ASD ISM 0372 Supervision of media destruction procedures
What it says
The destruction of media storing accountable material is performed under the supervision of at least two cleared personnel.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia destruction must be overseen by at least two security-cleared staff members.
This control ensures that any time you destroy media (like hard drives, USB sticks, or old computers) that has important or sensitive information on it, at least two trusted employees have to watch over the process. This is important because if media ends up in the wrong hands, it could lead to your sensitive information being accessed or misused, potentially harming your business's reputation and finances.
Free. Save your status, tasks and notes.
Why it matters
Without two cleared staff supervising destruction of accountable media, material may be removed or not destroyed, causing unauthorised disclosure and breach reporting.
How to implement
Managers should establish a protocol for media destruction, assigning at least two security-cleared staff members to oversee the process.
Start by choosing trustworthy employees with security clearance and train them on the destruction procedure to ensure they know what to do and why it matters.
The IT team should create a list of all media that needs destroying and organise regular destruction sessions.
They can do this by maintaining an inventory of outdated or obsolete media and scheduling monthly or quarterly sessions to manage it securely and efficiently.
HR managers should ensure all staff involved in the destruction process have the necessary security clearance.
This can be done by regularly reviewing staff clearances and updating them as needed, ensuring compliance with organisational security policies.
The office manager should set up a secure area for the destruction process that can be easily monitored.
This might involve setting aside a locked room where media can be destroyed using shredding tools or devices, with access limited to authorised personnel.
Compliance officers should document the destruction process by preparing a report that includes the date, time, and personnel involved.
They can use a simple form for staff to fill out during each session, logging details like types of media destroyed and who was present, to maintain an audit trail.
Keep it running
Before destruction, confirm two cleared personnel are present and record their names/time; stop the process if either leaves until supervision is restored.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documented media destruction procedures: Request a written protocol that outlines how media destruction is handled.
Look at
Clear steps indicating at least two security-cleared personnel are involved.
Good evidence
Includes detailed roles and procedures ensuring compliance with the control.
- Check 2 of 5What an auditor asks for
Look at
How the process is conducted, ensuring two cleared staff are present and following the procedure.
Good evidence
Session involves staff following documented steps and securely handling media throughout the process.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the destruction steps and why two people are needed. Listen for clear, confident explanations that follow established protocols.
Good evidence
Demonstrate understanding of security risks and adherence to procedures.
- Check 4 of 5What an auditor asks for
Ask for
To see past destruction logs and reports: Request documentation showing past sessions and involved personnel.
Look at
Recorded details like dates and staff signatures to verify protocol compliance. Good records include complete information that matches the procedure and confirms proper oversight.
- Check 5 of 5What an auditor asks for
Look at
Recent and valid clearance endorsements or certificates. Good records show that all current staff have the necessary clearances and are familiar with destruction procedures.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0372 requires the destruction of media storing accountable material to be supervised by at least two cleared personnel. This is a specific, heightened handling requirement for the disposal stage of the media life cycle that Annex A 7.10 requires to follow the organisation's classification scheme and handling requirements. Annex A 7.10 also covers acquisition, use and transportation of all storage media.
This control supports A.7.14.
ISM-0372 requires the destruction of media storing accountable material to be supervised by at least two cleared personnel. Dual supervision gives assurance that the media and its sensitive contents are actually destroyed, supporting the Annex A 7.14 requirement to verify sensitive data is removed or securely overwritten before disposal or re-use. Annex A 7.14 covers verification across all equipment containing storage media, while ISM-0372 addresses only oversight of destruction for accountable material.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.