ASD ISM 0315 Ensure destruction of high assurance IT equipment
What it says
High assurance IT equipment is destroyed prior to its disposal.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishHigh assurance IT equipment must be destroyed before disposal to prevent data leaks.
This control means that before you throw away or recycle high-security IT equipment, you must destroy it to make sure no one can get any sensitive information from it. This matters because if old computers or storage devices are not properly destroyed, someone could retrieve confidential data which could lead to identity theft, financial loss, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If high assurance IT equipment is disposed of without destruction, stored sensitive data may be recovered, causing a security breach and reputational harm.
How to implement
The IT manager should identify all high assurance equipment in the organisation.
This involves creating a list of devices such as computers or storage media that store sensitive information, ensuring no device is overlooked.
The procurement team needs to arrange for appropriate destruction services.
They can do this by contacting certified data destruction companies that adhere to security standards and ensuring they provide certificates of destruction.
The office manager should ensure a secure collection process for devices marked for destruction.
They can set up a locked bin or room where outdated devices are stored before collection.
The IT team should be responsible for removing data from devices before destruction.
This can involve running data-wiping software to make data retrieval impossible and noting the process in their records.
HR should train staff on the importance of high assurance device destruction.
They can organise regular awareness sessions to explain why this process is critical and how staff can help identify devices that need to be destroyed.
Keep it running
Verify and document destruction of high assurance devices before disposal; use approved destruction methods and periodically audit disposal records.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment inventory list: Request the latest document listing all high assurance equipment scheduled for destruction.
Look at
Completeness and accuracy in the description of each device.
Good evidence
Is a list updated regularly with all items accounted for.
- Check 2 of 5What an auditor asks for
Look at
Dates, serial numbers, and signatures.
Good evidence
Shows matching details with the internal inventory records.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the steps taken to ensure data is irretrievable before device disposal.
Look at
Their understanding of the process and any software used.
Good evidence
Includes a clear, step-by-step procedure they follow.
- Check 4 of 5What an auditor asks for
Good evidence
Is a locked and monitored area with a logbook of access.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of training sessions conducted about the importance of device destruction.
Look at
Attendance records and session materials.
Good evidence
Is documentation showing regular training sessions with most staff attending.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.10.
ISM-0315 requires physical destruction of high assurance IT equipment before disposal to prevent residual data exposure. Annex A 7.10 requires storage media to be managed across its lifecycle, including disposal, in line with classification and handling requirements. The overlap is specifically in the disposal stage for media/equipment that could contain sensitive data, but Annex A 7.10 is broader lifecycle governance while ISM-0315 mandates a particular disposal outcome (destruction) for a defined class of equipment.
This control partially overlaps A.7.14.
ISM-0315 requires that high assurance IT equipment is destroyed prior to disposal to prevent any data leakage. Annex A 7.14 requires verification that sensitive data and licensed software have been removed or securely overwritten before equipment disposal or re-use. They align on secure end-of-life handling to prevent information compromise, but ISM-0315 is stricter and specific to high assurance equipment destruction, whereas Annex A 7.14 allows secure sanitisation and also covers re-use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.