Remove Labels from Media Before Disposal
Remove all identifying labels from media before throwing it away to ensure no information can be traced back.
Plain language
Removing labels from media, like printed documents or disks, before you throw them away is crucial to protect your privacy and security. If you leave identifying information on them, someone might be able to trace them back to you or your organisation, potentially exposing sensitive details or causing harm.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Nov 2021
Control Stack last updated
18 May 2026
E8 maturity levels
N/A
Official control statement
Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal.
Why it matters
If labels or markings remain on disposed media, they can link devices to owners or classifications, enabling targeted attacks, information leakage and reputational harm.
Operational notes
Before disposal, require staff to remove/obliterate all labels and markings (owner, classification, asset tags). Use a checklist and spot checks to confirm removal.
Implementation tips
- Office staff should collect all media that needs disposal and check for any labels or markings. Carefully peel off any visible stickers or marks, using suitable tools like adhesive removers if necessary, to ensure all identifying information is removed.
- Managers should create and enforce a media disposal policy that requires removing labels. Clearly outline the procedures and ensure all staff are trained on why this is important and how to properly remove labels before disposal.
- The IT team should regularly audit storage areas for old media awaiting disposal. They should monitor compliance with the label removal policy and provide reports back to managers highlighting any areas that need attention.
- Procurement staff should purchase media with consideration for easy label removal, perhaps choosing media with non-adhesive labels or recyclable media where practical. This makes the disposal process more efficient and less prone to errors.
- The security team should run periodic training sessions or workshops focused on safe disposal practices. Demonstrate effective techniques for removing labels and emphasise real-world consequences of failing to follow the procedure.
Audit / evidence tips
- AskA copy of the media disposal policy GoodProvides a clear, written procedure detailing steps for label removal
- AskThem how they ensure labels are removed from media GoodIs staff can describe the specific steps they take and understand the importance of this practice
- GoodProcess shows labels being carefully checked and removed before any media goes into waste bins
- AskA report from a recent media audit: Evaluate if the audit includes checks on label removal compliance GoodReport will include sections on how often label removal is not followed and any corrective actions taken
- GoodOutcome shows regular training sessions have been conducted and provides evidence of staff attendance
Cross-framework mappings
How ISM-0378 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
| layers Partially meets (1) expand_less | ||
| Annex A 7.10 | ISM-0378 requires organisations to remove identifying labels and markings from media prior to disposal to prevent traceability and inadve... | |
| sync_alt Partially overlaps (2) expand_less | ||
| Annex A 5.13 | Annex A 5.13 requires organisations to develop and implement procedures for information labelling aligned to an information classificatio... | |
| Annex A 7.14 | ISM-0378 requires removal of labels/markings from media before disposal so the media cannot be linked to an owner, classification, or pri... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.