ASD ISM 0839 Prohibit outsourcing of media destruction
What it says
The destruction of media storing accountable material is not outsourced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not allow external companies to destroy media with sensitive data.
This control means you shouldn't allow outside businesses to destroy old equipment or data storage like hard drives that contain sensitive information. It's important because if this data gets into the wrong hands, it could lead to identity theft, financial loss, or damage to your business reputation.
Free. Save your status, tasks and notes.
Why it matters
Outsourcing media destruction can lead to leaks of sensitive data, resulting in identity theft, financial loss, or reputational damage.
How to implement
Managers should ensure their staff understand the importance of keeping sensitive information protected by not outsourcing its destruction.
Conduct training sessions explaining how mishandled data can lead to breaches. Make sure everyone is aware of the policies regarding data handling.
The IT team should develop and implement a secure media destruction process internally.
Identify all types of media that contain sensitive data and set up a secure method for destroying them, such as shredding or degaussing in a controlled environment.
Office managers should regularly audit their media destruction practices.
Conduct spot checks to ensure that only authorised personnel are involved in the media destruction process and that it takes place in-house.
Procurement should vet any third-party services involved in handling equipment disposal without data destruction.
Ensure contracts clearly specify that the third party will not be responsible for destroying any data storage devices.
The security officer should oversee the development of a clear policy on media destruction.
Draft a policy document outlining the steps and tools used for in-house destruction and ensure it's easily accessible to all staff members for reference.
Keep it running
Do not outsource destruction of media holding accountable material; perform it in-house with authorised staff, logging serials, chain-of-custody and destruction outcomes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Records of any media destruction activities: Request documentation showing details about destroyed media, including dates and methods used.
Look at
Entries showing all processes are handled internally without any third-party involvement.
Good evidence
Is a comprehensive log showing dates, responsible personnel, and methods used.
- Check 2 of 5What an auditor asks for
Ask for
To see internal training materials: Request to view the training materials used to educate staff on data protection and media destruction.
Look at
The content to ensure it comprehensively covers risks and internal procedures.
Good evidence
Includes detailed guides and attendance records from training sessions.
- Check 3 of 5What an auditor asks for
Ask for
Policy documents on media destruction: Request to view the formal policy document governing internal media destruction processes.
Look at
Clear guidelines outlining what media can be destroyed, by whom, and how.
Good evidence
Is a policy that is up-to-date, comprehensive, and easily understood.
- Check 4 of 5What an auditor asks for
Ask for
Internal audits or reports on media handling: Request any reports on assessments of media destruction processes.
Look at
Evidence of regular internal checks of compliance with in-house processes.
Good evidence
Includes documented assessments with findings and improvement actions.
- Check 5 of 5What an auditor asks for
Ask for
Staff sign-off sheets: Request sheets signed by staff acknowledging their understanding of the internal media destruction process.
Look at
Dates, signatures, and clear evidence that staff are informed about policy changes.
Good evidence
Is records showing regular sign-offs from employees involved in media handling.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0839 requires that destruction of media storing accountable material is not outsourced, keeping media destruction under the organisation's direct control. Annex A 7.10 requires secure life-cycle management of storage media, including disposal, in line with classification and handling requirements, which can include controls over who performs destruction. Annex A 7.10 is broader because it covers acquisition, use, transport and disposal, while ISM-0839 is a specific prohibition focused only on outsourcing the destruction step.
This control partially overlaps A.7.14.
ISM-0839 requires that the destruction of media storing accountable material is not outsourced. Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten before equipment is disposed of or re-used, which addresses secure sanitisation outcomes. They overlap on the objective of preventing data exposure at end-of-life, but Annex A 7.14 does not address who performs destruction, and ISM-0839 does not specify sanitisation/verification methods like overwriting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.