ASD ISM 0370 Supervise media destruction with cleared personnel
What it says
The destruction of media is performed under the supervision of at least one cleared person.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure destroyed media is supervised by a qualified person for security purposes.
This control ensures that when you destroy media, like old computers or hard drives, it is done under the watchful eye of someone who is trusted and has been cleared for security purposes. This is important because if disposal is not handled properly, sensitive information might end up in the wrong hands, leading to data breaches or misuse that could damage your reputation and bottom line.
Free. Save your status, tasks and notes.
Why it matters
If media destruction isn't supervised by a cleared person, data may not be fully destroyed, enabling recovery and unauthorised disclosure.
How to implement
Assign a responsible manager: A manager should designate a trusted and security-cleared staff member to oversee media destruction activities.
This person must be aware of the types of sensitive data stored and the risks involved in mishandling.
Brief the supervision process: The designated person should be briefed about what to look for during the destruction process, ensuring that the media is completely destroyed and unrecognisable.
Use a checklist or guide that covers all necessary steps.
Organise a dedicated destruction area: Arrange for a specific, secure place where media destruction takes place.
It should be out of public view and have appropriate tools and equipment available to fully destroy the media.
Record the destruction process: The supervisor should log each destruction session, noting down what was destroyed, when, and how it was supervised.
This record should be signed off by the supervisor to confirm compliance.
Review the procedure regularly: The assigned manager should periodically review the media destruction process, ensuring it aligns with current security policies and that the supervising staff maintain their clearance status.
Keep it running
Have at least one cleared person supervise each destruction event and record date, media IDs, method used, and sign-off confirming completion.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media destruction log: Request to see the records that show which media items were destroyed, who supervised the process, and when it happened.
Look at
Details such as dates, names of cleared personnel, and methods used.
Good evidence
Will be a complete and timely log confirming supervision by a cleared person.
- Check 2 of 5What an auditor asks for
Ask for
Them to explain the steps they follow when overseeing media destruction, and what actions they take to ensure complete destruction.
Good evidence
Would include a procedure for verifying total data destruction and understanding of security risks involved.
- Check 3 of 5What an auditor asks for
Look at
Adherence to procedures and correct use of destruction equipment.
Good evidence
Example would be all media being rendered unreadable and unrecognisable.
- Check 4 of 5What an auditor asks for
Look at
Current clearance documentation.
Good evidence
Will show that clearances are up-to-date and at an appropriate level for the media being disposed of.
- Check 5 of 5What an auditor asks for
Ask for
The written policy regarding media destruction and look for sections detailing supervision requirements and personnel responsibilities.
Good evidence
Will describe a clear process with assigned roles and accountability measures.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0370 requires media destruction to be carried out under the supervision of at least one cleared person. This is a specific handling requirement for the disposal stage of the media life cycle that Annex A 7.10 requires to be managed in line with the organisation's classification scheme and handling requirements. Annex A 7.10 also covers acquisition, use and transportation of media, which ISM-0370 does not address.
This control supports A.7.14.
ISM-0370 requires media destruction to be supervised by at least one cleared person. Supervision by a cleared person provides assurance that media holding sensitive data is actually destroyed, which supports the Annex A 7.14 requirement to verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use. Annex A 7.14 focuses on verification of data removal across equipment, while ISM-0370 addresses only who must oversee destruction.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.