ASD ISM 0348 Develop and maintain media sanitisation procedures
What it says
Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create, apply, and keep up media sanitisation methods and procedures.
To keep your business safe, it's important to securely wipe or destroy any old or unwanted data storage media, like hard drives or USB sticks, before getting rid of them. If you don't, sensitive information could fall into the wrong hands, leading to data breaches and loss of trust in your organisation.
Free. Save your status, tasks and notes.
Why it matters
Poor media sanitisation can lead to sensitive data leaks, resulting in reputational damage, legal repercussions, and financial loss.
How to implement
The IT team should develop a clear media sanitisation policy: This policy should outline what types of media need to be sanitised, the methods for doing so, and how records should be kept.
The policy should be easy for all staff to follow and include instructions for wiping and dismantling devices.
Managers should ensure staff are trained on media sanitisation procedures: Hold training sessions for employees to make sure everyone knows how to properly sanitise data-bearing media.
Use simple language and practical demonstrations to show the correct processes.
IT support staff should maintain an inventory of media containing data: Keep a list of all company devices and media that store data, noting when they were last sanitised or destroyed.
Use a spreadsheet or software tool to track this information consistently.
Procurement teams should include media sanitisation in vendor contracts: When contracting with suppliers for data storage or IT disposal, ensure agreements specify secure sanitisation of data.
Include clear data destruction protocols in contracts to avoid leaks.
Office managers should assign responsibility for regular checks: Have someone regularly check that media sanitisation is being done correctly.
Set up quarterly reviews where responsible staff verify that sanitisation standards are being maintained across the office.
Keep it running
Maintain documented procedures for sanitising, verifying and recording disposal of each media type (e.g., wipe, degauss, shred), and review them regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media sanitisation policy document: Review the document to ensure it covers all types of media used in the organisation and outlines approved sanitisation methods.
Good evidence
Is a comprehensive, easily understandable document signed off by management.
- Check 2 of 5What an auditor asks for
Good evidence
List should be up-to-date and cross-referenced with disposals.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the sanitisation process they follow and how they confirm media is securely wiped or destroyed.
Good evidence
Will include specific methods and tools used, and how they verify success.
- Check 4 of 5What an auditor asks for
Look at
Attendance lists and training content to check if staff members regularly receive appropriate training.
Good evidence
Record shows regular sessions with high attendance and clear instructional material.
- Check 5 of 5What an auditor asks for
Good evidence
Process will be structured and result in a certificate or other confirmation that media was successfully sanitised.
Mappings
Closest match in ISO/IEC 27001: A.5.37, Documented operating procedures for information processing, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.37.
ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures. ISO/IEC 27001:2022 Annex A 5.37 requires documented operating procedures for information processing facilities to be available to relevant personnel, which would include documenting and publishing media sanitisation procedures. Annex A 5.37 is broader because it covers operating procedures across many processing activities, whereas ISM-0348 is specifically focused on media sanitisation.
This control partially overlaps A.5.10.
ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and procedures for handling information and associated assets, which commonly includes requirements for handling and disposing of storage media securely (including sanitisation prior to reuse or disposal). Annex A 5.10 is broader (acceptable use and handling generally), while ISM-0348 goes deeper on the specific life-cycle activity of sanitising media and maintaining dedicated sanitisation procedures.
This control partially overlaps A.7.10.
ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures. ISO/IEC 27001:2022 Annex A 7.10 requires secure management of storage media across acquisition, use, transport, and disposal, where sanitisation is a key control for disposal and reuse stages. Annex A 7.10 covers the full storage media life cycle and classification/handling alignment, while ISM-0348 focuses specifically on establishing and maintaining the sanitisation process and procedures.
This control depends on A.8.10.
Annex A 8.10 requires organisations to ensure information is deleted when no longer required. ISM-0348 supports Annex A 8.10 by requiring media sanitisation processes and procedures to be developed, implemented and maintained, which provides the operational capability to perform secure deletion. ISM-0348 focuses on procedural governance for sanitisation and does not itself set the retention/deletion trigger of 'no longer required'.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.