ASD ISM 0831Ensure Proper Handling of Sensitive Media
Official control statement
Media is handled in a manner suitable for its sensitivity or classification.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Handle media carefully based on its sensitivity to keep information safe.
What this means in practice
This control is about making sure that things like USB drives, DVDs, or even printed documents are handled carefully based on how sensitive the information they contain is. This matters because if these items fall into the wrong hands, they could expose personal information, harm your business reputation, or lead to legal trouble.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2018
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Mishandling classified or sensitive media (loss, theft or improper disposal) can cause data compromise, legal breaches and reputational harm.
Operational notes
Label and track sensitive media, store in approved secure containers, control access during transport, and sanitise or destroy media per its classification.
Implementation tips
- Office managers should categorise all media based on the sensitivity of the information it contains. Do this by reviewing the type of information, such as financial or personal details, and labelling the media accordingly with clear tags like 'Confidential' or 'Public'.
- Staff responsible for media should secure sensitive items in locked cabinets or secure electronic systems. This can be done by establishing a secure storage area with access controls, ensuring only authorised personnel can access sensitive materials.
- Managers should train employees on proper media handling procedures. Offer a simple workshop on recognising sensitive information and the appropriate steps to secure it, including how to transport sensitive media safely and destroy it when no longer needed.
- IT teams should implement encryption for digital media that contains sensitive information. This means using software tools to scramble data, making it unreadable to anyone who doesn't have the correct passcode or key to unlock it.
- Human Resources should develop and enforce a media handling policy. Create a clear set of rules and guidelines covering how all employees should handle, use, and dispose of sensitive media, and ensure everyone is aware of these policies through regular reminders and updates.
Audit / evidence tips
- AskThe company policy on media handlingLook atWhether the policy outlines procedures for different levels of information sensitivity and includes specific steps for secure storage and disposalGoodIncludes detailed guidelines with clear responsibilities and actions
- GoodShows regular training sessions with comprehensive attendance
- Look atSecure storage solutions like lockable cabinets or vaults and ensure there is limited access to authorised personnel onlyGoodIs a well-documented list of who has access and how security is maintained
- Look atRecords of media audits that have been conducted. Check that the audits assessed media handling and that any identified issues have been addressedGoodIs a report detailing findings and actions taken to correct any problems
- AskA demonstration of the disposal process for sensitive media. Verify steps are taken to ensure media is correctly destroyed, like shredding papers or erasing and physically destroying digital storage devicesGoodDemonstrates understanding and proper use of destruction methods
Cross-framework mappings
How ISM-0831 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| Annex A 7.10 | ISM-0831 requires media to be handled in a manner suitable for its sensitivity or classification | |
sync_altPartially overlaps(2)expand_less | ||
| Annex A 7.7 | ISM-0831 requires media to be handled in a manner appropriate to its sensitivity or classification | |
| Annex A 8.33 | Annex A 8.33 requires test information to be selected, protected and managed to prevent exposure of sensitive data | |
extensionDepends on(2)expand_less | ||
| Annex A 5.12 | ISM-0831 requires media to be handled according to its sensitivity or classification | |
| Annex A 5.13 | ISM-0831 requires media to be handled in accordance with its sensitivity or classification to protect information | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Media
See all Guidelines for media controls, or browse the full ASD ISM library.