Skip to content
Media
ASD ISMISM-0359

ASD ISM 0359 Proper sanitisation of non-volatile flash memory

What it says

Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Non-volatile flash memory is wiped by overwriting it twice with random data, then checked to ensure it's clean.

This control is about making sure that the data stored on non-volatile flash memory is completely erased before disposing of the device or repurposing it. This is important because if old data isn't properly wiped, sensitive information could fall into the wrong hands, leading to privacy breaches or financial loss.

Why it matters

If flash memory isn't overwritten twice with random patterns and verified, sensitive data may remain recoverable when devices are reused or disposed of.

How to implement

  1. IT team should develop a sanitisation procedure: Ensure there is a clear step-by-step process to overwrite non-volatile flash memory twice with random data.

    Use reliable software tools designed for data destruction to execute this process.

  2. System administrator looks after regular verification: After data has been overwritten, the system administrator should perform a read-back process to verify that no original data is left.

    Use data verification software to confirm the memory is clean.

  3. Procurement officer manages equipment lifecycle: Before disposing or selling off devices with non-volatile memory, the procurement officer should ensure the sanitisation process has been completed.

    Keep a record of this verification for future audits.

  4. Staff training by IT manager: Train staff responsible for handling storage media on how to carry out the sanitisation process properly.

    Use training sessions or workshops with practical demonstrations using real devices.

  5. Compliance officer conducts regular checks: The compliance officer should periodically review and audit sanitisation efforts to ensure procedures are effectively protecting data.

    Include spot-checks during the gear disposal or repurposing process.

Keep it running

Overwrite the entire flash medium at least twice with random patterns, then perform a full read-back verification to confirm the overwrite completed successfully.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The sanitisation procedure document: Request the written procedure that outlines how non-volatile flash memory is overwritten and verified.

    Look at

    Detailed steps covering both data overwriting and verification.

    Good evidence

    Includes an up-to-date document with clear responsibilities and methods.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Shows logs with past dates and successful verifications.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Them to explain how the memory sanitisation process is conducted and verified.

    Good evidence

    Is when staff confidently describe the overwriting and verification process and know where the procedure is documented.

  4. Check 4 of 5What an auditor asks for

    Look at

    Adherence to the documented procedure and any deviations addressed immediately.

    Good evidence

    Demonstrates exact following of the procedure.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Includes well-organised records with all necessary details and authorisations.

Mappings

Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.7.10Secure management of storage mediaPartially meets
  • A.7.14Secure disposal or re-use of equipmentPartially meets
  • A.8.10Secure deletion of information when no longer neededPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.