ASD ISM 0375 Decide on public release of data storage media
What it says
Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAfter data is erased or destroyed, a formal decision allows media to be sent to the public.
When you delete or destroy data stored on media like hard drives or USB sticks, you need to make a formal decision about whether it's safe to let those items go into the public. This matters because if data isn't completely erased or destroyed, someone could retrieve sensitive information, leading to potential privacy breaches or data theft.
Free. Save your status, tasks and notes.
Why it matters
Without a documented administrative decision to release sanitised/destroyed media (or waste) to the public domain, residual data may be exposed, causing privacy breaches and theft.
How to implement
Managers should establish a policy for data disposal: Clearly outline when and how data storage media can be released to the public after sanitisation.
This could be a simple rule book that everyone in the organisation follows.
IT staff should perform data erasure verification: Before releasing any data storage media, IT should use software tools to confirm that data has been fully erased.
Conduct tests to ensure there are no data remnants left.
System owners should document the sanitisation process: Keep records of what data was on the device, how it was erased or destroyed, and the date and person responsible for the action.
Use a standardised template for consistency.
Security officers should review disposal decisions: They should verify that any release of storage media doesn't inadvertently expose sensitive data.
This involves checking that the media was correctly classified and sanctioned for public release.
Procurement leaders should ensure secure disposal contracts: Contracts with recycling or disposal vendors should include requirements for ensuring data erasure and verification.
Confirm that the vendors have adequate certifications and processes in place.
Keep it running
Record a formal, authorised release decision (including scope: media vs waste) after confirming sanitisation/destruction and declassification results; retain approvals and evidence before public disposal.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
Copies of disposal policies and procedures.
Look at
The documents that outline how media disposal decisions are made and who is responsible.
Good evidence
Policy will clearly define the sanitisation process and have formal approval from senior management.
- Check 2 of 4What an auditor asks for
Look at
Logs or reports from the erasure tools showing data has been wiped.
Good evidence
Includes clear documentation of successful data erasure with dates and responsible persons noted.
- Check 3 of 4What an auditor asks for
Ask for
Them to describe the steps they take to ensure all data is removed before media is released.
Good evidence
Is a clear understanding of the erasure process and the tools used.
- Check 4 of 4What an auditor asks for
Ask for
Contracts with disposal vendors.
Look at
Clauses that mandate secure data erasure and certifications.
Good evidence
Contract outlines vendor responsibilities, including providing proof of data destruction.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0375 requires a formal administrative decision to release storage media or its waste into the public domain following sanitisation, destruction or declassification. Annex A 7.10 requires storage media to be managed across its full lifecycle (acquisition to disposal) in line with classification and handling requirements, which encompasses disposal and release controls. ISM-0375 is a specific governance gate within the broader lifecycle management requirement in Annex A 7.10.
This control partially overlaps A.7.14.
ISM-0375 requires that after sanitisation, destruction or declassification, an authorised administrative decision is formally made before releasing storage media (or its waste) into the public domain. Annex A 7.14 requires verification that sensitive data and licensed software have been removed or securely overwritten prior to equipment disposal or re-use, which is a key precondition to safe public release. The ISO control focuses on technical/verification steps before disposal or re-use, whereas ISM-0375 focuses on governance and authorisation to release media/waste to the public after those steps are completed.
This control partially overlaps A.8.10.
ISM-0375 requires an authorised administrative decision before media (or its waste) can be released publicly after sanitisation, destruction or declassification. Annex A 8.10 requires information to be securely deleted when no longer needed, which is one of the actions that may occur before any disposal or release decision. Annex A 8.10 addresses the deletion requirement itself, while ISM-0375 adds the post-treatment governance step specifically for public release of the media/waste.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.