Skip to content
Information technology equipment
ASD ISMISM-0316

ASD ISM 0316 Formal decision on IT equipment disposal

What it says

Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Before IT equipment is publicly released, it must be sanitised and authorised after a formal decision.

When a business needs to get rid of old computers or electronic devices, it's essential to ensure all data is wiped clean and authorised for disposal. If this isn't done, sensitive information could end up in the wrong hands, leading to privacy breaches or financial loss.

Why it matters

Without a formal release decision after sanitisation/destruction, IT equipment or waste may be released publicly while still sensitive, causing data exposure and reputational harm.

How to implement

  1. The IT team should document a sanitisation process: This involves writing down a clear step-by-step method for wiping data from all devices, such as computers or smartphones.

    They can do this by using software tools that meet Australian Government standards for data destruction.

  2. Managers should review the sanitisation checklist: Before any equipment leaves the organisation, managers should ensure all devices have been through the data-wiping process by checking off each item on a checklist to avoid errors.

  3. The IT team should conduct a final approval meeting: Before releasing any equipment, hold a meeting with the authorising officer to confirm every device has been properly cleaned and documented, gaining their sign-off for disposal.

  4. Procurement staff should track disposal authorisations: Keep a log or spreadsheet of each device, including details of data cleaning and authorisation signatures, to create a clear audit trail.

  5. Arrange for secure transfer of equipment after approval: Once devices are cleared, the procurement team should organise transport to a disposal facility, using a vendor who complies with ASD security standards.

Keep it running

Record a formal administrative release decision (approver, date, asset IDs, sanitisation/destruction evidence) before IT equipment or waste is released into the public domain.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The equipment disposal records: Request documents that list each device, its sanitisation status, and authorisation for disposal.

    Look at

    The signatures and dates confirming each step.

    Good evidence

    Shows completeness with no missing entries.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Them to describe the sanitisation process used on devices before disposal.

    Look at

    Consistency with documented procedures.

    Good evidence

    Includes clear, accurate steps aligning with written policies.

  3. Check 3 of 5What an auditor asks for

    Good evidence

    Observation shows adherence to the process without shortcuts.

  4. Check 4 of 5What an auditor asks for

    Look at

    Certification or contracts ensuring secure handling of equipment.

    Good evidence

    Includes valid certifications and adherence to agreements.

  5. Check 5 of 5What an auditor asks for

    Ask for

    To see the document that details who authorised the release of equipment.

    Look at

    Clear, timely approval that matches the sanitisation records.

    Good evidence

    Contains signatures and no delays or mismatches in dates.

Mappings

Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control covers in full and more.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.7.10Secure management of storage mediaBroader than
  • A.7.14Secure disposal or re-use of equipmentPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.