ASD ISM 0313 Develop and maintain IT equipment sanitisation procedures
What it says
IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and uphold processes for properly cleaning and disposing of IT equipment.
This control is about ensuring that your organisation properly cleans and disposes of IT equipment like computers and smartphones. If you don't do this, sensitive information could be accidentally shared when old devices are discarded or sold, which could lead to data breaches and damage your business's reputation.
Free. Save your status, tasks and notes.
Why it matters
Improper sanitisation of IT equipment can lead to data leaks, exposing sensitive information when devices are discarded, compromising business integrity.
How to implement
The IT team should develop a clear policy for cleaning and disposing of IT equipment.
They can start by listing the types of devices your organisation uses and outlining the specific steps needed to wipe each one securely before it is disposed of or recycled.
Managers should ensure that staff responsible for equipment are trained in the sanitisation procedures.
This can be done by setting up training sessions or providing easy-to-follow guides on how to clean the data from devices before they leave the organisation.
Procurement staff should coordinate with the IT team when any equipment is being decommissioned.
They should follow a checklist to ensure the devices are properly wiped and that documentation of the sanitisation process is recorded.
HR should work with the IT department to revoke access from all departing employees promptly.
They must also ensure that any devices returned by employees are added to the sanitisation schedule.
Executive management should review and approve the IT equipment sanitisation policy annually.
They can do this by consulting with the IT team and ensuring that the process remains up to date with current technology and security standards.
Keep it running
Maintain documented sanitisation procedures, train staff, and verify data wiping (or destruction) is completed and recorded before disposal, resale or reuse.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The IT equipment sanitisation policy document: Check that it includes steps for cleaning data from devices before disposal.
Good evidence
Is a detailed process describing how each device type is handled and who is responsible.
- Check 2 of 4What an auditor asks for
Ask for
Them to explain the steps taken for at least one type of device.
Good evidence
Shows a clear understanding of the complete process and awareness of potential risks if not followed.
- Check 3 of 4What an auditor asks for
Look at
Evidence that employees know how to sanitise equipment. Good evidence includes training schedules, attendance records, and easy-to-understand guides.
Good evidence
Is if they follow the documented process precisely, showing that the procedure is practical and implemented.
- Check 4 of 4What an auditor asks for
Good evidence
Is a comprehensive log with dates, responsible person, and written confirmation of sanitisation completion.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.10.
ISM-0313 requires organisations to develop, implement and maintain IT equipment sanitisation processes and procedures. Annex A 7.10 overlaps because lifecycle management of storage media (including disposal) typically includes sanitisation/secure erasure steps and handling requirements that drive when and how sanitisation occurs. Annex A 7.10 is broader across the entire storage media lifecycle (acquisition, transport, handling), whereas ISM-0313 is focused specifically on sanitisation processes for IT equipment.
This control partially overlaps A.7.14.
ISM-0313 requires organisations to develop, implement and maintain IT equipment sanitisation processes and procedures. Annex A 7.14 overlaps by requiring verification that sensitive data and licensed software are removed or securely overwritten before equipment disposal or re-use, which is a core sanitisation outcome. ISM-0313 is more procedure/process-governance oriented (including maintaining sanitisation procedures), while Annex A 7.14 is more outcome/verification oriented specifically at the disposal or re-use point.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.