ISO 27001 is best known as the international standard for information security management systems, and businesses often associate it with areas such as access control, network security and incident response. Less widely understood is that a properly implemented information security management system also governs the end-of-life handling of IT assets, making ISO 27001 directly relevant when evaluating both your own organisation’s practices and those of any ITAD provider you engage.

Within the ISO 27001 framework and its associated Annex A controls, asset management and secure disposal are explicitly addressed. Organisations certified to the standard are required to maintain an inventory of information assets, classify them according to sensitivity, and apply controls proportionate to that classification throughout the asset’s lifecycle — including its disposal.

For a business, this has two practical dimensions. Internally, if your own organisation holds or is working towards ISO 27001 certification, your IT asset disposal process needs to be documented, risk-assessed, and demonstrably followed as part of your management system. Externally, when selecting an ITAD provider, formal information security certification — where held — indicates that data handling during disposal is governed by an audited management system rather than informal procedure alone.

It is worth understanding that ISO 27001 is a management systems standard rather than a technical specification for how data should be erased — it does not itself dictate that a provider erase to NIST 800-88 or any particular technical standard. What matters more directly for most businesses is whether a provider can evidence the underlying practices ISO 27001 would assess: documented processes, staff access controls, physical security, and incident response, whichever specific certification framework they sit under.

For transparency: we are not ISO 27001 certified. We hold Cyber Essentials certification, operate as a registered waste carrier under our Environment Agency permit, use vetted staff and GPS-tracked vehicles, and run data sanitisation on Certus erasure software with certified technicians, aligned with NIST 800-88 principles. ISO 27001 is a standard we’re aware of and may work towards in future, but we’d rather set out honestly what we hold today than let this article imply otherwise.