SOC 2 CC6.5: Discontinuing Protections Over Disposed Assets

SOC 2 CC6.5 requires that data and software are rendered unrecoverable before an asset loses its protections or leaves the company's control. It sits in the CC6 series (Logical and Physical Access Controls), and a frequent finding under it is a company that sanitizes or destroys media in practice but keeps no record proving it happened.

What does SOC 2 CC6.5 require?

In plain terms, CC6.5 governs the last stage of an asset's life. Before a laptop is retired, a disk is returned to a leasing company, a server is decommissioned, or a cloud volume is deleted, the data and software on it have to be put beyond recovery. The criterion draws a line in time: protections such as encryption, access control, and physical custody can only be dropped once the data they were protecting can no longer be read.

The scope of SOC 2 CC6.5 is any asset that held protected data or software. That includes end-user devices, portable media, backup tapes, on-prem disks, and the storage behind a cloud service. The criterion is technology-neutral, so the same expectation applies whether the asset is a physical drive going into a shredder or a block-storage volume being released back to the provider's pool.

CC6.5 is short. It carries a single point of focus, which makes it one of the narrower CC6 criteria, but the evidence expectation is specific: the company has to show that disposal follows a defined method and that each disposal event was recorded.

What are the CC6.5 points of focus?

The AICPA defines 1 point of focus for CC6.5. Because the Trust Services Criteria are AICPA copyrighted material, the point of focus below is paraphrased rather than reproduced verbatim; consult the official TSC document for exact wording.

• Removes data and software before disposal. Procedures render data and software inaccessible from any asset the company, its vendors, or its employees hold, once that data is no longer needed on the asset or the asset is about to leave the company's control. This covers deletion, cryptographic erasure, and physical destruction, chosen to match the asset and the sensitivity of what it held.

How do you meet CC6.5 in cloud environments?

Cloud environments satisfy CC6.5 mostly through provider mechanisms and cryptographic controls, because the company rarely touches physical media. The building blocks are:

• Cryptographic erasure through key destruction. When storage is encrypted with keys the company manages in a KMS, deleting the key makes the ciphertext unrecoverable without physically wiping the disk. This is the standard disposal method for encrypted cloud volumes and managed databases.
• Provider media sanitization for hardware. The retirement and destruction of the physical disks behind a cloud service is the provider's responsibility, covered in the provider's SOC 2 report and inherited as a subservice control. The company documents the reliance the same way it does for physical access under CC6.4.
• Deletion of data no longer required. Retention rules trigger deletion of customer and internal data once its purpose ends, whether through lifecycle policies on object storage or scheduled purges in the application. Customer-initiated deletion on offboarding is part of the same control.
• Sanitizing non-production copies. Snapshots, backups, and data copied into lower environments are deleted or scrubbed on a schedule, so protected data does not linger in forgotten places after it is no longer needed.

Cloud disposal is easy to operate and easy to leave undocumented. The mechanism runs, but nobody captures the before-and-after that an auditor can sample.

How do you meet CC6.5 on-prem?

On-prem environments carry the full physical side of disposal, because the company owns the hardware end to end. The data protection on-prem guide covers the detail; the shape is:

• A media sanitization standard. A written standard defines the method by disk type and data sensitivity, aligned to a recognized reference such as NIST SP 800-88: cryptographic erase or multi-pass overwrite for reusable media, physical destruction for media that cannot be reliably wiped.
• Certificates of destruction. When drives are shredded or degaussed, whether in-house or by a disposal vendor, a certificate records the serial numbers, the method, the date, and who performed it.
• Chain of custody for retired hardware. Decommissioned assets are tracked from removal to destruction, so a drive cannot go missing between the rack and the shredder.
• Asset inventory reconciliation. The asset register is updated on disposal, closing the loop so a retired asset is not still listed as active.

Cloud vs on-prem at a glance

What evidence do auditors expect for CC6.5?

How does CC6.5 map to ISO 27001:2022?

Organizations pursuing both frameworks can reuse CC6.5 evidence directly for these Annex A controls, since both frameworks ask for the same disposal method and the same proof. The SOC 2 to ISO 27001 control mapping covers the full crosswalk across all five Trust Services Categories.

Related criteria

CC6.5 closes the asset lifecycle that the rest of the CC6 series opens. CC6.4 governs physical access to assets while they are in use, and CC6.5 picks up at the end, once an asset is retired or leaves the company. CC6.7 sits alongside it, covering how information is protected while it moves and how removable media is handled before disposal. The logical protections that CC6.5 eventually discontinues are the ones established under CC6.1. The next criterion in the series, CC6.6, turns from assets to the system boundary.

Frequently Asked Questions

What does SOC 2 CC6.5 mean?

SOC 2 CC6.5 requires that data and software are rendered unrecoverable before an asset loses its protections or leaves the company's control. In practice it means a laptop, disk, backup tape, or cloud volume has to be wiped, cryptographically erased, or physically destroyed before it is reused, returned, or thrown away, and the disposal has to be recorded.

What evidence satisfies CC6.5?

The core evidence is a data retention and disposal policy, a media sanitization standard, and a record for each disposal event: certificates of destruction for physical media, deletion-job or key-deletion logs for cloud data, chain-of-custody records for retired hardware, and asset-register updates showing the asset was removed.

How do you dispose of data in the cloud for CC6.5?

The common method is cryptographic erasure: when storage is encrypted with company-managed keys, destroying the key makes the data unrecoverable without touching the physical disk. Retention policies and lifecycle rules delete data once its purpose ends, and the destruction of the underlying hardware is inherited from the cloud provider as a subservice control.

Does CC6.5 require physical destruction of drives?

Not always. CC6.5 requires that the ability to recover data is removed, and the method is chosen to fit the asset. Reusable media can be cryptographically erased or overwritten to a recognized standard such as NIST SP 800-88; physical destruction is reserved for media that cannot be reliably wiped or that held highly sensitive data.

How is CC6.5 different from CC6.7?

CC6.7 covers protecting information while it is transmitted, moved, or carried on removable media during normal operation. CC6.5 covers the end of the line: making data unrecoverable once the asset holding it is disposed of or leaves the company. Removable media sits in both, protected under CC6.7 in use and sanitized under CC6.5 at disposal.