ASD ISM 0831 Ensure proper handling of sensitive media
What it says
Media is handled in a manner suitable for its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishHandle media carefully based on its sensitivity to keep information safe.
This control is about making sure that things like USB drives, DVDs, or even printed documents are handled carefully based on how sensitive the information they contain is. This matters because if these items fall into the wrong hands, they could expose personal information, harm your business reputation, or lead to legal trouble.
Free. Save your status, tasks and notes.
Why it matters
Mishandling classified or sensitive media (loss, theft or improper disposal) can cause data compromise, legal breaches and reputational harm.
How to implement
Office managers should categorise all media based on the sensitivity of the information it contains.
Do this by reviewing the type of information, such as financial or personal details, and labelling the media accordingly with clear tags like 'Confidential' or 'Public'.
Staff responsible for media should secure sensitive items in locked cabinets or secure electronic systems.
This can be done by establishing a secure storage area with access controls, ensuring only authorised personnel can access sensitive materials.
Managers should train employees on proper media handling procedures.
Offer a simple workshop on recognising sensitive information and the appropriate steps to secure it, including how to transport sensitive media safely and destroy it when no longer needed.
IT teams should implement encryption for digital media that contains sensitive information.
This means using software tools to scramble data, making it unreadable to anyone who doesn't have the correct passcode or key to unlock it.
Human Resources should develop and enforce a media handling policy.
Create a clear set of rules and guidelines covering how all employees should handle, use, and dispose of sensitive media, and ensure everyone is aware of these policies through regular reminders and updates.
Keep it running
Label and track sensitive media, store in approved secure containers, control access during transport, and sanitise or destroy media per its classification.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The company policy on media handling.
Look at
Whether the policy outlines procedures for different levels of information sensitivity and includes specific steps for secure storage and disposal.
Good evidence
Includes detailed guidelines with clear responsibilities and actions.
- Check 2 of 5What an auditor asks for
Good evidence
Shows regular training sessions with comprehensive attendance.
- Check 3 of 5What an auditor asks for
Look at
Secure storage solutions like lockable cabinets or vaults and ensure there is limited access to authorised personnel only.
Good evidence
Is a well-documented list of who has access and how security is maintained.
- Check 4 of 5What an auditor asks for
Look at
Records of media audits that have been conducted. Check that the audits assessed media handling and that any identified issues have been addressed.
Good evidence
Is a report detailing findings and actions taken to correct any problems.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of the disposal process for sensitive media. Verify steps are taken to ensure media is correctly destroyed, like shredding papers or erasing and physically destroying digital storage devices.
Good evidence
Demonstrates understanding and proper use of destruction methods.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which asks for the same thing.
ISO/IEC 27001: 5 mappings
This control is equivalent to A.7.10.
ISM-0831 requires media to be handled in a manner suitable for its sensitivity or classification. Annex A 7.10 similarly requires storage media to be managed across its life cycle (acquisition, use, transport and disposal) in accordance with classification and handling requirements. Both controls directly address classification-driven handling expectations for media, with Annex A 7.10 making the life-cycle stages explicit while ISM-0831 states the overarching requirement.
This control partially overlaps A.7.7.
ISM-0831 requires media to be handled in a manner appropriate to its sensitivity or classification. Annex A 7.7 overlaps by requiring clear desk and clear screen rules for papers and removable storage media, which is one concrete way to prevent exposure or loss of sensitive media. Annex A 7.7 is narrower and environment/behaviour specific (work areas and screens), while ISM-0831 covers broader handling expectations for media in general (e.g. transport, custody, and storage consistent with classification).
This control partially overlaps A.8.33.
Annex A 8.33 requires test information to be selected, protected and managed to prevent exposure of sensitive data. ISM-0831 requires media handling suited to sensitivity, applicable to test data on media. ISM-0831 generally covers media, while Annex A 8.33 focuses on test information lifecycle management.
This control depends on A.5.12.
ISM-0831 requires media to be handled according to its sensitivity or classification. Annex A 5.12 establishes the classification policy and practices that determine what those sensitivity/classification levels are and how they should be applied. Without a defined classification scheme from Annex A 5.12, implementing ISM-0831 consistently is difficult because the organisation lacks the basis for deciding appropriate handling requirements.
This control depends on A.5.13.
ISM-0831 requires media to be handled in accordance with its sensitivity or classification to protect information. Annex A 5.13 supports this by requiring information labelling procedures aligned to the classification scheme, which helps personnel recognise the classification of media and apply the correct handling. ISM-0831 is focused on the handling behaviour, whereas Annex A 5.13 is focused on making classification visible and actionable via labels.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.