ASD ISM 0307 Sanitise equipment when not using cleared technician
What it says
If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the IT equipment and associated media are sanitised before maintenance or repairs.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSanitise IT equipment if repairs are made by non-cleared technicians.
When fixing or maintaining IT equipment, it's essential to make sure that any sensitive data is wiped clean if the work is done by someone who isn't officially approved for secure tasks. This prevents data from being exposed to unauthorised individuals, protecting your organisation from potential breaches.
Free. Save your status, tasks and notes.
Why it matters
Failing to sanitise equipment exposes sensitive data to unauthorised access, leading to potential data breaches and reputational damage.
How to implement
IT Managers should ensure that a checklist is in place for data sanitisation before any repairs.
Do this by creating a template that lists all devices, types of data, and steps for erasing it securely.
Office Managers need to keep a record of which devices have undergone repairs by non-approved personnel.
Track this in a simple logbook or spreadsheet noting the date, device, and technician.
Procurement officers should verify that repair contracts include requirements for data sanitisation when non-cleared technicians are involved.
Ensure these clauses are visible and acknowledged in contracts.
IT Support staff must use data wiping software before handing devices to non-cleared technicians.
Select software that fully erases data, not just deletes it, and verify each wipe with a validation report.
Team leaders should regularly review and update sanitisation procedures.
Schedule monthly meetings to assess if the process is current with best practices and adjust as needed.
Keep it running
Consistently monitor and update data sanitisation processes to align with evolving security threats and best practices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the data sanitisation policy: Check for a document that describes procedures when non-cleared technicians are used.
Look at
whether it includes all steps and responsible parties.
Good evidence
is a detailed, clearly updated policy.
- Check 2 of 5What an auditor asks for
Look at
dates, device identifiers, and technician details.
Good evidence
complete entries with no gaps in dates.
- Check 3 of 5What an auditor asks for
Ask for
proof of data wiping tool usage: Request reports or screenshots from the software used for wiping data.
Look at
confirmations that data was erased successfully.
Good evidence
includes timestamped reports.
- Check 4 of 5What an auditor asks for
Look at
distinct terms for sanitisation compliance.
Good evidence
shows explicit clauses signed by vendors.
- Check 5 of 5What an auditor asks for
Ask for
to see regular review records for sanitisation processes: Review minutes from meetings discussing improvements to the sanitisation procedure.
Look at
recent updates and decisions.
Good evidence
provides actionable outcomes from each meeting.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 5 mappings
This control partially meets A.7.10.
ISM-0307 requires sanitising IT equipment and associated media before maintenance or repairs when work is performed by a technician who is not appropriately cleared. Annex A 7.10 covers managing storage media across its entire life cycle, including handling, transport, and disposal, which encompasses sanitisation processes where required. ISM-0307 is a specific scenario-based requirement.
This control partially overlaps A.5.19.
ISM-0307 requires sanitising equipment and media before maintenance when an appropriately cleared technician is not used. Annex A 5.19 establishes processes to manage information security risks in supplier relationships, providing the governance mechanism to require and verify sanitisation arrangements for suppliers or their staff. The implementation of ISM-0307 often relies on such governance.
This control partially overlaps A.7.13.
Annex A 7.13 requires equipment to be maintained correctly to preserve the availability, integrity and confidentiality of information. ISM-0307 relates by requiring sanitisation of IT equipment and associated media before maintenance or repair when an appropriately cleared technician is not used, protecting confidentiality during maintenance. ISM-0307 is narrower and focuses on pre-maintenance sanitisation under specific personnel conditions, whereas Annex A 7.13 includes ongoing preventive and corrective maintenance more broadly.
This control partially overlaps A.7.14.
ISM-0307 requires sanitising IT equipment and any associated media before maintenance or repair when the technician is not appropriately cleared. This overlaps with Annex A 7.14, which requires verifying that sensitive data is removed or securely overwritten before equipment is disposed of or reused. However, ISM-0307 is triggered by third-party/uncleared maintenance access, while Annex A 7.14 is about end-of-life or reallocation.
This control partially overlaps A.8.10.
Annex A 8.10 mandates deletion of unnecessary information. ISM-0307 requires data sanitisation before third-party maintenance, preventing unintended disclosure, aligning with secure deletion practices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.