ASD ISM 0371 Ensure proper supervision of media destruction
What it says
Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff must oversee media destruction to ensure it is done correctly and completely.
To ensure confidential information doesn't fall into the wrong hands, it's crucial that whenever you destroy old or unused media like hard drives or documents, someone responsible should be there to ensure it's done properly. If not supervised, there's a risk that sensitive data might accidentally get leaked or stolen, leading to potential privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If media destruction isn't supervised through to completion, media may be removed or destruction may fail, exposing sensitive data and causing loss.
How to implement
The office manager should designate a responsible staff member to oversee media destruction.
This person should be trained to understand the importance of securely destroying media and follow a clear checklist for the destruction process.
The IT team should schedule regular media destruction days and notify the responsible staff member.
They should prepare the media to be destroyed and ensure appropriate tools and services are available during the process.
The procurement officer should engage a certified secure destruction service provider if needed.
Ensure that the provider is reputable and their methods are compliant with all relevant standards and regulations.
The responsible staff member should physically witness the destruction of media.
Whether done internally or by a service provider, they should verify that all media is completely destroyed without leaving any traceable data.
The manager should document every destruction event, including the date, type of media destroyed, method used, and the supervising staff member.
This record should be securely stored for future reference or audits.
Keep it running
Ensure a supervisor maintains custody from handling to final destruction, witnesses completion, and records date, method, serial/asset ID, and witness.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media destruction log: Request to see the record that documents each destruction event.
Look at
Dates, the type of media destroyed, and the name of the supervising staff member.
Good evidence
Clear records showing complete and supervised destruction events.
- Check 2 of 5What an auditor asks for
Ask for
Them about their understanding of the destruction process and their role in supervising it.
Good evidence
Is a clear explanation of procedures and why supervision is important.
- Check 3 of 5What an auditor asks for
Look at
Whether the process follows documented procedures and if the supervisor is present.
Good evidence
Is a structured process with active supervision from start to finish.
- Check 4 of 5What an auditor asks for
Ask for
Any certificates or documentation from the destruction service provider.
Look at
The compliance with standards and methods used.
Good evidence
Up-to-date certifications proving secure and proper destruction methods.
- Check 5 of 5What an auditor asks for
Look at
Current and relevant training records.
Good evidence
Is updated records showing the staff are adequately trained to oversee destructions.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0371 requires organisations to supervise media destruction end-to-end, ensuring the media is controlled to the point of destruction and that destruction is successful. Annex A 7.10 relates by requiring storage media to be managed across its full lifecycle, including acquisition, use, transport and disposal, in line with classification and handling requirements. ISM-0371 is a specific control within the broader media lifecycle management expectations of Annex A 7.10, focusing specifically on supervision during destruction/disposal.
This control partially overlaps A.7.14.
ISM-0371 requires personnel to supervise the handling of media through to destruction and verify that destruction is completed successfully. Annex A 7.14 relates by requiring verification that sensitive data (and licensed software) is removed or securely overwritten before equipment is disposed of or re-used, which commonly includes destruction or sanitisation steps. The ISO control focuses on the technical/verification outcome for disposal or re-use, whereas ISM-0371 focuses on human supervision and chain-of-handling assurance during destruction activities.
This control partially overlaps A.8.10.
ISM-0371 requires supervised handling of media up to the point of destruction and confirmation that destruction completes successfully. Annex A 8.10 relates because it requires secure deletion of information from systems/devices/media when no longer needed, which can be implemented via destruction or sanitisation. Annex A 8.10 is broader about deletion triggers and scope (information lifecycle), while ISM-0371 is narrower and procedural, targeting supervision of physical/media destruction execution.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.