ASD ISM 0325 Reclassify media to higher sensitivity
What it says
Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia connected to more sensitive systems is upgraded to match the highest security level.
This control is about ensuring that any storage media, like USB drives or external hard drives, matches the security level of the most sensitive system it connects to. This matters because if you fail to update the security level, sensitive information could be accessed by someone who shouldn't have it, potentially leading to data breaches or reputational damage.
Free. Save your status, tasks and notes.
Why it matters
If media isn't reclassified after connection to a higher-sensitivity system, it may be handled at too low a level, exposing data.
How to implement
System owners should ensure that any media connected to their systems are assessed for sensitivity.
They should set up a checklist to verify the classification level of each piece of media and compare it to the system it's connected to.
IT teams should configure systems to automatically log connections with media to track and audit their classification levels.
Use system settings or software tools that can record and alert responsible staff when media connects to a sensitive system.
Managers should train staff on recognising the sensitivity levels and handling media accordingly.
Organise regular training sessions and convey the risks of mishandling sensitive media, like data breaches and third-party access.
Procurement staff should engage vendors to verify the options for making media read-only where appropriate.
This involves checking with suppliers if the media can be set to 'read-only' mode either physically or via software.
HR should establish a policy that details the process for media classification and reclassification.
This policy should be regularly updated and easily accessible to all staff to ensure compliance and understanding.
Keep it running
Reclassify any connected media to the system's highest sensitivity, unless it is read-only or read-only access is technically enforced.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
Records of media classification: Request a log or spreadsheet showing the security classification of media that connects to each system.
Look at
Entries that detail the initial classification and any changes.
Good evidence
Shows that each entry is reviewed and updated in a timely manner.
- Check 2 of 4What an auditor asks for
Good evidence
Includes consistent use of logs and procedures to identify and reclassify media promptly when needed.
- Check 3 of 4What an auditor asks for
Good evidence
An automatic prompt for classification verification or a lockdown if classifications do not match.
- Check 4 of 4What an auditor asks for
Ask for
To see training materials and attendance records related to media classification training sessions.
Look at
Comprehensive materials and consistent staff participation. Good is regular and documented training sessions with updated materials.
Good evidence
A clearly outlined process for classifying and reclassifying media with roles and responsibilities identified.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.12.
ISM-0325 requires that any media connected to a higher-classified/sensitivity system be reclassified up to that higher level (unless read-only access is assured). Annex A 5.12 establishes the organisation's overall information classification policy and practices that define classification levels and decision criteria. ISM-0325 operationalises one specific classification rule (inheritance/upgrade on connection) rather than defining the broader classification scheme.
This control partially meets A.7.10.
ISM-0325 requires reclassifying media to the higher sensitivity/classification when it is connected to a more sensitive system, with an exception for read-only media or enforced read-only access. Annex A 7.10 requires secure lifecycle management of storage media in accordance with the organisation's classification and handling requirements. ISM-0325 is a specific handling/labelling escalation rule within the broader media management lifecycle covered by Annex A 7.10.
This control supports A.8.12.
ISM-0325 reduces the risk of mishandling by ensuring connected media is treated at the highest sensitivity/classification of the system it touches. Annex A 8.12 requires data leakage prevention (DLP) measures across systems, networks, and devices processing sensitive information. Reclassifying media per ISM-0325 supports DLP by ensuring controls and handling expectations follow the highest sensitivity, but Annex A 8.12 focuses on technical prevention/detection mechanisms rather than classification escalation rules.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.