ASD ISM 0350 Destroy unsanitizable media before disposal
What it says
The following media types are destroyed prior to their disposal: - microfiche and microfilm - optical discs - programmable read-only memory - read-only memory - other types of media that cannot be sanitised.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia that can't be cleaned of data must be destroyed before getting rid of it.
This control is all about securely getting rid of certain types of media like optical discs and microfilm that can't be cleaned of their data. Before you throw them out, you need to destroy them to ensure sensitive information doesn't end up in the wrong hands. If you don't do this, private data could be exposed, leading to potential breaches and damage to your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to destroy unsanitised media like optical discs or microfilm before disposal can lead to data breaches, financial loss, and damage to organisational reputation.
How to implement
Office managers should create an inventory of all media types used in the organisation and categorise them based on their ability to be sanitised.
This involves listing what types of media you have and identifying those that cannot be wiped clean, like read-only media or microfilm.
The IT team should develop a standard procedure for the physical destruction of unsanitizable media.
This can be done by acquiring a shredder capable of handling these types of materials or by contracting a certified data destruction company.
Procurement staff should ensure contracts with disposal vendors include media destruction services that comply with the organisation's requirements.
This means reviewing vendor capabilities and certifications to ensure they understand and can perform the destruction required for sensitive information.
The security team should regularly train staff involved in media disposal on the importance of this control and the steps to correctly destroy media.
This involves practical sessions showing how to handle and destroy different media types safely.
Managers should set regular reviews every six months to ensure the destruction process is being followed and any new media types used within the organisation are evaluated for sanitisation capability.
These reviews should involve checking the destruction records and assessing any changes in media usage.
Keep it running
Regularly audit disposal procedures to identify unsanitiseable media and ensure it is physically destroyed before disposal to prevent data exposure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of media types used in the organisation: Verify that the list includes all the media types identified in the inventory.
Good evidence
List is comprehensive, regularly updated, and marks which items cannot be sanitised.
- Check 2 of 5What an auditor asks for
Good evidence
Record will match the volume and types of unsanitizable media listed in the inventory.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the methods and tools used to destroy media.
Good evidence
Should include details of the equipment used or the vendor services hired, demonstrating knowledge of best practices.
- Check 4 of 5What an auditor asks for
Look at
Training records for staff involved in media disposal: Ensure there are up-to-date records of media disposal training sessions and attendance by relevant staff.
Good evidence
Includes dates of the training, attendees' names, and a summary of the topics covered.
- Check 5 of 5What an auditor asks for
Good evidence
Session follows all safety and security protocols, ending with properly destroyed media.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0350 requires organisations to destroy storage media that cannot be sanitised, including types like microfiche, microfilm, optical discs, ROM/PROM, before disposal. This aligns with Annex A 7.10's requirement for secure management of storage media throughout its lifecycle, including disposal, according to classification and handling guidelines. ISM-0350 is a specific disposal requirement within the broader lifecycle management expectations of Annex A 7.10.
This control partially overlaps A.7.14.
ISM-0350 mandates destruction of media that cannot be sanitised before disposal. Annex A 7.14 requires equipment with storage media to be verified for data removal or secure overwriting prior to disposal or re-use. Both controls focus on preventing data remanence at end-of-life. ISM-0350 specifically mandates destruction for unsanitizable media, whereas Annex A 7.14 supports verification and allows for re-use by removal or overwriting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.