Label Media With Protective Markings Reflecting Sensitivity Or Classification
All media, apart from fixed drives built inside equipment, must carry a label showing how sensitive or highly classified the information on it is.
Plain language
Media means any item that stores information, such as USB sticks, external hard drives, CDs, DVDs, backup tapes and memory cards. This control says every piece of media must have a label, called a protective marking, that shows how sensitive or how highly classified the information stored on it is. The only exception is fixed media built inside a device, like the internal hard drive sealed inside a laptop or server. Labelling matters because it tells anyone handling the media how carefully it must be treated, so confidential information is not accidentally left in an unlocked drawer, posted, or thrown out.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
Media, except for internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification.
Why it matters
Unlabelled media can be mistaken for low-risk, so highly sensitive information may be stored insecurely, mailed, or discarded, leading to a data breach.
Operational notes
Re-check labels whenever media is reused for different information, and replace any marking that becomes worn, unreadable or no longer matches the sensitivity of the data held.
Implementation tips
- The person responsible for security (such as the office manager or IT lead) should set a simple labelling scheme that matches your organisation's sensitivity levels, for example 'OFFICIAL', 'OFFICIAL: Sensitive' or your own 'Public', 'Internal', 'Confidential' tiers, and write down what each level means.
- Whoever issues or buys storage media should attach a physical label (a printed sticker or permanent marker) to each item, such as USB sticks, external drives, backup tapes, CDs and DVDs, showing the highest sensitivity of the information it holds before it is used to store data.
- IT staff should keep a register listing each piece of removable media, its serial number or unique identifier and its protective marking, so labels can be checked against a master list and missing or mismatched labels are spotted.
- Managers should make clear that internally mounted fixed media (the sealed internal drive inside a laptop, desktop or server) does not need its own external label, so staff focus labelling effort on removable and portable media that leaves the device.
- The security lead should run a periodic walk-through (for example every six months) to confirm media in use still carries a correct, legible protective marking, and re-label any item whose label is worn, missing or no longer matches the data it now holds.
Audit / evidence tips
- Askthe organisation's media labelling procedureLook atwhether it lists the sensitivity or classification levels used and requires a protective marking on each item of mediaGoodis a written, dated procedure naming each level and stating that all media except internally mounted fixed media must be labelled
- Askto physically inspect a sample of removable media (USB sticks, external drives, backup tapes, optical discs)Look atwhether each one carries a clear, legible protective markingGoodis every sampled item showing a marking that matches the sensitivity of the data it holds
- Askthe media register or inventoryLook atwhether each entry records the protective marking alongside the itemGoodis a complete register where every removable item has a recorded classification that matches its physical label
- Askhow the organisation decides which media is exemptLook atwhether staff correctly understand that only internally mounted fixed media inside equipment is exemptGoodexplains that sealed internal drives are exempt but anything removable or portable must be labelled
- Askevidence of periodic label checksLook atdated review records or walk-through notes confirming markings are still correct and legibleGoodis recent review records showing items were checked and any worn or incorrect labels were fixed
Cross-framework mappings
How ISM-0332 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.13 | ISM-0332 requires organisations to label physical media (excluding internally mounted fixed media) with protective markings that reflect ... | |
linkRelated(1)expand_less | ||
| Annex A 5.12 | Annex A 5.12 requires information to be classified according to organisational security needs (confidentiality, integrity, availability) ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Media
See all Guidelines for media controls, or browse the full ASD ISM library.