BS EN 15713

Secure Destruction of Confidential Material

Secure Destruction of Confidential Material

From paper documents to ID cards, hard drives and counterfeit products, this standard outlines the procedures and controls necessary to ensure destruction of confidential and sensitive material. This standard covers various aspects of the process, including collection, storage, transportation, destruction methods, and certification.

Background

The original BS EN 15713:2009 standard provided a structured code of practice for companies to work to for the secure destruction of confidential information for their customers. Security of information and ultimate customer satisfaction were the key drivers through procedures being adopted correctly. The new 2023 version of this standard sets significantly enhanced requirements over the original 2009 version. Anyone wishing to attain certification to this new 2023 version will need to work through these new requirements before certification to the new version can be achieved.

What is BS EN 15713 about?

From paper documents to ID cards, hard drives and counterfeit products, this standard outlines the procedures and controls necessary to ensure destruction of confidential and sensitive material. This standard covers various aspects of the process, including collection, storage, transportation, destruction methods, and certification.

Implementation

Sections 4 through 21 now contain many “shall” auditable requirements. All have to be in place to avoid potential nonconformities being issued in external audits. This information document is only meant to guide you to sectional requirements and it is for each individual business to complete their own Gap Analysis of their own business procedures to ensure they meet compliance to the standard.

What organisations would benefit from certification to BS EN 15713?

Information destruction service providers
Data controllers of large organisations, businesses, and public sector organisations
Security or information security officers
Trade or industry associations

The structure of the new version of the standard:

Section 4 – establishing and determining the protection class required by clients and that you are able to offer as a service provider
Section 5 – determination of security level
Section 6 – increasing the security level
Section 7 – destruction equipment
Section 8 – company destruction premises and service provider holding sites
Section 9 – control of access to secure areas
Section 10 – contract requirements
Section 11 – record of process of collection through to destruction
Section 12 – subcontracting
Section 13 – company personnel
Section 14 – collection and transport of confidential and sensitive material – requirements
Section 15 – storage and retention of confidential and sensitive material at destruction facility
Section 16 – business continuity planning and responding to security incidents
Section 17 – retention of records
Section 18 – categories of confidential and sensitive material
Section 19 – end produce waste disposal
Section 20 – supply chain – review
Section 21 – information security

BS EN 15713 covers:

On site destruction using mobile equipment brought in
Offsite destruction using equipment at a destruction facility
Co-location of confidential or sensitive material in same place as destruction equipment.

NOTE: BS EN 15713:2023 does not cover destruction by erasure (e.g. crypto erasure, data overwriting, degaussing or other forms of magnetic/electronic erasure).

Why should you use BS EN 15713:2023?

Risk mitigation: it helps you safeguard sensitive information and prevent unauthorized access. It can reduce the risk of data breaches, identity theft and information leakage.

Clarity: BS EN 15713 makes clear the requirements for offering a professional destruction service, and helps their customers understand the procedures and the choices available to them when selecting levels of destruction.

Reassurance: users can be assured that any object or data carrier is destroyed in such a way that reproduction of information is either impossible or only possible with considerable expenditure in terms of personnel, resources and time. For added reassurance, destruction outcome tables are detailed in the standard.

Current and futureproof: BS EN 15713 provides a modern benchmark for the latest available appropriate procedures and processes for organizations that want to safely destroy materials.

Alignment: it now harmonizes with the requirements of regulation such as GDPR, standards such as ISO/IEC 27001, and data controllers’ expectations regarding process and risk management in relation to information security, making organizational information security more seamless and robust.

Expertise: the information in BS EN 15713 can help users to develop expertise in information destruction, improve operational efficiency and accelerate the adoption of innovation.

Reputation: using BS EN 15713 demonstrates a commitment to maintaining the confidentiality and privacy of stakeholders’ information that can enhance trust and reputation and smooth new market entry.

What’s new about BS EN 15713:2023?

The importance of confidential data and sensitive material, its potential value, and maintaining security of content when items have reached end of useful life have all changed massively since 2009. Hence this major revision of BS EN 15713:2009.

At double the length of its predecessor, BS EN 15713:2023:

Consolidates the current requirements of data protection and brand integrity with the practices of information destruction service providers throughout Europe
Aligns better with the requirements of regulation such as GDPR, other international standards such as ISO/IEC 27001, and data controllers’ expectations with regard to process and risk management in relation to information security.

What costs are involved?

You need to first purchase a copy of the standard (QSS are an authorised BSI standards distributor and can save you money on the cost of the standard if ordered through QSS) and then budget costs for implementing the standard within your business prior to initial assessment. You may wish to do this yourselves or you may engage an appropriately qualified and experienced independent consultant who can quote to assist you through the preparation process.

When a business engages QSS (Quality Service Standards Ltd) to carry out its assessment and certification processes, an “Initial Assessment” will be carried out by QSS to audit the company’s compliance against the entire standard. Following this (and subject to the clearance of any nonconformities) a certificate will be issued, usually valid for 12 months. Annual surveillance assessments are then carried out, each covering certain elements of the standard and normally leading to renewal of certification for a further 12 months (subject to any nonconformities).

Costs for this can be obtained by contacting David Woodhouse, QSS General Manager at:

Quality Service Standards Ltd.,
Unit 3, The Progression Centre, Mark Road,
Hemel Hempstead, HP2 7DW

T: +44 (0)1923 699840
E: admin@qssonline.co.uk