A.8.10 Technological
Information deletion
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (9)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- MP-6mostlyaligns with — Both controls require organizations to apply approved sanitization techniques to storage media and verify that sensitive information is irretrievably removed when it is no longer needed.
- AU-11partialaligns with — Both controls require retention of evidence—deletion logs or audit records—to demonstrate that information was disposed of in accordance with policy.
- CM-6partialaligns with — Both controls rely on automated configuration settings to enforce secure deletion according to retention schedules and classification rules.
- SA-9partialaligns with — Both controls require organizations to impose and verify deletion or sanitization obligations on external service providers that store organizational information.
- SI-18partialaligns with — Both controls emphasize the timely removal of information that is no longer required to reduce exposure risk and maintain data quality objectives.
Aligned NIST CSF 2.0 outcomes (11)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- ID.AM-08mostlyaligns with — By mandating secure deletion at end-of-life for systems, services, and media, the control operationalizes the CSF requirement to manage assets throughout their full life cycle.
- PR.DS-01mostlyaligns with — The ISO control's requirement to apply secure deletion methods to data-at-rest when it is no longer needed directly supports the CSF outcome of protecting the confidentiality, integrity, and availability of stored data.
- GV.SC-05partialaligns with — The control's explicit inclusion of deletion requirements in third-party agreements and verification of cloud-provider deletion capabilities aligns with the CSF outcome of embedding cybersecurity requirements into supplier contracts.
- PR.PS-02partialaligns with — Secure removal of obsolete software, temporary files, and versions when they are no longer required contributes to the CSF outcome of maintaining or replacing software commensurate with risk.
- PR.PS-03partialaligns with — The control's guidance on degaussing or physically destroying storage media and hardware when disposing of equipment supports the CSF outcome of removing hardware commensurate with risk.
- PR.PS-04partialaligns with — Requiring logs or evidence of deletion actions provides the records that the CSF outcome expects to be generated and made available for continuous monitoring.
Related OWASP ASVS 5.0 requirements (7)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V14.2.7mostlyaligns with — Both require that sensitive data be removed once it is no longer needed, enforcing automated or policy-driven deletion to limit exposure.
- V13.3.4partialaligns with — Requiring secrets and sensitive data to be expired and rotated according to documented schedules mirrors the ISO guidance on scheduled, policy-driven deletion of information.
- V14.2.4partialaligns with — The ISO control’s emphasis on documented retention rules and secure deletion methods directly supports the ASVS requirement to define and apply data-retention controls for sensitive information.
Related weaknesses / CWE (41)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1272mostlyprevents — Explicit information-deletion requirements directly address uncleared sensitive data on state transitions.
- CWE-200mostlyprevents — By enforcing timely, verifiable removal of sensitive data from systems and storage media, the control reduces the window during which residual information can be accessed by unauthorized actors.
- CWE-212mostlyprevents — Explicit information-deletion control directly addresses improper removal of sensitive data.
- CWE-226mostlyprevents — Explicitly requires secure deletion of information before resources are reused or disposed.
- CWE-1301partialprevents — Mandates procedures for secure information deletion that would prevent incomplete hardware data removal.
- CWE-244partialprevents — Explicitly requires secure deletion of sensitive data, directly addressing improper heap clearing.
- CWE-312partialmitigates — Secure deletion of obsolete or temporary copies prevents sensitive data from remaining in cleartext on disk after its intended lifetime.
- CWE-522partialmitigates — Requiring cryptographic erasure or physical destruction of storage that held credentials limits the chance that recoverable copies of authentication material persist beyond their required retention period.
- CWE-524partialmitigates — Information deletion ensures sensitive data is removed from caches when no longer needed.
- CWE-532partialmitigates — Mandating deletion of temporary files and logs that may contain sensitive information prevents those artifacts from remaining accessible after the data is no longer needed.
- CWE-538partialmitigates — The control’s requirement to remove or securely destroy information stored in externally accessible locations reduces the risk of sensitive data being left in files or directories that external parties can reach.
- CWE-539partialmitigates — Information deletion policies can mandate removal or encryption of sensitive cookie data.
- CWE-664partialprevents — Information deletion control ensures proper release and sanitization at end of life.
- CWE-921partialmitigates — Deletion reduces exposure but does not address the lack of access control on existing storage.
- CWE-256nonemitigates — Requires secure deletion of sensitive information, indirectly reducing exposure of stored plaintext passwords.
- CWE-313nonemitigates — Deletion policies help remove sensitive cleartext files when no longer needed.
- CWE-314nonemitigates — Deletion policy reduces exposure window but does not address the initial cleartext storage decision.
- CWE-318nonenone — Deletion controls address end-of-life disposal, not the initial insecure storage practice.
- CWE-377nonenone — Information deletion policies may cover secure removal of temporary files after use.
- CWE-459noneprevents — Explicitly requires secure deletion of temporary or residual data, directly addressing incomplete cleanup.
- CWE-526nonenone — Requires secure deletion of sensitive information, which would prevent leaving it in environment variables.
- CWE-528nonemitigates — Secure deletion of core dumps reduces residual exposure, but does not prevent the initial unauthorized access.
- CWE-672nonenone — Enforces timely deletion of resources so they cannot be used after release.
- CWE-772nonenone — Explicit information-deletion requirements directly address timely release of resources after use.
- CWE-775nonenone — Explicit deletion of information assets can include closing file descriptors, but does not mandate it at the code level.
Mitigated MITRE ATT&CK techniques (5)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1005partialmitigates — Enforcing secure deletion of sensitive data when it is no longer required reduces the volume of information an adversary can collect from local systems.
- T1025partialmitigates — Requiring secure deletion of data on removable media before disposal or reuse limits the sensitive information an adversary can obtain from such media.
- T1039partialmitigates — Mandating deletion of obsolete copies and temporary files on network shares reduces the amount of data an adversary can collect from shared drives.
- T1530partialmitigates — Requiring verified deletion of information stored in cloud services shrinks the data set an adversary can collect from cloud storage.
- T1552partialprevents — Securely deleting credentials and other sensitive files when they are no longer needed reduces the chance an adversary will find unsecured credentials in files or other locations.
Prevented OWASP Web Top 10 (2025) risks (2)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A02partialmitigates — Enforcing documented, automated deletion procedures and verifying third-party disposal reduces the chance that obsolete data or default retention settings remain accessible due to misconfigured storage or cloud services.
- A04partialmitigates — Secure deletion of cryptographic material and encrypted data prevents residual keys or ciphertext from being recovered after the retention period, thereby reducing the impact of any prior cryptographic failure.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.