ASD ISM 0323 Classifying media by data sensitivity
What it says
Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia should be classified by the highest level of data sensitivity it contains.
This control is about making sure that any media, like USB drives or DVDs, are labelled according to the most sensitive information they hold. If this doesn't happen, sensitive data could be accidentally exposed if the media is lost or stolen, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If media is not classified to the highest data sensitivity it stores, it may be handled too loosely, increasing the risk of disclosure if lost, stolen or accessed.
How to implement
IT staff should review all media regularly to check for any sensitive information stored on them.
Conduct this review by scanning the contents of the media and comparing it to your organisation's data sensitivity classifications.
The data owner should determine the classification level for the data stored on each media device.
This involves identifying the highest sensitivity of the information and labelling the media accordingly with clear stickers or tags.
Managers should train staff to understand the importance of data classification.
This training involves workshops or e-learning modules that explain how to handle different types of data based on sensitivity levels.
The IT department should implement a tracking system for all media used within the organisation.
This means listing each item in a log that tracks the media's classification, assigned user, and movement.
Security personnel should conduct regular audits to ensure compliance with this classification control.
These audits involve checking random samples of media to confirm they have the correct classifications applied.
Keep it running
Classify each device, tape or drive to the highest sensitivity of any data stored, and update the label when contents change. Verify labels during audits and disposal.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media classification register: Request a document that records all media items and their assigned classifications.
Look at
Completeness and accuracy in matching the highest data sensitivity.
Good evidence
Is an up-to-date register that accurately reflects all items in use.
- Check 2 of 5What an auditor asks for
Look at
Staff training records on data sensitivity: Check that employees have completed relevant training.
Good evidence
Includes completion certificates or records in a training log.
- Check 3 of 5What an auditor asks for
Ask for
To see physical examples of classified media: Request to inspect a sample of media to verify if they are correctly labelled.
Look at
Visible classification labels and check if they match the data contents.
Good evidence
Is correctly labelled media items according to sensitivity.
- Check 4 of 5What an auditor asks for
Ask for
Them how they ensure media is properly classified and tracked.
Good evidence
Includes a clear explanation of procedures, checks, and regular updates to the media register.
- Check 5 of 5What an auditor asks for
Look at
Identified issues and implemented improvements.
Good evidence
Shows that any past issues were addressed and improvements are in place.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.12.
ISM-0323 requires media to be classified to the highest sensitivity or classification of any data it stores. ISO/IEC 27001:2022 Annex A 5.12 establishes the requirement for an organisation-wide information classification policy. ISM-0323 is a specific rule within that broader scheme, focusing on classifying storage media when multiple data sensitivities exist.
This control partially meets A.7.10.
ISM-0323 requires media to be classified to the highest sensitivity/classification of the data it stores. ISO/IEC 27001:2022 Annex A 7.10 mandates that storage media be managed according to the organisation's classification scheme throughout its lifecycle. ISM-0323 informs the classification value that drives the handling requirements in Annex A 7.10, which covers broader lifecycle management beyond classification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.