ASD ISM 0374 Develop and maintain media disposal procedures
What it says
Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and uphold procedures for securely disposing of media.
This control is all about making sure that any old or unneeded media-things like USB drives, DVDs, or even old hard drives-are disposed of safely and securely. If this isn't done properly, sensitive information could fall into the wrong hands, putting your organisation's reputation and finances at risk.
Free. Save your status, tasks and notes.
Why it matters
Improper media disposal can cause data breaches by exposing sensitive information from discarded devices or paper records, harming finances and reputation.
How to implement
Managers should create a media disposal policy: Start by listing all types of media your office uses.
Describe how each type should be handled when it's no longer needed, such as shredding CDs or using specialised software to erase data from hard drives.
IT staff should maintain disposal logs: Every time media is disposed of, record the date, what was disposed of, and how it was done.
Keep this log handy for audits and reviews to demonstrate compliance.
The office manager should train staff on disposal procedures: Hold a short workshop to explain the importance of media disposal and walk through the steps outlined in your policy.
Reinforce why following these steps protects the organisation.
Procurement teams should work with certified disposal services: Identify companies that specialise in secure media destruction.
Verify their credentials and ensure they comply with standards set by the Australian Cyber Security Centre (ACSC).
Regularly review and update procedures: IT managers should set a schedule, perhaps annually, to review disposal processes.
Update procedures based on new technologies or risks and communicate changes to all staff.
Keep it running
Regularly audit disposal processes and train staff so all media is securely destroyed or sanitised (e.g., shredding, degaussing, wiping) before disposal.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The organisation's media disposal policy.
Look at
The scope, the types of media covered, and specific disposal methods.
Good evidence
Policy clearly describes how to handle all media types and aligns with industry standards.
- Check 2 of 3What an auditor asks for
Good evidence
Log shows consistent records of media disposed of, with dates and responsible staff noted.
- Check 3 of 3What an auditor asks for
Ask for
Them about the disposal process and how staff are trained. They should confidently explain the procedures and importance of secure disposal.
Good evidence
Includes valid, unexpired certificates from recognised authorities.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0374 requires organisations to develop, implement and maintain procedures for securely disposing of media. Annex A 7.10 requires storage media to be managed through its full life cycle, explicitly including acquisition, use, transportation and disposal in line with classification and handling requirements. ISM-0374 aligns to the disposal component only, while Annex A 7.10 is broader by covering governance and controls across the entire media lifecycle.
This control partially overlaps A.7.14.
ISM-0374 requires organisations to develop, implement and maintain media disposal processes and supporting procedures. Annex A 7.14 specifically requires verification that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or reused, which is a key part of media disposal. Annex A 7.14 is narrower and focused on data sanitisation on equipment for disposal/reuse, whereas ISM-0374 covers end-to-end organisational procedures (e.g. roles, authorisation, chain-of-custody, approved destruction methods and service providers) for media disposal more broadly.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.