SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC6.5: CC6.5 Protecting data on assets until disposal
SOC 2 SOC2-CC6.5 covers CC6.5 Protecting data on assets until disposal. The held text names 4 evidence records for it, the first being Media sanitisation and disposal procedure. The common gap an assessor flags is Devices disposed of without certificates of destruction.
Logical and physical protection over physical assets is withdrawn only once the data and software on them can no longer be read or recovered and are no longer needed. Points of focus: data and software on equipment due for disposal are identified and made unreadable; and, as revised in 2022, data and software are removed, deleted or made inaccessible on any device the organisation, its vendors or its staff own once they are no longer needed there or the device leaves the organisation's control. (Device recovery from leavers sits under CC6.4.)
What evidence supports SOC2-CC6.5?
- Asset disposalMedia sanitisation and disposal procedure
- Asset disposalCertificates of destruction or wipe logs for disposed devices
- Asset disposalRemote wipe or data removal records for vendor-held and staff-owned devices
- Asset disposalAsset register entries closed with the sanitisation method recorded
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC6.5, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Devices disposed of without certificates of destruction
- Company data left on personal phones after the person leaves
- Equipment sent for repair with data still readable
How it maps to ISO 27001:2022
- 7.10 medium Media disposal is covered; acquisition, transport and storage of media across life cycle is not.
- 7.14 high Protections are discontinued only once data can no longer be read or recovered from the asset.
- 8.10 high Data is rendered unreadable and unrecoverable before protections are withdrawn.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.