ASD ISM 0835 TOP SECRET volatile media retains classification after sanitisation
What it says
Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended period, or had data repeatedly stored on or written to the same memory location for an extended period.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVolatile media (memory that normally loses its contents when power is removed, such as RAM modules) used to store TOP SECRET information does NOT automatically lose its classification just because it has been sanitised (cleared or wiped). Under this control, the media keeps its TOP SECRET classification after sanitisation in two specific situations: (1) it held the same static (unchanging) data for an extended period; or (2) it had data repeatedly stored at, or written to, the same memory location for an extended period. In both cases the prolonged exposure can leave a faint physical imprint of the data in the memory cells, a phenomenon known as data remanence or "burn-in", which sanitisation cannot reliably remove. Because the classification is retained, the media must continue to be handled, protected, stored, and eventually destroyed as TOP SECRET material rather than being reused at a lower level or released.
Volatile media is memory that is meant to forget its contents once power is switched off, like the RAM (Random Access Memory) modules inside a computer. You might assume that wiping such memory makes it safe to reuse. This control says that is not always true for TOP SECRET systems. If the memory held the same unchanging information for a long time, or had the same data written over and over to the same spot for a long time, a faint physical "ghost" of that information can stick in the chip. This lingering imprint is called data remanence (sometimes "burn-in"). Cleaning the device cannot be trusted to erase it. So in those two situations the memory stays classified as TOP SECRET even after it has been sanitised. It must keep being treated as TOP SECRET, which means it cannot simply be reused on a lower-sensitivity system, sold, or thrown out as ordinary equipment. Instead it must be physically destroyed using an approved method for TOP SECRET media. The point is to stop highly sensitive information from leaking out through hardware that everyone assumed was already clean.
Free. Save your status, tasks and notes.
Why it matters
If sanitised TOP SECRET volatile media that retains its classification is reused or disposed of as clean, residual imprinted data could leak and harm national security.
How to implement
IT and system owners should keep an inventory of every piece of volatile media (such as RAM modules) used in TOP SECRET systems, recording how long it has been in service and whether it held static data or repeatedly wrote to the same memory locations.
When a TOP SECRET system is decommissioned, IT staff must flag any volatile media that meets either condition (extended static storage, or extended repeated writes to the same location) and mark it as retaining its TOP SECRET classification rather than clearing it for reuse.
Security officers should write a procedure that routes retained-classification volatile media straight to approved physical destruction for TOP SECRET media, instead of sanitise-and-reuse, and document the chain of custody until destruction is verified.
System owners must ensure media flagged as retaining classification continues to be stored, transported, and access-controlled at the TOP SECRET level until it is destroyed, so it is never downgraded or released by mistake.
Procurement and asset managers should track volatile media through its whole lifecycle from purchase to destruction, so no retained-classification device is accidentally redeployed, donated, or sent to general e-waste.
Keep it running
Treat extended static storage and extended repeated same-location writes as classification-retaining triggers; route flagged volatile media to approved TOP SECRET destruction, never reuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
How do you decide whether sanitised TOP SECRET volatile media keeps its classification?
Look at
For a documented rule that captures both triggers, extended static data storage and extended repeated writes to the same memory location. GOOD-ANSWER: A written procedure that names both conditions and treats matching media as retaining TOP SECRET classification.
- Check 2 of 5What an auditor asks for
Ask for
Can you show the inventory of volatile media used in TOP SECRET systems?
Look at
For records of service duration and data-usage patterns per device. GOOD-ANSWER: An up-to-date register listing each module, how long it ran, and whether static-storage or repeated-write conditions applied.
- Check 3 of 5What an auditor asks for
Ask for
What happens to volatile media that retains its TOP SECRET classification after sanitisation?
Look at
For evidence it is sent to approved physical destruction, not reused or downgraded. GOOD-ANSWER: Destruction records and chain-of-custody logs showing retained-classification media was destroyed as TOP SECRET.
- Check 4 of 5What an auditor asks for
Ask for
How is retained-classification media protected before it is destroyed?
Look at
For TOP SECRET-level storage, transport, and access controls applied to flagged media. GOOD-ANSWER: Custody logs showing flagged media stayed under TOP SECRET handling the whole time.
- Check 5 of 5What an auditor asks for
Ask for
How do you make sure no retained-classification module is accidentally reused or disposed of as ordinary equipment?
Look at
For lifecycle tracking from purchase to destruction. GOOD-ANSWER: Asset records that follow each device end-to-end with disposal controls preventing downgrade or release.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.7.10.
ISM-0835 addresses the requirement that sanitised TOP SECRET volatile media can still be treated as TOP SECRET based on storage duration and write-pattern persistence risk. ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed through its life cycle in accordance with the organisation's classification scheme and handling requirements, which includes decisions about how media is classified and handled after sanitisation. ISM-0835 is a specific rule for one media type and classification edge case, while Annex A 7.10 is a general life-cycle media management control.
This control partially overlaps A.7.14.
ISM-0835 requires that, even after sanitisation, TOP SECRET volatile media may retain its TOP SECRET classification where data persistence risk remains due to long duration or repeated writes to the same locations. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data is removed/securely overwritten before equipment disposal or re-use, which aligns with the underlying concern that sanitisation may not fully eliminate recoverable information. ISM-0835 is more specific about residual classification decisions for volatile media at TOP SECRET, whereas Annex A 7.14 is broader and focused on disposal/re-use handling rather than classification retention outcomes.
This control depends on A.5.12.
ISM-0835 specifies a concrete classification handling outcome: sanitised TOP SECRET volatile media may still retain TOP SECRET classification when data remanence is plausible due to extended or repeated storage patterns. ISO/IEC 27001:2022 Annex A 5.12 requires an organisation-wide information classification policy and practices, which provides the governance mechanism to define and apply rules like ISM-0835 consistently. Annex A 5.12 is broader and policy-focused, while ISM-0835 is an implementation-specific classification retention rule for a particular scenario.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.