ASD ISM 0318 Safely disposing of unsanitised printer components
What it says
When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDestroy printer cartridges or print drums if they can't be sanitised, like other memory devices.
This control is about properly getting rid of printer parts like cartridges and drums when they're no longer usable or can't be cleaned securely. If you don't destroy these parts correctly, sensitive information could potentially be recovered by others, leading to privacy breaches and security risks.
Free. Save your status, tasks and notes.
Why it matters
If unsanitised printer cartridges or MFD drums are not destroyed, residual images/data may be recovered from disposed parts, causing a data breach.
How to implement
The office manager should be responsible for identifying old printer cartridges and drums that need disposal.
They should keep a log of these components and their removal dates to ensure they are handled promptly.
The IT team should set up a process for securely destroying unusable printer parts.
This means arranging for them to be collected by a professional disposal service that offers certificates of destruction.
Procurement staff should choose a disposal service that specialises in electronic waste, ensuring they can safely destroy components like printer cartridges and memory devices.
Always ask for certificates of destruction from the service.
Staff members involved in the disposal process should be trained on the importance of securely handling printer components.
This can involve a short training session explaining the risks and the organisation's procedures.
Managers should periodically review disposal practices to ensure they comply with security guidelines.
They can do this by checking logs of disposed items and certificates of destruction to ensure everything is accounted for.
Keep it running
Verify cartridges/drums that cannot be sanitised are handled as electrostatic memory devices and destroyed, with disposal records and periodic spot-checks.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The disposal log of printer components: Check this document for entries that include dates, parts disposed of, and responsible personnel.
Good evidence
Log will have all required details and match the certificates of destruction received.
- Check 2 of 4What an auditor asks for
Look at
Certificates of destruction: Verify these certificates are from a reputable electronic waste service, including clear details about what was destroyed and when. Good certificates are dated, signed by the disposal service, and include part descriptions.
- Check 3 of 4What an auditor asks for
Ask for
Them to explain the steps they take to ensure secure disposal.
Good evidence
Will describe a documented process, proper service selection, and regular checks.
- Check 4 of 4What an auditor asks for
Look at
Evidence that staff involved in disposal receive relevant training. Good documentation will include training dates, topics covered, and a list of attendees.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0318 requires organisations to destroy printer cartridges or MFD print drums when they cannot be sanitised, treating them as electrostatic memory devices. This relates directly to Annex A 7.10, which requires secure life-cycle management of storage media including disposal in line with classification and handling requirements. Annex A 7.10 is broader because it covers all storage media across acquisition, transport, use and disposal, whereas ISM-0318 is a specific disposal treatment for a particular media type.
This control partially meets A.7.14.
ISM-0318 requires destruction of printer cartridges or print drums when sanitisation is not possible to prevent residual data exposure. This aligns with Annex A 7.14, which requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use. Annex A 7.14 is broader in covering all equipment with storage media and allowing sanitisation/overwrite approaches, while ISM-0318 specifies destruction for these printer components when sanitisation cannot be performed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.