ASD ISM 0347 Use write-once media for secure data transfers

IT staff should organise a review of existing media usage processes: Ensure staff members are aware of which types of physical media (like CDs or DVDs) can only be written to once.

This can involve updating procedures and providing training to relevant staff on the secure handling of such media.

System owners should coordinate with the IT team to source appropriate write-once media: Identify and purchase media that can be used to securely transfer data.

This includes liaising with suppliers to confirm that the media meets security requirements and is compatible with existing systems.

The IT team should implement a verification process to ensure the media is write-once: Conduct tests to confirm that the media can be written to only once and mark it as secured.

This might involve attempting to overwrite the media after data is transferred to verify that it's not possible.

Managers should establish a policy for data transfer approval: Create a clear procedure for approving transfers, including a checklist that ensures write-once media is being used for high-security data movements.

This could involve setting up a quick form that requires sign-off from a data protection officer.

The IT team should install software to ensure read-only access on receiving systems: Where exceptions are necessary, configure the systems that will receive data to allow only read access, preventing any changes.

This may involve using operating system settings or third-party software to enforce read-only restrictions.