ASD ISM 0947 Sanitise media after data transfers between domains
What it says
When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishClean rewriteable media after transferring data between systems of different security levels.
When you move files using a USB stick or another rewritable disk between computers with different security levels, like from a personal laptop to a work computer with sensitive information, you need to wipe it clean afterwards. This is important because if you don't, the disk could carry confidential data to places it shouldn't, risking a data leak or security breach.
Free. Save your status, tasks and notes.
Why it matters
If rewritable media isn't sanitised after each cross-domain manual transfer, residual data can leak between domains and be accessed unauthorised.
How to implement
IT staff should establish a clear protocol for sanitising media.
This can be done by providing employees with a step-by-step guide on how to completely erase data from rewritable media after use.
Managers should ensure staff are trained to understand the importance of sanitising media.
Host a training session where employees learn why it's critical for data protection and the steps involved in doing it.
The IT team should set up technical tools to help staff erase data from media automatically.
Implement software on work devices that prompts users to clean media after use or does it automatically when plugged in.
Office managers could designate a secure spot to check and clean media after data transfers.
Encourage employees to visit the tech support desk where IT can help erase data immediately after transfers.
HR should incorporate media sanitisation policies into the onboarding process.
Include a section in the employee handbook defining the procedure and significance of sanitising media used for data transfers.
Keep it running
After every manual transfer between security domains, sanitise rewritable media using an approved method and record completion to prevent residual data carryover.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media sanitisation procedure document: Request the written procedure for how rewritable media should be cleaned.
Look at
Clear, easy-to-follow steps that anyone can understand.
Good evidence
Is a comprehensive guide with examples and contact details for further help.
- Check 2 of 5What an auditor asks for
Ask for
To see training records: Request documentation that shows employees have been trained in media sanitisation practices.
Look at
Dated attendance sheets or online course completions.
Good evidence
Is a list of courses with employee participation rates and dates.
- Check 3 of 5What an auditor asks for
Ask for
To see software tools used for media sanitisation: Request a demonstration of the software tools provided to staff for cleaning media.
Look at
Functionality that guides users through the process or automatically cleans media.
Good evidence
Includes a demonstration showing how the tool works.
- Check 4 of 5What an auditor asks for
Ask for
To review logs for recently sanitised media: Request the log file that records instances of media sanitisation.
Look at
Dates, user IDs, and confirmation of completion.
Good evidence
Is a log entry showing regular use of the sanitisation process.
- Check 5 of 5What an auditor asks for
Ask for
The policy document given to employees regarding media use: Request a copy of the section of the employee handbook that discusses media use and sanitisation.
Look at
Clear language and emphasised importance of the policy.
Good evidence
Is a plainly written policy that includes both 'why' and 'how' instructions.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.14.
ISM-0947 requires sanitising rewritable media after each manual transfer between different security domains to prevent information leakage via residual data. Annex A 5.14 requires information transfer rules and procedures for transfer mechanisms, and ISM-0947 provides a concrete procedural safeguard that can be embedded into those transfer procedures. Annex A 5.14 is broader and policy/procedure-oriented, while ISM-0947 is a specific technical/operational control applied during manual cross-domain transfers.
This control partially meets A.7.10.
ISM-0947 requires sanitising rewritable media after each manual transfer of data between different security domains. Annex A 7.10 requires storage media be managed across its lifecycle in line with classification and handling requirements, which would include controls for secure handling and cleansing where appropriate. ISM-0947 is a specific procedural requirement within the broader media-management lifecycle, with a narrower focus on cross-domain transfer and post-transfer sanitisation.
This control partially meets A.8.10.
Annex A 8.10 requires deletion of information from storage media once it is no longer required. ISM-0947 mandates sanitising rewritable media after each manual transfer between different security domains, which is a specific case of deletion to prevent residual data exposure. ISM-0947 is narrower because it applies to cross-domain manual transfers and rewritable media, whereas Annex A 8.10 applies to all contexts where data is no longer needed.
This control partially overlaps A.7.14.
ISM-0947 requires that when data is manually transferred between systems in different security domains, any rewritable transfer media is sanitised after each transfer. Annex A 7.14 requires sensitive data be removed or securely overwritten from equipment/storage media prior to disposal or re-use, which aligns with the need to prevent residual data remaining on media. The key difference is that ISM-0947 is an operational, per-transfer requirement for cross-domain movement, whereas Annex A 7.14 is triggered by end-of-life or re-use events and is not specific to domain separation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.