ASD ISM 0337 Ensure media is used with authorised systems
What it says
Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia must only be used with systems that are authorised for its sensitivity level.
This control is about ensuring that any media, like USB drives or DVDs, is only used with computers and systems that are secure enough to handle its confidentiality and importance. This matters because using sensitive media with unsecured systems can lead to information leaks or data breaches, which can damage your organisation's reputation or lead to financial loss.
Free. Save your status, tasks and notes.
Why it matters
Using sensitive media on unauthorised systems can expose classified data, breach ISM requirements, and cause incidents and reputational harm.
How to implement
System owners should create and maintain a list of authorised systems that can handle different sensitivity levels of media.
This involves identifying which computers and devices are equipped with the necessary security measures, such as encryption, and keeping this list updated regularly.
IT teams should set up controls to prevent unauthorised media from being used with sensitive systems.
This can be done by configuring system settings to block unauthorised devices automatically and ensuring that only approved users have the rights to override these controls.
Managers should train staff on the importance of using media only with authorised systems.
This involves holding regular information sessions where employees learn about the risks of data leaks, how to identify authorised systems, and practical steps they can take to avoid using media incorrectly.
Procurement teams should ensure the systems purchased meet security standards for handling media of varying sensitivity.
This means checking the specifications to confirm that new devices have adequate protection measures in place to match the information they will handle.
HR should incorporate guidelines on media usage within the organisational policies.
This includes clearly outlining the consequences of violating these policies and ensuring every employee is aware of the protocols for handling sensitive information.
Keep it running
Ensure removable media is only connected to systems authorised for its sensitivity/classification; enforce controls and periodically audit connection logs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of authorised systems: Request documentation or a database entry that shows which systems are allowed for different sensitivity levels.
Look at
The details such as the system names, sensitivity levels supported, and last update date.
Good evidence
Includes a comprehensive, regularly updated list cross-referenced with the organisation's classification standards.
- Check 2 of 5What an auditor asks for
Good evidence
Demonstrates a regular schedule with high attendance and topics focused on policy awareness and risk management.
- Check 3 of 5What an auditor asks for
Ask for
How they configure systems to enforce media usage restrictions.
Look at
Methods like encryption and device control settings.
Good evidence
Includes specific technical details that ensure media is only used with authorised systems.
- Check 4 of 5What an auditor asks for
Ask for
To see if regular checks are performed on systems to verify media use compliance. Observe the process for checking compliance records.
Good evidence
Involves witnessing a routine inspection or an audit trail of previous checks with documented results.
- Check 5 of 5What an auditor asks for
Look at
Clear guidelines on what constitutes an authorised system and the procedures for ensuring compliance.
Good evidence
Includes up-to-date policies that are comprehensive and have been communicated to all employees.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
ISM-0337 requires media to only be used with systems authorised to process, store or communicate the media's sensitivity or classification. Annex A 5.10 supports this by requiring documented acceptable-use and handling procedures, which formalises rules on where classified media may be used. Annex A 5.10 is broader and policy-focused, while ISM-0337 is operational.
This control partially meets A.7.10.
ISM-0337 requires media to only be used with systems authorised for its classification. Annex A 7.10 covers the full lifecycle management of storage media, aligning classification and handling requirements. Within this broader control, ISM-0337's focus on authorised system use is a specific aspect.
This control depends on A.5.13.
ISM-0337 mandates that media be used only with systems authorised for its classification. Annex A 5.13 is a prerequisite since consistent labelling assists in identifying media classifications, which is crucial for applying authorised-system restrictions per ISM-0337. Annex A 5.13 focuses on media marking, while ISM-0337 enforces authorised system use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.