Skip to content
Media
ASD ISMISM-0356

ASD ISM 0356 Classify magnetic media after sanitisation

What it says

Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

After cleaning, classified magnetic media must still be treated as classified.

Even after you clean data off a hard drive or USB, it still needs to be treated as classified if it was originally marked as SECRET or TOP SECRET. This is important because traces of sensitive information might linger, and handling such media carelessly can lead to information leaks that could damage national security or a company's reputation.

Why it matters

Misclassifying sanitised SECRET/TOP SECRET magnetic media as unclassified can cause mishandling, spillage, or compromise.

How to implement

  1. IT security team should train staff on proper handling: Teach employees that even after removing data, media that was classified as SECRET or TOP SECRET needs careful handling, similar to when it had data.

    Use simple explanations to stress why it's important.

  2. Managers should create strict handling protocols: Define clear steps on how to store, transport, and dispose of classified media after data has been erased.

    Provide these steps in a written document available to all staff who handle such media.

  3. Security officers should use secure chains of custody: Ensure any media considered SECRET or TOP SECRET follows a documented pathway when moved or checked out.

    This involves signing logs that track media from one place to another with signatures of those handling it.

  4. Procurement teams should maintain vendor compliance: When contracting third-party vendors to handle classified media, verify that they understand and adhere to your organisation's handling protocols and sign agreements confirming this.

  5. Auditors should periodically review handling procedures: Regularly conduct checks to ensure the proper processes are being followed for dealing with classified media.

    Use simple checklists to see if standards have been met.

Keep it running

Treat sanitised SECRET/TOP SECRET magnetic media as still classified; label and store it accordingly and brief staff to prevent mishandling.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The magnetic media handling protocol: Request documents detailing handling procedures for sanitised classified media.

    Look at

    Clear instructions that align with the classification level.

    Good evidence

    A procedure document with clear, simple steps for handling and storage.

  2. Check 2 of 4What an auditor asks for

    Look at

    The dates, signatures, and reasons for media movement.

    Good evidence

    Outcome is seeing complete logs without gaps or missing information.

  3. Check 3 of 4What an auditor asks for

    Ask for

    Them to describe how they handle classified media after sanitisation.

    Good evidence

    Is staff providing a concise, accurate description that matches documented procedures.

  4. Check 4 of 4What an auditor asks for

    Look at

    Secure, controlled environments. Good practice involves locked storage and restricted access.

    Good evidence

    Is seeing contracts that explicitly reference classification handling requirements.

Mappings

Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.7.10Secure management of storage mediaPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.