SOC 2 Laptop Disposal Evidence: What CC6.5 Auditors Test

Retired laptops leave quietly. Nobody writes anything down.

A laptop is replaced in a hardware refresh. It goes into a closet, then to a recycler, then to an employee who asks to keep it.

Months later an auditor picks a serial number marked "retired" in your register and asks what happened to the data on it. If the answer lives in someone's memory, you have a finding.

What does SOC 2 CC6.5 require for retired laptops?

CC6.5 says an entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished. KirkpatrickPrice's write-up of the criterion quotes two points of focus: procedures to identify data and software that need to be disposed of, and procedures to remove data and software from the entity's physical control and render it unreadable.

In practice that means a retired laptop cannot simply drop off your books. Protections such as encryption and access controls stay in force until the data is provably unrecoverable. The evidence is what proves the moment that happened.

What do auditors actually ask to see?

They start from a sample, not a policy. KirkpatrickPrice describes auditors looking for a defined disposal process, including who performs it, whether an internal IT administrator or a third party. They also look for sanitization before devices leave the organization, by wiping or physical destruction, and for assurance that devices which are sold, donated or given to employees were cleaned first.

WatchDog Security's CC6.5 page lists three evidence artifacts: media and device disposal procedures, a certificate of destruction for every decommissioned asset, and an asset inventory register that tracks retired hardware.

Note the source. These are compliance vendors describing common practice, not the AICPA. Your auditor decides what they accept, so confirm the specifics before the observation window opens.

Why does the asset inventory matter more than the certificate?

Because it is the join key. The auditor takes a serial number from the register and asks for the matching disposal record. A certificate of destruction for a drive nobody can tie back to a register entry proves little. A register entry marked "disposed" with no record behind it is worse.

Our post on what auditors check in a device inventory covers building a register that can answer this kind of sampling. For disposal, the register needs a final status for every device, and that status needs a date and a linked record.

Two failure patterns recur:

• Devices that were replaced but never marked retired, so they still appear as active and silent.
• Devices marked retired with no wipe or destruction record behind the status.

Which sanitization method fits which laptop?

The method should match the storage and the sensitivity of the data. Overwriting a spinning disk is a different operation from sanitizing a solid-state drive, and evidence should name which one was done.

The reference standard has moved. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was finalized in September 2025 and supersedes Rev. 1. NIST's page for Rev. 1 lists it as withdrawn on September 26, 2025. NIST describes sanitization as rendering access to target data on the media infeasible for a given level of effort. If your written procedure still cites Rev. 1, update the citation and ask your auditor which revision they expect.

Cryptographic erase is the method most modern laptops can use, and it depends on a precondition.

Primo's data erasure guide says its wipe uses the operating system's native cryptographic erase mechanism, which destroys hardware-backed encryption keys. On Windows that only counts when disk encryption is active. Where it is not, the same page says the wipe "performs a factory reset without cryptographic erasure." That is a vendor's description of its own product, but the logic generalizes: crypto erase is only as good as the encryption that was on the disk before.

That ties disposal directly to a control you already have to prove. If you can show disk encryption was enforced on that laptop throughout its life, a key-destroying wipe has something to destroy. If you cannot, the wipe record is carrying more weight than it can bear.

What belongs in a per-device disposal record?

Enough for a stranger to reconstruct what happened without asking you. A workable record has these fields:

• Asset ID and serial number, matching the register.
• Disposition path: recycled, destroyed, donated, sold, reassigned or returned to lessor.
• Sanitization method and the standard it cites, including the revision.
• Who performed it and when.
• Confirmation that it completed, as distinct from a command that was sent.
• Last known encryption state before sanitization.
• For third-party disposal, the certificate of destruction listing the individual serial number.
• The approver.

The distinction in the fifth bullet is the one teams miss. Primo describes retaining an audit log of wipe commands and device acknowledgments as its evidence of execution, with the command, the device's acknowledgment and a timestamp. A command with no acknowledgment is a request. Record the acknowledgment, or record that the device never checked in.

What if a third party handles disposal?

Then the certificate becomes your main artifact, and you need to read it before you file it. It should identify each device by serial number rather than by batch, name the method used, and carry a date. A certificate that says "one pallet of laptops" cannot be matched to a register entry.

You also still own the control. Handing hardware to a recycler moves the labor, not the accountability. Keep the transfer record showing which serials left your hands, on what date and with whom, so the chain from your register to the vendor's certificate is unbroken.

What about devices that are reassigned or kept by employees?

Reassignment is disposal in miniature. KirkpatrickPrice specifically calls out devices that are sold, donated or given to employees. A laptop moving from one person to another carries the previous owner's cached credentials and files, so it deserves the same sanitization record as a laptop leaving the building, followed by a fresh enrollment in your inventory.

This overlaps with the evidence we describe in laptop offboarding: the departure record and the disposal record should reference each other, so one sampled device leads to both.

How do you keep disposal evidence without a scramble?

By reading device state continuously instead of reconstructing it at the end. The sanitization record cannot be backfilled, since it exists when the wipe is confirmed or it does not. But the surrounding facts can come from a sensor that has been reporting all year: which serial numbers stopped checking in, what their last encryption reading was, and which devices are silent but still listed as active.

That last group is the useful one. A device that stopped reporting and was never marked retired is either sitting in a closet or walking out the door, and your register should not have to guess which. Where a device's state cannot be verified, the honest output is "unknown", and it goes into the record as unknown. Any remediation, including a wipe, remains a human-approved action.

To test yourself, take last quarter's retired devices and pull a record for each. Count how many have every field above. The number that do not is the finding you would otherwise meet in fieldwork.

What is the key takeaway?

• CC6.5 turns on one thing: protections end only once data is unrecoverable, and you must show when that happened.
• The asset register is the join key. Every retired serial needs a dated status and a linked record.
• Name the sanitization method and cite the current NIST revision. Rev. 1 was withdrawn on September 26, 2025.
• Crypto erase depends on encryption having been on. Prove that first.
• A sent wipe command is not a confirmed wipe. Keep the acknowledgment.
• Third-party certificates must list individual serial numbers, and reassigned or donated laptops count as disposal.
• These are vendor and practitioner descriptions, not AICPA text. Confirm with your auditor.

Find the laptops in your fleet that have gone silent: start free with up to 10 devices for 30 days, no card required.