ASD ISM 0368 Ensuring media particles are no larger than 9 mm
What it says
Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDestroy media so resulting particles are no bigger than 9 mm to prevent data recovery.
This control is about making sure that any physical media like CDs, hard drives, or USB sticks are broken down into pieces no larger than 9 millimetres. This is important because if the pieces are bigger, someone might be able to recover the data that was on them, which could lead to private information being exposed.
Free. Save your status, tasks and notes.
Why it matters
If media destruction particles exceed 9 mm, data recovery becomes possible, risking confidential information exposure and potential breaches.
How to implement
The office manager should ensure all outdated media is collected and stored securely until destruction.
Use locked storage cabinets in a secure room to prevent unauthorised access until the media can be properly destroyed.
The procurement officer needs to hire a reliable service that uses a hammer mill, disintegrator, or grinder to destroy media.
Check that the service provider is certified and guarantees particle sizes no larger than 9mm.
IT staff should conduct an internal destruction process using appropriate tools if external services aren't used.
Follow manufacturer instructions for shredder settings and safety procedures to achieve the correct particle size.
The compliance officer should update records to specify destruction methods and compliance with the particle size requirement.
Maintain a log of destruction dates, methods used, and names of personnel responsible.
The security officer should educate all staff about the importance of this control.
Hold a short training session explaining how small particles make it almost impossible to recover data and why that's critical for privacy protection.
Keep it running
Regularly verify hammer mill/disintegrator/grinder or cutting settings so output particles are ≤9 mm; sample and measure waste periodically, and record results.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The destruction log: Request the documentation outlining dates, methods, and personnel responsible for media destruction.
Look at
Records showing particle size compliance.
Good evidence
Includes logs with specific destruction dates, methods, and particle size confirmation.
- Check 2 of 5What an auditor asks for
Ask for
Them to describe the destruction process and tool settings.
Good evidence
Includes correctly naming the tools used and describing how they ensure compliance with particle size.
- Check 3 of 5What an auditor asks for
Good evidence
Sign is consistent use of specified destruction tools and immediate verification of particle size post-destruction.
- Check 4 of 5What an auditor asks for
Ask for
To see the contract or agreement with an external destruction service.
Look at
The details ensuring compliance with particle size and frequency of service.
Good evidence
Agreement specifies 9mm compliance and regular service intervals.
- Check 5 of 5What an auditor asks for
Good evidence
Set includes clear, understandable reasons and instructions about the destruction process.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0368 requires media destruction to a defined particle size (≤9 mm) as an anti-recovery measure. This directly supports Annex A 7.10, which requires storage media to be securely managed across its lifecycle including disposal in line with handling requirements. Annex A 7.10 is broader across acquisition, transport and disposal methods, whereas ISM-0368 specifies one measurable destruction outcome for disposal/destruction.
This control partially meets A.7.14.
ISM-0368 requires physical destruction of media such that waste particles are no larger than 9 mm to prevent data recovery. This relates to Annex A 7.14 because secure disposal/re-use of equipment includes ensuring storage media is sanitised so sensitive data cannot be recovered. Annex A 7.14 is broader (it allows secure overwrite/verification and covers re-use as well as disposal), while ISM-0368 is a specific physical destruction criterion.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.