ASD ISM 0311 Ensuring sanitisation of IT equipment media
What it says
IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove or clean media from IT equipment to ensure data is not left on the device.
This control ensures that any data on IT equipment is either removed or properly cleaned before the equipment leaves your control or is repurposed. This matters because leftover data can fall into the wrong hands, resulting in privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Residual data on unsanitised media can be recovered, enabling unauthorised access and disclosure of sensitive information, with potential financial loss.
How to implement
Manager: Develop a clear policy for sanitising IT equipment before disposal or repurposing.
This can include steps such as identifying devices that require sanitisation and specifying the methods to be used.
IT Team: Physically remove storage media, like hard drives or USB drives, from equipment before sending it for disposal.
Ensure these components are either securely destroyed or wiped using approved software.
Office Manager: Keep an inventory of IT equipment that requires sanitisation, tracking its movement and status from active use to disposal.
Use a simple spreadsheet to log dates and responsible personnel.
HR and IT Team: Educate staff on the importance of data sanitisation.
Conduct short training sessions explaining why data needs to be removed and how mishandling can lead to data breaches.
Procurement: When purchasing new IT equipment, ensure that proper procedures for eventual sanitisation and disposal are included in the vendor agreements to avoid data breaches in case of returns or end-of-life management.
Keep it running
Verify media sanitisation or removal for each device, and record the method, date and approver to support audit and disposal assurance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the equipment sanitisation policy: Ensure it outlines the procedures for both physical removal and digital sanitisation of media.
Look at
Comprehensive steps addressing different equipment types.
Good evidence
Policy is specific, dated, and includes staff responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
Them to explain the steps they take to remove or wipe data from devices.
Good evidence
Includes a clear, repeatable process for different types of devices.
- Check 3 of 5What an auditor asks for
Look at
Fields detailing device types, sanitisation method used, and date completed.
Good evidence
Will show consistent and completed entries across all fields.
- Check 4 of 5What an auditor asks for
Good evidence
Outcome is a rigorous adherence to the sanitisation steps documented in the policy.
- Check 5 of 5What an auditor asks for
Good evidence
Contract will specify vendor responsibilities for data protection during equipment handling and disposal.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control is equivalent to A.7.14.
ISM-0311 requires IT equipment containing media to be sanitised, either by removing the media or sanitising it in situ, to ensure residual data is not left on the device. This directly aligns with ISO/IEC 27001:2022 Annex A 7.14, which requires verification that sensitive data (and licensed software) is removed or securely overwritten before equipment disposal or re-use. Annex A 7.14 is framed around disposal/re-use decision points, while ISM-0311 is focused on the sanitisation action for equipment containing media regardless of the specific end state.
This control partially overlaps A.7.10.
Annex A 7.10 requires storage media to be managed securely across its lifecycle, including secure disposal consistent with classification and handling requirements. ISM-0311 overlaps by mandating sanitisation of IT equipment containing media, either by removing the media or sanitising in situ, which is a core disposal/reuse safeguard. ISM-0311 is focused on sanitisation at disposal or reallocation, whereas Annex A 7.10 additionally includes acquisition, transportation, and ongoing handling controls.
This control partially overlaps A.8.10.
Annex A 8.10 requires deletion of information when not needed to reduce risk, while ISM-0311 mandates media sanitisation either by removal or in-situ, aligning with secure deletion for repurposing or disposal.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.