ASD ISM 0371Ensure Proper Supervision of Media Destruction
Official control statement
Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Staff must oversee media destruction to ensure it is done correctly and completely.
What this means in practice
To ensure confidential information doesn't fall into the wrong hands, it's crucial that whenever you destroy old or unused media like hard drives or documents, someone responsible should be there to ensure it's done properly. If not supervised, there's a risk that sensitive data might accidentally get leaked or stolen, leading to potential privacy breaches or financial loss.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2021
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
If media destruction isn't supervised through to completion, media may be removed or destruction may fail, exposing sensitive data and causing loss.
Operational notes
Ensure a supervisor maintains custody from handling to final destruction, witnesses completion, and records date, method, serial/asset ID, and witness.
Implementation tips
- The office manager should designate a responsible staff member to oversee media destruction. This person should be trained to understand the importance of securely destroying media and follow a clear checklist for the destruction process.
- The IT team should schedule regular media destruction days and notify the responsible staff member. They should prepare the media to be destroyed and ensure appropriate tools and services are available during the process.
- The procurement officer should engage a certified secure destruction service provider if needed. Ensure that the provider is reputable and their methods are compliant with all relevant standards and regulations.
- The responsible staff member should physically witness the destruction of media. Whether done internally or by a service provider, they should verify that all media is completely destroyed without leaving any traceable data.
- The manager should document every destruction event, including the date, type of media destroyed, method used, and the supervising staff member. This record should be securely stored for future reference or audits.
Audit / evidence tips
- AskThe media destruction log: Request to see the record that documents each destruction eventLook atDates, the type of media destroyed, and the name of the supervising staff memberGoodClear records showing complete and supervised destruction events
- AskThem about their understanding of the destruction process and their role in supervising itGoodIs a clear explanation of procedures and why supervision is important
- Look atWhether the process follows documented procedures and if the supervisor is presentGoodIs a structured process with active supervision from start to finish
- AskAny certificates or documentation from the destruction service providerLook atThe compliance with standards and methods usedGoodUp-to-date certifications proving secure and proper destruction methods
- Look atCurrent and relevant training recordsGoodIs updated records showing the staff are adequately trained to oversee destructions
Cross-framework mappings
How ISM-0371 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 7.10 | ISM-0371 requires organisations to supervise media destruction end-to-end, ensuring the media is controlled to the point of destruction a... | |
sync_altPartially overlaps(2)expand_less | ||
| Annex A 7.14 | ISM-0371 requires personnel to supervise the handling of media through to destruction and verify that destruction is completed successfully | |
| Annex A 8.10 | ISM-0371 requires supervised handling of media up to the point of destruction and confirmation that destruction completes successfully | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Media
See all Guidelines for media controls, or browse the full ASD ISM library.