What it asks for. Before equipment containing storage media is disposed of or re-used, verify that sensitive data and licensed software have been removed or securely overwritten.
In practice. All equipment is checked for storage media, including printers, phones and network devices. Data is removed using methods suitable for the media and its sensitivity, such as cryptographic erasure, overwriting or physical destruction, and the result is verified. Disposal through third parties is covered by contract and certificates of destruction tied to asset identifiers. Damaged devices are assessed before being sent for repair or discarded. Auditors expect a disposal procedure, records linking assets to sanitisation method and certificates.
Common gaps. Multifunction printers, mobile phones and network appliances are often forgotten as data carriers. Destruction certificates frequently cover a batch rather than individual assets, making it impossible to prove that a specific device was wiped.