ASD ISM 1065 Reset device settings before media sanitisation
What it says
The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReset hidden and configuration settings on hard drives before erasing them to ensure nothing is overlooked.
Before you erase a hard drive, reset all hidden and internal settings. This prevents anything from being missed, ensuring sensitive information isn't accidentally retained and potentially accessed by someone else later on.
Free. Save your status, tasks and notes.
Why it matters
If HPA/DCO aren't reset before sanitising a magnetic HDD, hidden areas can retain sensitive data and be recovered, causing a breach.
How to implement
IT team should first identify any hard drives that need to be reset.
Make a list of all such devices in your organisation before any sanitisation process starts.
Device managers should remove any hidden settings on hard drives.
This means accessing the special areas where settings are stored and ensuring they are cleared or set back to default.
The IT team should verify the resetting of each drive's hidden configurations.
This involves checking both the host-protected area and device configuration overlay table to ensure all settings are properly reset.
IT staff must use specialised software to reset and then sanitise the drives.
Simple step-by-step software solutions can make it easy to navigate and properly perform these tasks.
System owners should confirm the process is complete and no data is leftover.
They can conduct a final check using available verification tools to ensure the sanitisation was thorough.
Keep it running
Before sanitisation, identify and reset the drive's HPA and DCO to factory/default, then confirm full native capacity is exposed and logged.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of all devices identified for sanitisation: Request the inventory file that lists all hard drives needing resetting and sanitisation.
Look at
The completeness of the list and ensure it matches the organisation's assets.
Good evidence
Includes a comprehensive, up-to-date inventory file.
- Check 2 of 5What an auditor asks for
Ask for
Records of the reset process for each device: Request documented evidence showing the reset of the host-protected area and device configuration overlay.
Look at
Clear descriptions and completion timestamps.
Good evidence
Includes timestamped logs or reports showing these settings were addressed.
- Check 3 of 5What an auditor asks for
Ask for
The software or tools used in the process: Request documentation showing what tools or software were used to reset and sanitise the drives.
Look at
User guides or certificates that the tools are adequate for the task.
Good evidence
Provides legitimate and reputable tools listed for use.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of a verification check after sanitisation: Request the final check documentation.
Look at
Confirmations that no data is leftover post-sanitisation.
Good evidence
Includes validation reports from verification tools.
- Check 5 of 5What an auditor asks for
Ask for
Training materials for the staff involved: Request training records or materials used to educate the IT team on performing these actions.
Look at
Materials that cover both theoretical knowledge and practical steps.
Good evidence
Includes comprehensive training logs or registration details for relevant training sessions.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-1065 requires resetting HPA and DCO on non-volatile magnetic hard drives prior to sanitisation to prevent hidden storage areas persisting after a wipe. Annex A 7.10 addresses secure management of storage media across its lifecycle, including disposal handling requirements where sanitisation expectations are typically governed. ISM-1065 is a specific technical requirement within the broader lifecycle media management practices set by Annex A 7.10.
This control partially meets A.7.14.
ISM-1065 requires organisations to reset the host-protected area (HPA) and device configuration overlay (DCO) on non-volatile magnetic hard drives before sanitisation so that hidden regions are not missed. Annex A 7.14 requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use, which is strengthened by ensuring the entire disk is addressable and included in the wipe. Annex A 7.14 is broader and outcome-focused across equipment disposal, while ISM-1065 is a specific technical pre-sanitisation step for certain hard drive features.
This control partially meets A.8.10.
ISM-1065 requires resetting HPA and DCO on magnetic hard drives before sanitisation so that deletion activities apply to all addressable and previously hidden disk areas. Annex A 8.10 requires secure deletion of information when no longer needed, and ISM-1065 supports this by preventing incomplete deletion caused by drive-level configuration that hides sectors from standard wiping tools. Annex A 8.10 is broader in scope (all media and systems), whereas ISM-1065 is a targeted control for a specific sanitisation failure mode on magnetic drives.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.