SOC 2 CC6.5: data and device disposal, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC6.5, the usual records are these.

• Device wipe or destruction certificates
• An asset inventory showing retired devices
• Data deletion records for retired systems

What Polara asks about it

The free readiness assessment asks one question that bear on CC6.5. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• What is your retention period for customer data, and how is it securely disposed of at end of life? If yes, show it: retention schedule naming each data store and its period, a deletion job configuration, a completed deletion request record, or a backup expiry setting. If no, the fix: state the retention period for customer data and the secure disposal method in the data management policy, and keep a signed disposal log.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Data Management Policy covers CC6.5.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Data classification and retention policy template

If you also run ISO 27001, the Annex A controls A.7.10, storage media, A.7.14, disposing of equipment and A.8.10, deleting information ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is data Classification. The fix: define a data classification scheme with handling rules per tier. The proof: data classification document defining tiers, examples, and handling rules.

An auditor asks two things about it. Is there a documented data classification scheme? Are classification tiers defined with handling rules and examples?

Is it in your scope?

Yes, always. CC6.5 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Logical and physical access: the criteria around it

CC6.5 is one of 8 criteria in logical and physical access, CC6.1 to CC6.8. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC6.1, logical access
• CC6.2, user provisioning
• CC6.3, least privilege
• CC6.4, physical access
• CC6.5, this page
• CC6.6, network boundaries
• CC6.7, data in transit
• CC6.8, malware prevention

Before it: CC6.4, physical access. After it: CC6.6, network boundaries. All the criteria are on the Trust Services Criteria page, grouped by category.