ASD ISM 0840 Certified services for outsourced media destruction
What it says
When outsourcing the destruction of media storing non-accountable material, a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO's Protective Security Circular-167, is used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse certified services for destroying non-accountable material to ensure security and compliance with ASIO guidelines.
When you're getting rid of old computers or hard drives, it's important to make sure any data on them is destroyed securely. If you hire someone to do this job, you need to use a company certified by the National Association for Information Destruction (NAID). This matters because if data isn't destroyed properly, confidential information could end up in the wrong hands, leading to security breaches or legal issues.
Free. Save your status, tasks and notes.
Why it matters
Using a non-NAID AAA/PSC-167-endorsed destruction service increases the risk of media compromise, data spills and ISM non-compliance.
How to implement
Managers should identify and choose certified destruction services for media disposal.
They can do this by checking the service provider's NAID certification and endorsements listed in ASIO's guidelines, ensuring they are properly qualified.
Procurement teams should only engage with destruction services that are NAID AAA certified.
Ensure the contract specifically mentions compliance with ASIO's Protective Security Circular-167 to prevent legal and security risks.
Office managers should verify service provider credentials before authorising media destruction.
Request evidence of current NAID certification and note any specific endorsements that apply to your needs.
IT teams should mark media for destruction and prepare it according to the certified service provider's requirements.
This includes organising and securely storing items until they are picked up for destruction.
Compliance officers should oversee the entire media destruction process to ensure adherence to guidelines.
They should also keep a record of all media destroyed, including dates and certificates from the destruction service, as proof of compliance.
Keep it running
Routinely verify vendor NAID AAA certification and PSC-167 endorsements; retain evidence (certificates) and review before each destruction engagement.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The contract with the destruction service provider: Ensure it states NAID AAA certification and references ASIO's PSC-167.
Look at
The certification dates and any endorsements relevant to media destruction.
Good evidence
Shows current certification and clear compliance terms.
- Check 2 of 5What an auditor asks for
Ask for
The destruction schedule and certificates.
Look at
Completed destruction logs and certificates of destruction from the service provider.
Good evidence
Result contains dates, descriptions of items destroyed, and service provider signatures.
- Check 3 of 5What an auditor asks for
Look at
The certification status and endorsements.
Good evidence
Document is up-to-date, matches the advertised services, and has official NAID endorsement.
- Check 4 of 5What an auditor asks for
Ask for
The internal policy on outsourcing media destruction: Check if it aligns with ASIO's guidelines and mandates the use of NAID certified providers. A strong policy will have clear steps and responsible parties outlined.
- Check 5 of 5What an auditor asks for
Ask for
Records of media destruction assessments.
Look at
A documented process where sensitive media was identified and deemed ready for destruction.
Good evidence
Record shows thorough assessment with management approval.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-0840 mandates use of a certified third-party destruction service for outsourced destruction of media storing non-accountable material. Annex A 5.19 requires managing information security risks in supplier relationships generally, including setting requirements and controls for suppliers delivering services. ISM-0840 is a specific supplier control focused on secure media destruction certification, while Annex A 5.19 covers a wider range of supplier types, risks, and lifecycle management activities.
This control partially meets A.5.21.
ISM-0840 requires that when an organisation outsources destruction of media holding non-accountable material, it uses a specifically certified destruction provider (NAID AAA with required endorsements per PSC-167). Annex A 5.21 requires defining and implementing processes to manage information security risks across the ICT products and services supply chain, which includes due diligence and controls over outsourced service providers. ISM-0840 is a prescriptive, single-use supply-chain requirement for media destruction, whereas Annex A 5.21 is broader across all ICT supply chain risks.
This control partially overlaps A.7.10.
ISM-0840 addresses secure disposal by requiring a certified outsourced destruction service for media holding non-accountable material. Annex A 7.10 requires storage media to be managed securely through its full lifecycle, including transportation and disposal, in line with classification and handling requirements. They overlap on disposal and third-party handling risks, but Annex A 7.10 is broader across all media lifecycle stages and does not prescribe NAID AAA/PSC-167 certification as ISM-0840 does.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.