ASD ISM 0358 Classification retention for sanitised EPROM and EEPROM
What it says
Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEven after erasure, certain memory devices stay classified as SECRET or TOP SECRET.
After you securely erase certain types of computer memory called EPROM and EEPROM, they still must be treated as holding secret information, like classified government documents. This is crucial because without this caution, sensitive information could be mishandled, leading to privacy breaches or even national security risks.
Free. Save your status, tasks and notes.
Why it matters
If sanitised EPROM/EEPROM isn't still treated as SECRET/TOP SECRET, residual data may be exposed, causing serious national security and legal impacts.
How to implement
IT team should ensure proper disposal processes: Develop a procedure for securely collecting and storing sanitised EPROM and EEPROM devices, even after erasure.
Use a locked, secure bin specifically labelled for classified media.
Managers must train staff on classification retention: Conduct regular training sessions for team members to help them understand that sanitised EPROM and EEPROM devices still hold their classification.
Use examples to show how improper handling can result in serious data leaks.
Procurement should track classified media: Create a log to document all instances of EPROM and EEPROM devices being sanitised and retained.
Include details like serial numbers, the date of sanitisation, and current storage status.
IT security staff should audit storage environments: Regularly check physical storage locations for these devices to ensure they are secure and that access is controlled.
Make a schedule to perform these checks monthly.
Compliance officers need to review classification policies: Regularly review and update your organisation's classification policies to ensure they align with this control.
Consult with the Australian Signals Directorate (ASD) guidelines for any updates.
Keep it running
After sanitisation, keep EPROM/EEPROM at its original SECRET/TOP SECRET classification: retain markings, store in approved containers, and control custody/access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device sanitisation log: Request to see records of all sanitised EPROM and EEPROM devices that still hold classifications of SECRET or TOP SECRET.
Look at
A comprehensive list with device identifiers and sanitisation dates.
Good evidence
Includes a tracked list showing consistent entries for all applicable devices.
- Check 2 of 5What an auditor asks for
Look at
Records of training sessions, attendance sheets, and materials used.
Good evidence
Is evidence of regular training sessions with high attendance and clear educational content.
- Check 3 of 5What an auditor asks for
Look at
Securely locked bins or cabinets and restricted access.
Good evidence
Shows robust physical measures preventing unauthorised access.
- Check 4 of 5What an auditor asks for
Ask for
IT team members how they handle and ensure security of sanitised EPROM and EEPROM devices.
Look at
Consistent knowledge of procedures across staff.
Good evidence
Is detailed and aligns with written procedures.
- Check 5 of 5What an auditor asks for
Look at
Alignment with advice from the ASD.
Good evidence
Includes regularly updated documents with signs of recent reviews.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
ISM-0358 requires that sanitised SECRET/TOP SECRET EPROM/EEPROM media continues to be handled as classified, affecting how staff may store, transport, and dispose of that media. Annex A 5.10 requires rules for acceptable use and procedures for handling information and associated assets. Annex A 5.10 supports ISM-0358 by being the vehicle for communicating and enforcing handling rules (e.g., prohibiting disposal as unclassified waste), but Annex A 5.10 is generic and does not contain ISM-0358's technology- and classification-specific constraint.
This control partially meets A.5.12.
ISM-0358 mandates a specific classification outcome: sanitised EPROM/EEPROM that previously held SECRET or TOP SECRET information must continue to be treated at that classification. Annex A 5.12 establishes the organisation's overall classification policy and practices used to determine and apply classification based on security needs and requirements. Annex A 5.12 supports ISM-0358 by providing the governance mechanism to define and institutionalise this explicit exception to typical downgrading/declassification expectations, but it does not itself prescribe the EPROM/EEPROM retention rule.
This control partially meets A.7.10.
ISM-0358 requires that after any sanitisation attempt, SECRET and TOP SECRET non-volatile EPROM/EEPROM media must still be handled as retaining its original classification. Annex A 7.10 requires storage media to be managed through acquisition, use, transport and disposal in accordance with the organisation's classification scheme and handling requirements. ISM-0358 is a highly specific classification-handling rule for particular memory technologies and high classifications, whereas Annex A 7.10 is a general lifecycle control that would typically be implemented via policies/procedures that can incorporate ISM-0358's exception rule.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.