ASD ISM 0357 Sanitising non-volatile EPROM media
What it says
Non-volatile EPROM media is sanitised by applying three times the manufacturer's specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishErase and overwrite EPROM with UV exposure and a random pattern to ensure data is completely removed.
Sanitising non-volatile EPROM media involves making sure old data is completely erased so it can't be recovered. This matters because if confidential or sensitive information isn't fully removed, it might be disclosed without permission, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Failing to apply 3x UV erasure and random overwrite on EPROM could leave recoverable remnants, enabling sensitive data exposure.
How to implement
IT personnel should follow manufacturer guidelines for UV erasure: Check the EPROM's manual for the specified ultraviolet light (UV) exposure time and apply it three times in a controlled environment.
Use a UV eraser device as specified by the instructions.
After UV exposure, IT should fully overwrite the EPROM: Use a software tool to write a random pattern of data across the entire EPROM chip, ensuring no trace of the original data remains.
Technical staff should verify the overwriting process: Use a reading device to check that the random data pattern is correctly written across the whole chip, confirming the overwriting was successful.
System administrators should securely dispose of unnecessary EPROMs: After successful sanitisation, ensure that EPROMs are either securely archived or disposed of according to your organisation's waste management policy for electronic devices.
Managers should document the sanitisation process: Maintain a log that details each sanitisation event, including dates, personnel involved, methods used, and verification results, to ensure a clear audit trail.
Keep it running
Apply 3x the manufacturer UV erase time, then overwrite the entire EPROM once with a random pattern and perform read-back verification.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The sanitisation process log: Request the detailed log of EPROM sanitisation events, including the dates and the methods used.
Look at
A step-by-step account of UV exposure and overwriting occurring multiple times.
Good evidence
Will include detailed records with confirmation of complete data removal.
- Check 2 of 5What an auditor asks for
Look at
A device in good working order that meets the manufacturer's specifications.
Good evidence
Will show the equipment is regularly maintained and still under operational condition.
- Check 3 of 5What an auditor asks for
Ask for
Them to describe how they overwrite EPROMs after UV exposure.
Look at
Their understanding of using random data patterns for overwriting completely.
Good evidence
Shows they confidently explain and follow the process.
- Check 4 of 5What an auditor asks for
Look at
The records and physical labels for evidence of processed date and verification.
Good evidence
Is appropriately labelled or tagged EPROMs with matching log entries.
- Check 5 of 5What an auditor asks for
Look at
Compliance with organisation policy for electronic waste.
Good evidence
Is detailed disposal logs showing secure and environmentally responsible methods.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0357 requires a precise EPROM sanitisation procedure to ensure data is irrecoverable, including verification by read back. Annex A 7.10 requires organisations to manage storage media across its lifecycle (acquisition, use, transport, disposal) according to classification and handling rules, within which sanitisation prior to disposal/re-use is a key activity. ISM-0357 only covers one media type and one sanitisation approach, whereas Annex A 7.10 covers governance and handling controls for many media types and scenarios.
This control partially meets A.7.14.
ISM-0357 requires a specific sanitisation method for non-volatile EPROM media, including extended UV erasure and a full overwrite with verification. Annex A 7.14 requires equipment containing storage media to be verified as having sensitive data removed or securely overwritten before disposal or re-use, which is the broader lifecycle/disposal requirement that EPROM sanitisation can satisfy. ISM-0357 is technology- and method-specific (EPROM + UV + overwrite), while Annex A 7.14 is media-agnostic and outcome-focused.
This control partially meets A.8.10.
ISM-0357 mandates a specific secure-erasure technique for non-volatile EPROM media (extended UV exposure, overwrite, and verification). Annex A 8.10 requires secure deletion of information from systems, devices, or any storage media when no longer needed, without prescribing a specific technique. ISM-0357 is a concrete implementation option that fits within Annex A 8.10's broader secure-deletion requirement and goes deeper on method and verification for EPROM.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.