SMB1001 · Control 25 · Gold
That old laptop you sold is still your problem
Deleting files does not remove them, and formatting a drive usually does not either. What SMB1001 asks for when a device leaves your business, and how to actually do it.
· 6 min read
Control 25 asks that any device storing sensitive, private or confidential information is disposed of securely. It is one of the easiest controls to get wrong, because the obvious actions (delete the files, empty the recycle bin, reset the machine) do not do what people assume.
Why deleting does not delete
Deleting a file removes the pointer to it, not the data. The contents sit on the drive until that space happens to be reused, and recovery tools are cheap and effective. A quick format is much the same. On modern solid-state drives the picture is more complicated again, because the drive moves data around internally in ways the operating system cannot see or reach.
What actually works
Cryptographic erase. If the drive was already encrypted, using the full-disk encryption built into Windows or macOS, then destroying the encryption key makes the data unreadable without touching it. This is fast, effective, and the practical answer for most business devices. It only works if the drive was already encrypted before you started, which is a good reason to encrypt everything as a matter of course.
Secure erase. Modern drives support a built-in command (ATA Secure Erase, or NVMe Format with a secure setting) that instructs the drive itself to purge its contents. This reaches the areas the operating system cannot.
Physical destruction. Shredding or degaussing the drive. Appropriate where the data is sensitive enough that you would rather not rely on anything working correctly.
The record is the compliance
Whichever method you use, the control is only satisfied if you can show it happened. That means a disposal record: which device, which asset tag, what method, what date, who did it, and where the device went afterwards. Reconcile it against your asset register, which SMB1001 also asks for at Gold, so there is no device on the list that quietly vanished.
If you need a certificate. Where evidence needs to be stronger than your own log, purpose-built certified erasure software produces a tamper-evident report for each device, tied to its serial number. That is a genuine artefact and is what to ask for if a client or insurer wants proof. Built-in encryption and ordinary wipe utilities do not produce anything of the sort, whatever a supplier may imply.
The devices people forget
Phones and tablets, obviously. But also: the multifunction printer, which almost certainly has an internal drive holding images of everything it has scanned or copied; NAS boxes and external drives; and old backup media sitting in a cupboard. Leased equipment counts too, and the leasing company's word is not the same as your own record.
What an assessor will ask for
Your disposal procedure, your disposal records, and whether they reconcile with the asset register. If you cannot account for where a device went, that is the finding, not the method you chose.
Written by Steven Usher, Director of Owls Nest Solutions. Nothing here is legal advice, and none of it is a pitch. If the cheap option fits, take the cheap option.
Keep reading