certificates list serial numbers, asset tags, the method used and the completion date for each item. Reject certificates that cover only totals.

Spares and returned devices without status

Spare laptops on a shelf, devices returned by departing staff and units held for repair often have no owner and no state. A device that is neither in use nor sanitized is an open disposal question. Give each spare a status such as in stock, awaiting sanitization, or sanitized, and record who holds it. Storage of unsanitized devices should be covered by the same physical access controls as the rest of the asset pool.

Sanitization claims without a described method

Statements such as the drive was securely wiped rarely survive questioning. Assessors ask which tool ran, which standard or procedure it follows, whether verification was performed, and what happens to drives that fail. Write a short sanitization procedure that names the method for each media type, including how flash and self-encrypting drives are handled, and keep a run log that shows the tool version and the verification result. Ask your vendor or internal team to explain the method in plain terms before the examination begins.

Who does what for CC6.5: your team, a partner and the auditor

Your organization owns CC6.5. The control only holds if someone accountable decides when an asset may leave the environment, approves the method used to remove data and software, and signs off that the asset is no longer needed. That accountability cannot be handed to an outside firm, because the auditor will ask which employee made each release decision and whether that person had authority to make it.

Disposal procedure: Write and approve the procedure that covers storage, wiping or destruction, verification and release, and name the role responsible for each step.
Release decisions: Record who approves releasing each asset, the date, and the sanitization method chosen, so every decision can be traced.
Exception handling: Decide what happens when a device cannot be wiped, fails verification or is held for legal reasons, and who signs off on that exception.
Vendor oversight: If a destruction or sanitization provider is used, keep the contract, certificates of destruction and the chain-of-custody records under your control.
Training: Make sure the staff who handle returned equipment know the procedure and the approval path.

Check that every disposed asset in your sample has a named approver and a dated release record, and that the approver is not the same person who performed the wipe.

Questions buyers ask about CC6.5 disposal

How much effort does CC6.5 add for a small team?

CC6.5 adds a bounded, recurring workload rather than a large project, and the effort depends mostly on how many physical assets you hold and how they leave your control. The main drivers are the number of laptops, phones, servers and removable drives in circulation, whether devices are reissued internally or leave through a recycler, and whether you already record asset ownership and status. A team with a current asset register and a written disposal procedure spends far less time per device than one reconstructing inventory at audit time. Ask any consultant or auditor to scope the work against your actual asset count and disposal routes before agreeing a price, since no fixed figure applies across companies.

Does a cloud-only company still need to address CC6.5?

Yes, if your company owns or controls any physical assets that store data, such as employee laptops, office network gear, USB drives or backup media, CC6.5 applies to those assets even when production runs in a cloud provider. The criterion asks you to keep protections on physical assets until data and software on them can no longer be read or recovered. Your cloud provider's data center disposal is typically covered by its own SOC reports, which you should review and cite, but that does not cover your endpoints. Confirm with your auditor how they want the boundary between your assets and the subservice organization's controls documented.

Can the auditor sanitize our devices for us?

No. An independent CPA firm examines and reports on your controls, and it does not perform disposal work or issue sanitization certificates as part of the examination. The organization owns the control, so it must choose and document the sanitization method, whether that is internal wiping, degaussing, physical destruction or a certified third-party service. The auditor then samples disposal records and tests whether the steps happened as described. Ask the auditor which records they expect for each disposal, and ask any third-party destruction vendor for its own certificate of destruction to file as evidence.

How far back must disposal records go for a Type 2 report?

A Type 2 report covers an observation period, and the auditor tests whether the control operated throughout that period, so disposal records must cover the entire window. The exact length of the period is agreed with your auditor and set by your engagement, so confirm it in writing before fieldwork starts. Records from before the period generally do not prove operation during it, which is why teams that begin disposal logging only shortly before the audit often have gaps. Start logging disposals as soon as the control is designed so the population is complete from the first day.

Is an existing asset management tool enough to meet CC6.5?

An asset tool helps, but it records what you hold and where it sits, not whether data was actually removed. You will usually need the asset inventory to show each device's status through its end of life, plus a separate disposal record that names the sanitization method, the person who performed it and the date. Open-source options such as GLPI can hold the asset lifecycle and disposal status, and the Wazuh Syscollector module can show hardware and software inventory from endpoints that are still enrolled. Confirm that the tool can record disposal status and retain history, because a device that is simply deleted from the inventory leaves no evidence.

What does the disposal process require from our IT and operations staff?

Staff must follow a written procedure every time a device leaves the organization's control, and they must record the result. In practice, the work involves:

Confirming the device is no longer needed and that its data has been backed up or migrated.
Applying the approved sanitization method and recording who did it and when.
Updating the asset register and retaining the destruction or wipe evidence.

Training and clear ownership reduce errors, especially for devices returned by remote staff. Assign a named owner for the procedure and review a sample of completed records each quarter so gaps surface before the auditor finds them.

When should we bring in an outside partner for CC6.5?

Bring in a partner when you need help designing the disposal procedure, building the asset inventory, choosing tools or preparing evidence before the examination, but keep the audit itself with an independent CPA firm. A partner such as DeployOpen can plan, implement and document self-hosted tooling and prepare evidence for the assessment, under a written scope agreed before work starts. Partners do not issue reports or attestations. Consider engaging help early if you have many devices, no asset register or several disposal routes, because the cost of reconstructing records later usually exceeds the cost of building them correctly from the start.

How DeployOpen prepares CC6.5 disposal evidence

DeployOpen works on CC6.5 as part of a self-hosted platform inside the client's own infrastructure. The organization owns its disposal controls and decides how assets leave its control, while DeployOpen prepares the inventory, procedures and records an independent SOC 2 auditor will test.

How we scope

Agree in writing which asset classes, locations and disposal routes fall inside the CC6.5 scope.
Confirm which disposal events must be recorded, such as reassignment, return, repair, resale and destruction.
Identify where a cloud provider or colocation facility handles media, and which of its reports the client will rely on.

How we build

Configure GLPI Assets so every disposed device has a traceable record from retirement to final status.
Deploy Wazuh Syscollector inventory so endpoints and their software are visible until they are removed from monitoring.
Write sanitization and destruction procedures that match the client's media types, with approval steps and sign-off roles defined.

How we hand over

Deliver disposal procedures, the asset register configuration and a control description mapped to CC6.5, C1.2 and P4.3 where in scope.
Provide sample disposal tickets, inventory exports and certificate templates so the client can show the auditor how the control runs.
Document open items and the owner for each, so the organization can decide what to close before fieldwork.

How we support

Offer ongoing support and upgrades for the inventory and disposal tooling as a retainer, if the client wants it.
Help the client answer auditor questions about disposal samples, using the records the platform already holds.
Note that the auditor, not DeployOpen, tests the control and issues the report or opinion.