ASD ISM 0378 Remove labels from media before disposal
What it says
Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove all identifying labels from media before throwing it away to ensure no information can be traced back.
Removing labels from media, like printed documents or disks, before you throw them away is crucial to protect your privacy and security. If you leave identifying information on them, someone might be able to trace them back to you or your organisation, potentially exposing sensitive details or causing harm.
Free. Save your status, tasks and notes.
Why it matters
If labels or markings remain on disposed media, they can link devices to owners or classifications, enabling targeted attacks, information leakage and reputational harm.
How to implement
Office staff should collect all media that needs disposal and check for any labels or markings.
Carefully peel off any visible stickers or marks, using suitable tools like adhesive removers if necessary, to ensure all identifying information is removed.
Managers should create and enforce a media disposal policy that requires removing labels.
Clearly outline the procedures and ensure all staff are trained on why this is important and how to properly remove labels before disposal.
The IT team should regularly audit storage areas for old media awaiting disposal.
They should monitor compliance with the label removal policy and provide reports back to managers highlighting any areas that need attention.
Procurement staff should purchase media with consideration for easy label removal, perhaps choosing media with non-adhesive labels or recyclable media where practical.
This makes the disposal process more efficient and less prone to errors.
The security team should run periodic training sessions or workshops focused on safe disposal practices.
Demonstrate effective techniques for removing labels and emphasise real-world consequences of failing to follow the procedure.
Keep it running
Before disposal, require staff to remove/obliterate all labels and markings (owner, classification, asset tags). Use a checklist and spot checks to confirm removal.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A copy of the media disposal policy.
Look at
The procedures outlined for removing identifying labels and how staff are instructed to comply.
Good evidence
Provides a clear, written procedure detailing steps for label removal.
- Check 2 of 5What an auditor asks for
Ask for
Them how they ensure labels are removed from media.
Good evidence
Is staff can describe the specific steps they take and understand the importance of this practice.
- Check 3 of 5What an auditor asks for
Good evidence
Process shows labels being carefully checked and removed before any media goes into waste bins.
- Check 4 of 5What an auditor asks for
Ask for
A report from a recent media audit: Evaluate if the audit includes checks on label removal compliance.
Good evidence
Report will include sections on how often label removal is not followed and any corrective actions taken.
- Check 5 of 5What an auditor asks for
Look at
Documentation on staff training about media label removal.
Good evidence
Outcome shows regular training sessions have been conducted and provides evidence of staff attendance.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-0378 requires organisations to remove identifying labels and markings from media prior to disposal to prevent traceability and inadvertent disclosure. ISO/IEC 27001:2022 Annex A 7.10 requires secure management of storage media across its full lifecycle, including acquisition, handling, transport and disposal, aligned to classification and handling rules. ISM-0378 is a specific disposal control that fits within the broader media lifecycle governance required by Annex A 7.10.
This control partially overlaps A.5.13.
Annex A 5.13 requires organisations to develop and implement procedures for information labelling aligned to an information classification scheme. ISM-0378 relates by addressing the lifecycle handling of those labels-requiring labels/markings that reveal owner or sensitivity to be removed from media before disposal. ISM-0378 is narrower and disposal-focused, whereas Annex A 5.13 is broader and covers how labels are defined and applied across information handling.
This control partially overlaps A.7.14.
ISM-0378 requires removal of labels/markings from media before disposal so the media cannot be linked to an owner, classification, or prior sensitive use. ISO/IEC 27001:2022 Annex A 7.14 requires verifying that sensitive data (and licensed software) has been removed or securely overwritten before equipment disposal or re-use, addressing residual information on the media itself. Both address secure end-of-life handling, but ISM-0378 targets external identifiers on the media, whereas Annex A 7.14 targets the data content remaining on the storage media.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.