ASD ISM 0317 Ensuring data erasure on printer cartridges and drums
What it says
At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrint three full pages of random text to ensure no data remains on printer cartridges or drums.
Believe it or not, printers can store data in their cartridges and drums. This means if you don't clear them out before disposing or reusing, you risk leaking sensitive information. By printing a few full pages of random text, you effectively clear any data out and protect your business from leaking confidential info when the cartridge or drum moves on.
Free. Save your status, tasks and notes.
Why it matters
If cartridges or drums aren't overwritten with random pages, residual print data may be recovered during disposal or reuse, causing sensitive information disclosure.
How to implement
The office manager should ensure that all staff understand the importance of this practice.
They can do this by scheduling a brief training session to explain the procedure and why it's critical for data security.
IT staff should take responsibility for the actual printing task to clear cartridges or drums.
They should generate random text using a simple tool like a random text generator, print at least three pages, and ensure the text covers each page fully to avoid any remaining data traces.
Procurement staff should be instructed to log each disposal of cartridges and drums, confirming they have been cleared correctly.
They can do this by maintaining a checklist to sign off each time the procedure is performed before disposal or return.
The manager should establish a clear process for handling cartridges and drums after they've been used.
This includes designating a safe area for holding them until they are cleared and developing a timeline for when clearing should occur.
IT staff should regularly audit the random text generation and printing process to ensure it's followed consistently.
They can do this by setting reminders in their calendar and checking that each step is performed correctly, especially before the cartridges or drums leave the premises.
Keep it running
For each colour cartridge or MFD drum, print at least three full pages of random text with no blank areas, and record completion at replacement/maintenance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Logs or records showing the date and time when cartridges or drums are cleared.
Look at
The records for consistency and completeness, ensuring there's no gap.
Good evidence
Record will show each instance clearly annotated with the date and type of equipment processed.
- Check 2 of 5What an auditor asks for
Look at
How the text is generated and ensure it covers the entire page.
Good evidence
Demonstration will show full coverage of the page to prevent data retention.
- Check 3 of 5What an auditor asks for
Ask for
Staff members about the importance and steps taken for clearing cartridges. Listen for their understanding of the risks and procedures involved.
Good evidence
Will include specific actions taken and the rationale behind them.
- Check 4 of 5What an auditor asks for
Look at
The procedure from start to finish, including checking the printed pages. Good practice involves full page coverage and immediate documentation upon completion.
- Check 5 of 5What an auditor asks for
Look at
How cleared cartridges and drums are stored and disposed of.
Good evidence
Involves safe storage, timely clearance, and adherence to documented procedures.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0317 requires a specific sanitisation action for printer cartridges and MFD drums by printing three full pages of random text to eliminate residual stored image/data. This supports the life-cycle handling expectations in Annex A 7.10, which requires storage media to be managed through acquisition, use, transport and disposal in line with classification and handling requirements, including secure end-of-life treatment. ISM-0317 is a single procedural step for one niche medium, while Annex A 7.10 covers broader media governance and controls beyond sanitisation.
This control partially meets A.7.14.
ISM-0317 requires printing at least three full pages of random text (with no blank areas) on each colour printer cartridge or MFD print drum to purge residual image/data held on the consumable. This relates directly to Annex A 7.14, which requires verification that sensitive data has been removed or securely overwritten before equipment is disposed of or re-used, including components that can retain data. ISM-0317 is a very specific, prescriptive method for a particular device/medium, whereas Annex A 7.14 is broader and technology-neutral across equipment disposal and re-use.
This control partially meets A.8.10.
Annex A 8.10 requires deletion of information from devices and storage media when it is no longer required. ISM-0317 mandates a specific erasure approach for residual data on printer cartridges and MFD drums, which is a niche but direct subset of secure deletion. ISM-0317 is narrower and technology-specific, whereas Annex A 8.10 applies broadly to all systems and media types.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.