To be compliant with ISO27001 secure disposal controls with a magnetic HDD we could degauss it before disposal. In SSD scenario, what is the best way for secure disposal which is compliant to ISO27001 standard?
ISO 27001 does not mandate a specific way SSDs should be destroyed, it just requires that the process is consistently applied after it has been approved by the business risk owners.
That being said, depending on the size of your business and the volume of devices you might consider the following:
- Make use of a secure disposal service
- Use a SSD shredder - Costly but quick and efficient and you might be able to hire a device depending on where you are in the world
- Depending on your risk profile, consult the manufacturers of the SSD for secure software erase techniques
Physical destruction, this would mean destroying the PCBs physically. You can do this with a shredder/crusher. Burning is also an option but might be in violation of health and environment regulations (burning plastics aren't really good).
For safe data sanitization and to follow various laws like ISO 27001, the busnisses are now more concern to properly destroy their IT assets (both SSD and HDD).
Various industries experts, recommend to overwrite data with random patterns of 0's and 1's followed by physical destruction.
Even I remember, once senior expert informed me that this method was already going in various US Govt Departments.
But, yes approach differes from company to company and how well they complaince with rules and regulations.
May be its time that various agencies like ISO 27001, EU-GDPR come under one umbrella and create a global body.
It is suggested to use data erasure software like Blancco 5, BitRaser and Secure Erase which you can easily download from Google.