ASD ISM 0312 Return overseas equipment for destruction
What it says
IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSensitive IT gear overseas must be sent back to Australia for destruction if it can't be cleaned there.
This control is about ensuring that any sensitive IT equipment, which cannot be securely wiped clean while located overseas, is safely returned to Australia for destruction. This is important because if this equipment falls into the wrong hands, it could expose highly sensitive data leading to potential national security risks or serious data breaches.
Free. Save your status, tasks and notes.
Why it matters
If overseas IT equipment or media that processed AUSTEO/AGAO cannot be sanitised is not returned, data may be exposed and compromise national security.
How to implement
The IT team should identify all equipment overseas that processes AUSTEO (Australian Eyes Only) or AGAO (Australian Government Access Only) data.
Make a list and regularly update it to include details like the type of equipment and location.
Once identified, the IT manager should assess whether the equipment can be securely wiped overseas.
If not, arrange for the equipment to be securely shipped back to Australia for destruction.
The procurement officer should liaise with a secure logistics provider to ensure the safe transportation of the equipment.
Confirm the provider's credentials and protocols for handling sensitive equipment.
The security manager should oversee the destruction process once the equipment is in Australia.
Use certified e-waste destruction services that provide a certificate of destruction.
Document the entire process for each piece of equipment: starting from identification, shipping, reception in Australia, and final destruction.
Ensure records are complete and stored securely for future reference or audit.
Keep it running
Use a documented chain of custody and approved secure courier processes to return overseas AUSTEO/AGAO equipment/media to Australia for destruction when it cannot be sanitised in situ.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The overseas equipment inventory: Request to see a list of all IT equipment held overseas that processes sensitive data.
Look at
A clear description of the equipment and its storage status.
Good evidence
Will include detailed records of equipment type, data processed, and location.
- Check 2 of 5What an auditor asks for
Look at
The shipping logs and destruction records: Verify the existence of transport documentation and destruction certificates for equipment returned and destroyed.
Good evidence
Will show dated shipping receipts and destruction certificates from a certified provider.
- Check 3 of 5What an auditor asks for
Ask for
How they identify equipment needing to be returned and how they coordinate this.
Good evidence
Is the manager can clearly explain the criteria for return and the process followed.
- Check 4 of 5What an auditor asks for
Good evidence
Will have detailed logs with dates, actions, and responsible persons' signatures.
- Check 5 of 5What an auditor asks for
Look at
The formal procedures and guidelines used by the organisation.
Good evidence
Will be a comprehensive procedure outline that aligns with best practices.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0312 mandates a specific handling outcome for overseas storage-bearing equipment that handled AUSTEO or AGAO data and cannot be sanitised in situ: return it to Australia for destruction. Annex A 7.10 requires lifecycle management of storage media, including transportation and disposal, aligned to classification and handling requirements. ISM-0312 fits as a specific, high-assurance transportation/disposal rule within the broader storage media lifecycle controls in Annex A 7.10.
This control partially meets A.7.14.
ISM-0312 requires that overseas IT equipment (including associated media) that has processed, stored or communicated AUSTEO or AGAO data and cannot be sanitised in situ is returned to Australia for destruction. Annex A 7.14 addresses secure disposal or re-use by requiring verification that sensitive data and licensed software are removed or securely overwritten prior to disposal or re-use. ISM-0312 is a specific procedural/geographical treatment for a high-sensitivity scenario, whereas Annex A 7.14 is a broader general requirement for disposal or re-use regardless of location.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.