ASD ISM 0330 Proper sanitisation and reclassification of media
What it says
Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore lowering media classification, it must be cleaned or destroyed and a formal decision made.
Before deciding to treat sensitive media as less sensitive, it's crucial to either thoroughly clean it or completely destroy it if necessary. This matters because if sensitive information isn't properly sanitised, it might fall into the wrong hands, leading to data breaches or misuse that can damage trust and incur significant costs.
Free. Save your status, tasks and notes.
Why it matters
Improper media sanitisation before downgrading can expose classified data, causing breaches, legal/contractual impacts and financial loss.
How to implement
Managers should establish clear procedures for media sanitisation: Develop a documented process for how different types of media should be cleaned or destroyed before their classification is lowered.
Involve IT staff to ensure the process is practical and achievable.
IT teams need to implement the sanitisation process: Use approved tools and methods (e.g., secure data wipe software) to clean electronic media.
For physical media like paper, shredding can be effective. Ensure staff are trained in these methods.
HR should oversee staff training on media classification: Ensure all employees understand the importance of this control and how to handle media appropriately in line with their classification.
Provide regular training sessions and updates.
Procurement teams should ensure sanitisation tools are available and updated: Purchase and maintain appropriate software and hardware for media sanitisation.
Review and update these tools regularly to ensure they comply with the latest security standards.
System owners need to make formal reclassification decisions: After sanitisation, formally document the decision to reclassify media to a lower sensitivity level, with appropriate authorisation.
Use a standard form or system for consistency.
Keep it running
Before downgrading media, sanitise or destroy it using approved methods and record a formal administrative decision authorising the reclassification.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The organisation's media sanitisation policy: Review the document to ensure it outlines steps for cleaning or destroying media before reclassification.
Good evidence
Includes detailed procedures and roles for those responsible.
- Check 2 of 4What an auditor asks for
Ask for
Logs of media sanitisation actions.
Look at
Records showing past sanitisation activities, such as destruction certificates or logs from secure wipe tools. Good logs include media type, date, method, and responsible person's name.
- Check 3 of 4What an auditor asks for
Ask for
How they ensure media is properly sanitised before reclassification.
Good evidence
Is a clear explanation with examples of tools and methods used and compliance with the policy.
- Check 4 of 4What an auditor asks for
Good evidence
Practice is the correct application of the documented procedures, showing effective and secure handling.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0330 requires that before media is reclassified to a lower sensitivity or classification, it is sanitised or destroyed and a formal administrative decision is made to reclassify it. ISO/IEC 27001:2022 Annex A 7.10 governs secure management of storage media across its full lifecycle, including disposal, in accordance with classification and handling requirements, which encompasses sanitisation activities. ISM-0330 is a specific rule within that broader lifecycle management requirement, adding an explicit reclassification trigger and decision point.
This control partially overlaps A.7.14.
ISM-0330 requires that before media is reclassified to a lower sensitivity or classification, it is sanitised or destroyed and a formal administrative decision is made to reclassify it. ISO/IEC 27001:2022 Annex A 7.14 aligns with the sanitisation aspect by requiring verification that sensitive data is removed or securely overwritten prior to disposal or re-use of equipment containing storage media. However, Annex A 7.14 is focused on disposal/re-use scenarios and does not include the ISM-0330 requirement for a formal decision to downgrade classification.
This control partially overlaps A.8.10.
ISM-0330 requires that before media is reclassified to a lower sensitivity or classification, it is sanitised or destroyed and a formal administrative decision is made to reclassify it. ISO/IEC 27001:2022 Annex A 8.10 overlaps by requiring secure deletion of information from systems, devices or other storage media when it is no longer required, which is one common method used to sanitise media. However, Annex A 8.10 is driven by retention/need-to-keep considerations rather than reclassification, and it does not address the administrative approval/decision process that ISM-0330 mandates.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.