Delete information stored in information systems, devices or other storage media when no longer required.
Also written as A8.10, Annex A 8.10, ISO 27001:2022 A.8.10, ISO27001 A.8.10.
Information deletion is one of 34 Technological Controls in ISO/IEC 27001:2022 Annex A. Delete information stored in information systems, devices or other storage media when no longer required. Technological controls are tested against system state, not policy text: expect the auditor to ask for configuration exports, tickets, or console screenshots showing the control is enforced in the live environment.
When preparing your Statement of Applicability (SoA) for A.8.10, gather artefacts such as:
If you run more than one framework, the same evidence usually satisfies all of them. A.8.10 aligns with:
SOC 2: CC6.5 Secure disposal, C1.2 Disposal of confidential information, P4.3 Secure disposal of personal information
NIST CSF 2.0: ID.AM-08 Asset lifecycle management, PR.DS-01 Data-at-rest protection
A.8.10 is a new control introduced in the 2022 revision with no direct 2013 equivalent. Treat it as a fresh requirement when transitioning from ISO 27001:2013.
Annex A controls are not mandatory in the abstract. Clause 6.1.3 requires you to compare your risk treatment plan against Annex A and justify, in the Statement of Applicability, any control you exclude. If your risk assessment surfaces a risk that A.8.10 addresses, excluding it needs a documented, risk-based rationale that an auditor will test.
In two passes. First design: does a documented control exist, is it owned, and does it address the risk? Then operating effectiveness: the auditor samples records from across the audit period to confirm the control actually ran. A Stage 2 audit will typically pull several samples, so evidence that only exists for the month before the audit is a common finding.
ISO 27001 sets no fixed interval — it requires review at "planned intervals" and after significant change. Annual review is the norm most certification bodies expect, with an out-of-cycle review triggered by incidents, major system changes, restructures, or new regulatory obligations. Record the review date and outcome either way; an undated control is treated as unreviewed.
A.8.10 aligns with SOC 2 CC6.5, C1.2, P4.3 and NIST CSF ID.AM-08, PR.DS-01. Evidence gathered for one framework will usually satisfy the others, which is the basis for a test-once, satisfy-many control library.
Yes. A.8.10 is one of the 11 controls introduced in the 2022 revision and has no direct ISO 27001:2013 equivalent, so a transitioning ISMS has no prior evidence to re-point and should treat it as a fresh implementation.