ASD ISM 0363 Develop and maintain media destruction processes
What it says
Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure your organisation creates and follows proper media destruction procedures to securely dispose of data.
This control is about making sure you properly dispose of your old storage devices and documents so no one can access the data you don't need anymore. If you don't have a clear process for getting rid of these items safely, your confidential information could fall into the wrong hands, leading to privacy breaches or fraud.
Free. Save your status, tasks and notes.
Why it matters
Inadequate media destruction can leave residual data on disposed or reused media, enabling unauthorised access, data breaches and regulatory non-compliance.
How to implement
Office Manager: Develop a clear written policy that outlines how different types of media-like old computers, USB drives, and paper documents-should be securely destroyed.
Work with IT to ensure that this policy is simple for all staff to understand and follow.
IT Team: Create a step-by-step procedure for securely wiping data from digital storage devices before disposal.
This can include using specific software tools for data removal and documenting that the task has been completed.
HR Department: Train staff on the importance of media destruction and the processes your organisation has in place.
Use practical sessions to demonstrate how to handle and dispose of media, and keep a record of who has completed this training.
Facilities Manager: Arrange regular pickups or drop-off points for secure media disposal services, such as shredding companies.
Make sure that the service provider complies with security standards by checking their accreditation or certifications.
Procurement Officer: Include media destruction requirements in contracts with third-party service providers.
Ensure that contracts specify how and when data should be destroyed and require proof that proper destruction has been carried out.
Keep it running
Document approved destruction/sanitisation methods by media type, maintain chain-of-custody records, and routinely audit any third-party destruction provider for compliance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media destruction policy: Request the document that explains how data is supposed to be destroyed at your organisation.
Look at
Clear steps, responsibility details, and compliance with recognised standards.
Good evidence
Policy will leave no room for misunderstanding about how data should be securely destroyed.
- Check 2 of 5What an auditor asks for
Ask for
Them to describe how they carry out data wiping from digital devices. Listen for details on specific tools they use and steps they take.
Good evidence
Will include mention of industry-standard software and a recorded process of confirmation.
- Check 3 of 5What an auditor asks for
Ask for
To witness a session of secure paper shredding or electronic media wiping.
Look at
Compliance with procedures such as double-checking that data is irretrievable. It's good if you see a systematic, documented approach being followed.
- Check 4 of 5What an auditor asks for
Ask for
Evidence that staff have been trained in media destruction procedures.
Look at
Attendance records or certificates.
Good evidence
Result is evidence of regular training sessions that are up-to-date and appropriately attended.
- Check 5 of 5What an auditor asks for
Look at
Clauses that specify data destruction methods and proof of services. Good contracts will include specifics on compliance with data destruction standards and obligations for proof of service.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0363 requires organisations to establish and maintain media destruction processes and procedures to securely dispose of data-bearing media. ISO/IEC 27001:2022 Annex A 7.10 covers secure management of storage media across its full lifecycle, explicitly including acquisition, use, transportation and disposal in line with classification and handling requirements. Media destruction is one component of lifecycle management, so ISM-0363 is a subset of Annex A 7.10 with a deeper focus on the destruction/disposal procedures themselves.
This control partially overlaps A.7.14.
ISM-0363 requires media destruction processes and supporting procedures to be developed, implemented and maintained so media is securely destroyed when no longer required. ISO/IEC 27001:2022 Annex A 7.14 relates by requiring verification that sensitive data (and licensed software) is removed or securely overwritten prior to equipment disposal or re-use, which is a common output of media destruction procedures. ISM-0363 is broader in emphasising organisational process maturity (process/procedure lifecycle), while Annex A 7.14 is narrower and focused on end-of-life disposal/reuse checks for equipment.
This control partially overlaps A.8.10.
Annex A 8.10 mandates that unused information be securely deleted, while ISM-0363 requires documented procedures for media destruction, supporting Annex A 8.10 by enhancing process maturity and consistency.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.