CON.6 Deleting and Destroying Data and Devices

An organisation MUST regulate the deletion and destruction of information. In doing so, the Process Owners for each specialised procedure or business process MUST specify which information must be deleted and disposed of under which conditions.

They MUST consider legal provisions that:

• define the minimum retention periods
• guarantee the maximum retention periods and the right to the secure deletion of personal data

If personal data is involved, the regulations for deleting and destroying personal data MUST be coordinated with the Data Protection Officer.

The deletion and destruction of information MUST be regulated for specialised procedures, business processes, and IT systems before they are used productively.

Sensitive information and storage media MUST be securely deleted or destroyed prior to disposal. The process for this MUST be clearly regulated. Individual employees MUST be informed of the tasks they need to perform for secure deletion and destruction. The process for deleting and destroying storage media MUST also take account of backups when necessary.

The location of destruction facilities on an organisation's premises MUST be clearly regulated. In this regard, it MUST be considered that information and resources may be collected first and only deleted or destroyed later. A central collection point of this kind MUST be protected against unauthorised access.

If external service providers are commissioned, the process for deletion and destruction MUST be sufficiently secure and transparent. The procedures used by an external service provider for secure deletion and destruction MUST at least meet the corresponding organisation’s internal requirements for deletion and destruction procedures.

Those commissioned with deletion and destruction SHOULD be regularly audited to ensure that their operations are still proceeding correctly.

An organisation MUST implement the following minimum procedures for deleting and destroying sensitive storage media. These procedures SHOULD be reviewed and adapted as necessary, depending on the protection needs of the data being processed.

• Rewritable digital media that are not encrypted during use MUST be completely overwritten with a data stream of random values (e.g. a PRNG stream).
• If encrypted digital media are used, they MUST be erased through secure deletion of the corresponding key in compliance with the respective crypto concept.
• Optical storage media MUST be destroyed in accordance with security level O-3 (at minimum) as defined in ISO/IEC 21964-2.
• Smartphones and other smart devices SHOULD be encrypted in line with the crypto concept in question. Smartphones and other smart devices MUST be reset to factory settings. The setup process SHOULD then be carried out to complete the deletion.
• IoT devices MUST be reset to factory settings. All the credentials stored in such devices MUST then be changed.
• Paper MUST be destroyed in accordance with security level P-3 (at minimum) as defined in ISO/IEC 21964-2.
• Storage media integrated in other devices MUST be securely erased via the devices' integrated functions. If this is not possible, the mass storage components MUST be removed and either securely erased like conventional digital media from a separate IT system, or destroyed in accordance with security level E-3 or H-3 (at minimum) as specified in ISO/IEC 21964-2.

An organisation SHOULD verify that the minimum requirements for deletion and destruction procedures (see CON.6.A12 Minimum Requirements for Deletion and Destruction Procedures) are sufficiently secure for the media and information actually used. Based on its findings, the organisation SHOULD determine appropriate procedures for deletion and destruction of each storage media.

For all the types of storage media the organisation uses and deletes or destroys itself, there SHOULD be suitable devices and tools with which the responsible employees can delete or destroy stored information. The selected procedures SHOULD be known to all the employees responsible.

The organisation SHOULD regularly check that the selected methods still correspond to the state of the art and are sufficiently secure for its purposes.

An organisation SHOULD document its regulations regarding deletion and destruction in a policy. The policy SHOULD be known to all the relevant employees of the organisation and represent the basis for their actions and work. In terms of its content, the policy SHOULD include all employed storage media, applications, IT systems, and other resources and information that are subject to deletion and destruction. Employee compliance with the policy SHOULD be checked regularly and at random. The policy SHOULD be updated at regular intervals.

If, due to a defect, digital storage media containing sensitive information cannot be securely deleted in accordance with the applicable procedures for deleting storage media, they SHOULD be destroyed in accordance with security level 3 (at minimum) of ISO/IEC 21964-2.

In the event that defective storage media are replaced or repaired instead, it SHOULD be contractually agreed with the service provider contracted for this purpose that these media will be securely deleted or destroyed by the service provider. The service provider's procedures SHOULD at least meet the organisation's internal requirements for deletion and destruction procedures.

The organisation SHOULD determine the required security level for the destruction of data media in accordance with ISO/IEC 21964-1, based on the protection needs of the data media to be destroyed. The media SHOULD be destroyed in accordance with the assigned security level outlined in ISO/IEC 21964-2.