ASD ISM 0360 Classification retention after flash memory sanitisation
What it says
Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEven after being sanitised, flash drives for SECRET and TOP SECRET still need to be treated as classified data.
Even after you think you've erased data from a flash drive, certain data still needs to be handled carefully if it was ever classified as SECRET or TOP SECRET. This is important because mishandling could inadvertently expose sensitive information, risking national security or personal privacy breaches.
Free. Save your status, tasks and notes.
Why it matters
If sanitised flash media is treated as unclassified, residual SECRET/TOP SECRET data may be exposed, creating a national security risk.
How to implement
Security officers should conduct a risk assessment to identify flash drives previously used for SECRET or TOP SECRET data.
They should list these devices and ensure they are tracked and monitored even after sanitisation.
IT teams should implement strict control processes for sanitising flash drives.
This involves using software or hardware that complies with government guidelines, ensuring that data cannot be easily recovered.
Management should establish and enforce a policy that treats all sanitised flash memory as if it still contains classified information.
This means storing or disposing of them securely like they would with classified materials.
Asset managers should maintain a detailed inventory of all flash memory devices used for classified information.
Each entry should include the current location, custodian, and sanitisation status of the device.
Training officers should provide regular reminders and training sessions for all staff on the proper handling of sanitised flash memory.
These sessions should emphasise why security practices for handling these devices still matter.
Keep it running
After sanitisation, keep flash media labelled SECRET/TOP SECRET and handle/store it as such, as flash cells can retain recoverable remnants.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The risk assessment document of flash drives used for classified data: Verify that each identified device is listed with its classification history.
Look at
Completeness and accuracy in the records.
- Check 2 of 4What an auditor asks for
Look at
The procedures to ensure they comply with relevant government standards.
Good evidence
Will include references to specific sanitisation methods and equipment used.
- Check 3 of 4What an auditor asks for
Ask for
Them to explain the steps they take and verify consistency with documented procedures.
Good evidence
Features adherence to documented processes and an understanding of the risks involved.
- Check 4 of 4What an auditor asks for
Look at
Clarity on why sanitised flash drives remain classified and how they should be handled.
Good evidence
Session or material will clearly convey the importance of ongoing secure handling.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.10.
ISM-0360 requires that after sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification and must continue to be handled as classified. This relates to ISO/IEC 27001:2022 Annex A 7.10 because it requires storage media to be managed across its lifecycle in accordance with the organisation's classification scheme and handling requirements. The overlap is specifically around post-sanitisation handling/controls for media, but Annex A 7.10 is broader (all media, all classifications) and does not mandate the ISM's specific rule that sanitised flash media at SECRET/TOP SECRET retains classification.
This control partially overlaps A.7.14.
ISM-0360 requires that sanitised SECRET and TOP SECRET flash media still retains its classification and must continue to be treated and controlled as classified. This overlaps with ISO/IEC 27001:2022 Annex A 7.14 because it addresses secure disposal or re-use of equipment by verifying sensitive data has been removed or securely overwritten prior to disposal or re-use. The key difference is that Annex A 7.14 assumes sanitisation enables declassification for disposal/re-use decisions, whereas ISM-0360 explicitly prevents declassification for SECRET/TOP SECRET flash media even after sanitisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.