Skip to content 
ISO/IEC 27001
ISO/IEC 27001 is the best-known standard for information security. Many customers demand it from their service providers – including those who collect, erase and destroy decommissioned hardware. Here you can read what the standard regulates, how a certification works and which requirements affect the decommissioning of IT.
In brief
ISO/IEC 27001 is an international standard that sets out requirements for an information security management system (ISMS). It requires risks to the confidentiality, integrity and availability of information to be assessed systematically and treated with suitable measures. In IT decommissioning, ISO/IEC 27001 mainly concerns the handling of storage media, the secure disposal or reuse of devices and the erasure of information.
What does ISO/IEC 27001 regulate?
The standard comes from ISO and IEC and is currently available in the version ISO/IEC 27001:2022. It describes how a company sets up an ISMS and operates and continually improves it. The main part contains requirements for context, leadership, planning, support, operation, evaluation and improvement. In addition there is Annex A with a catalog of 93 measures (controls) in four themes: organizational, people, physical and technological.
The standard does not prescribe any particular technology. The company decides on the basis of a risk assessment which measures it applies and justifies this in the statement of applicability. The sister standard ISO/IEC 27002 gives guidance on implementing the individual measures.
ISO 27001 and the decommissioning of IT
Several measures from Annex A directly concern the end of life of hardware:
| Measure (Annex A, 2022) | Contents | Practice in decommissioning |
|---|---|---|
| 5.9 Inventory | Inventory of information and other associated assets | Device list with serial numbers |
| 5.11 Return of assets | Return on departure or contract end | Take-back of notebooks and phones in offboarding |
| 7.10 Storage media | Handling of storage media throughout the entire life cycle | Secure collection, transport and storage |
| 7.14 Secure disposal or reuse of equipment | Check devices before disposal or reuse, remove data | Erasure or destruction before resale or recycling |
| 8.10 Deletion of information | Delete information when it is no longer needed | Documented erasure methods and proof |
| 5.19 to 5.22 Suppliers | Security in supplier relationships | Define and monitor requirements for service providers contractually |
Which questions you should ask a service provider for decommissioning is shown by the guide Choosing an ITAD provider.
How an ISO 27001 certification works
Certification may be carried out by a certification body accredited for this purpose, in Germany by the DAkkS (see Accreditation). The initial audit runs in two stages: review of the documentation, then review of the implementation. The certificate is valid for three years. In the years in between, surveillance audits take place, followed by a recertification. Whether a certificate is valid and which scope it covers is stated in the certificate itself: pay attention to the scope and the expiry date.
Distinction from related terms
The BSI IT-Grundschutz is a German procedure model with detailed modules. A certification "ISO 27001 based on IT-Grundschutz" is issued by the BSI itself. TISAX is an assessment and exchange procedure of the automotive industry that builds on ISO/IEC 27001. NIS2 is a law, not a standard: a certification can help to demonstrate the legal obligations but does not replace them.
ISO/IEC 27001 at Second IT
Second IT is certified to ISO/IEC 27001, and also to ISO 9001, ISO 14001 and ISO 45001. In addition there are access control and video surveillance, the commitment of employees to data secrecy, NDAs and procedures for VS-NfD. More on Data secrecy and confidentiality at Second IT.
Frequently asked questions about ISO/IEC 27001
What is the difference between ISO 27001 and ISO 27002?
ISO/IEC 27001 contains the certifiable requirements for an ISMS. ISO/IEC 27002 is a guideline that explains the measures from Annex A in more detail. Certification is only against ISO/IEC 27001.
How long is an ISO 27001 certificate valid?
Usually three years. A prerequisite is successful surveillance audits in the years in between. A recertification follows.
Does ISO 27001 require a particular erasure method?
No. The standard requires information to be deleted when it is no longer needed and devices to be checked before disposal or reuse. Which method is appropriate follows from the risk assessment. For implementation, many companies refer to standards such as NIST SP 800-88 or to DIN 66399 for destruction.
Is ISO 27001 mandatory for companies?
No, certification is voluntary. Many customers do demand it from their service providers, however. NIS2 is a law and not a standard. A certification can help to demonstrate legal obligations but does not replace them.
What is the statement of applicability in ISO 27001?
In it, a company records which measures from Annex A it applies and why. The basis is the risk assessment. The standard does not prescribe any particular technology; the company decides and justifies its selection.
Decommissioning with a partner certified to ISO/IEC 27001.
Send us your device list. You will receive your offer in 48 hours on average.