ASD ISM 0332 Label media with protective markings reflecting sensitivity or classification
What it says
Media, except for internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll media, apart from fixed drives built inside equipment, must carry a label showing how sensitive or highly classified the information on it is.
Media means any item that stores information, such as USB sticks, external hard drives, CDs, DVDs, backup tapes and memory cards. This control says every piece of media must have a label, called a protective marking, that shows how sensitive or how highly classified the information stored on it is. The only exception is fixed media built inside a device, like the internal hard drive sealed inside a laptop or server. Labelling matters because it tells anyone handling the media how carefully it must be treated, so confidential information is not accidentally left in an unlocked drawer, posted, or thrown out.
Free. Save your status, tasks and notes.
Why it matters
Unlabelled media can be mistaken for low-risk, so highly sensitive information may be stored insecurely, mailed, or discarded, leading to a data breach.
How to implement
The person responsible for security (such as the office manager or IT lead) should set a simple labelling scheme that matches your organisation's sensitivity levels, for example 'OFFICIAL', 'OFFICIAL: Sensitive' or your own 'Public', 'Internal', 'Confidential' tiers, and write down what each level means.
Whoever issues or buys storage media should attach a physical label (a printed sticker or permanent marker) to each item, such as USB sticks, external drives, backup tapes, CDs and DVDs, showing the highest sensitivity of the information it holds before it is used to store data.
IT staff should keep a register listing each piece of removable media, its serial number or unique identifier and its protective marking, so labels can be checked against a master list and missing or mismatched labels are spotted.
Managers should make clear that internally mounted fixed media (the sealed internal drive inside a laptop, desktop or server) does not need its own external label, so staff focus labelling effort on removable and portable media that leaves the device.
The security lead should run a periodic walk-through (for example every six months) to confirm media in use still carries a correct, legible protective marking, and re-label any item whose label is worn, missing or no longer matches the data it now holds.
Keep it running
Re-check labels whenever media is reused for different information, and replace any marking that becomes worn, unreadable or no longer matches the sensitivity of the data held.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the organisation's media labelling procedure.
Look at
whether it lists the sensitivity or classification levels used and requires a protective marking on each item of media.
Good evidence
is a written, dated procedure naming each level and stating that all media except internally mounted fixed media must be labelled.
- Check 2 of 5What an auditor asks for
Ask for
to physically inspect a sample of removable media (USB sticks, external drives, backup tapes, optical discs).
Look at
whether each one carries a clear, legible protective marking.
Good evidence
is every sampled item showing a marking that matches the sensitivity of the data it holds.
- Check 3 of 5What an auditor asks for
Ask for
the media register or inventory.
Look at
whether each entry records the protective marking alongside the item.
Good evidence
is a complete register where every removable item has a recorded classification that matches its physical label.
- Check 4 of 5What an auditor asks for
Ask for
how the organisation decides which media is exempt.
Look at
whether staff correctly understand that only internally mounted fixed media inside equipment is exempt.
Good evidence
explains that sealed internal drives are exempt but anything removable or portable must be labelled.
- Check 5 of 5What an auditor asks for
Ask for
evidence of periodic label checks.
Look at
dated review records or walk-through notes confirming markings are still correct and legible.
Good evidence
is recent review records showing items were checked and any worn or incorrect labels were fixed.
Mappings
Closest match in ISO/IEC 27001: A.5.12, Information classification policy and practices, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.12.
Annex A 5.12 requires information to be classified according to organisational security needs (confidentiality, integrity, availability) and interested party requirements, so it is handled appropriately. ISM-0332 implements part of this by requiring media to be labelled with protective markings that reflect its sensitivity/classification. ISM-0332 focuses on physical/media labelling, whereas Annex A 5.12 is broader and includes defining the classification scheme and applying it across information in all forms.
This control partially meets A.5.13.
ISM-0332 requires organisations to label physical media (excluding internally mounted fixed media) with protective markings that reflect the media's sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.13 requires procedures for information labelling aligned to the organisation's classification scheme, which can include labels on media and containers. ISM-0332 is a specific, physical-media-focused instantiation of the broader ISO labelling requirement, which also covers labelling of information in other forms (e.g. documents, files, records) and the procedures around it.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.