ASD ISM 0354 Ensuring proper sanitisation of magnetic media
What it says
Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishErase non-volatile magnetic media by overwriting with random data, ensuring old data cannot be accessed.
Ensuring that magnetic media, like old hard drives, media tapes, or backup disks, are properly erased before disposal or reuse is crucial. If this isn't done thoroughly, sensitive information could be recovered by someone else, potentially leading to data breaches or privacy violations.
Free. Save your status, tasks and notes.
Why it matters
Improper sanitisation of non-volatile magnetic media can expose residual sensitive data when reused, causing data breaches and reputational damage.
How to implement
IT Manager should ensure all non-volatile magnetic media is identified: Compile a list of all media types in use, including backup tapes and spare hard drives.
This helps to systematically track what needs to be cleaned.
IT Team should perform the sanitisation process using approved software: Use data wiping tools that overwrite the magnetic media with random data at least once to make previously stored data unreadable.
Check the tool's documentation to ensure it follows industry standards for data destruction.
Procurement staff should be trained on disposal processes: Ensure they know that media cannot just be thrown away but needs to be cleaned according to this control.
Provide them with a checklist of approved disposal methods.
IT Team should verify sanitisation through read-back testing: After wiping, use a verification process to read back the data to confirm no old data remains.
Document these results for each device.
Office Manager should keep a disposal log: Maintain records of when and how each piece of media was sanitised and by whom, along with verification test results.
This log can be a simple spreadsheet or database entry.
Keep it running
Overwrite magnetic media end-to-end with a random pattern and perform read-back verification. Use three overwrite passes for pre-2001 or <15 GB devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media sanitisation procedures document: Request a copy of the specific procedures used for wiping non-volatile magnetic media.
Look at
Steps covering media identification, wiping processes, and verification.
Good evidence
Describes clear steps that align with the control requirements.
- Check 2 of 5What an auditor asks for
Ask for
The log that tracks each piece of media purged. Check for dates, methods used, and verification signatures.
Look at
The disposal log or inventory records.
Good evidence
Is a well-maintained log that matches physical media inventory records.
- Check 3 of 5What an auditor asks for
Ask for
Them to describe the process of sanitisation and verification.
Good evidence
Include clear references to tools used and how verification is performed for each media.
- Check 4 of 5What an auditor asks for
Look at
Proper use of tools and adherence to documented procedures. Good performance follows the documented steps exactly.
- Check 5 of 5What an auditor asks for
Ask for
Proof of training for procurement staff.
Look at
Training records or certificates that show procurement staff have been taught disposal methods. Good evidence is recent and relevant training logs tied to the specific control's requirements.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0354 requires non-volatile magnetic media to be sanitised by overwriting the entire medium with a random pattern (with specified pass requirements) and verifying by read-back. ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed securely across its lifecycle, including disposal, in line with classification and handling rules, which would encompass having sanitisation methods for media. ISM-0354 is a specific technical sanitisation method for one media type, whereas Annex A 7.10 is broader lifecycle governance covering acquisition, use, transport and disposal.
This control partially meets A.7.14.
ISM-0354 mandates a specific, verifiable overwriting process to sanitise non-volatile magnetic media so that prior data cannot be accessed. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data has been removed or securely overwritten before equipment disposal or re-use, directly aligning with the intent of sanitisation. ISM-0354 is narrower because it prescribes detailed overwrite pass counts and read-back verification for magnetic media, while Annex A 7.14 applies more generally to any equipment with storage media and allows multiple secure removal approaches.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.