ASD ISM 1160 Use NSA-evaluated degaussers for media destruction
What it says
If using degaussers to destroy media, degaussers evaluated by the United States' National Security Agency are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly use NSA-approved degaussers to securely erase data from storage media.
This control means that when you need to erase data from things like old hard drives or tapes, you should use degaussers that the United States' National Security Agency (NSA) has evaluated. This is important because using the right equipment ensures sensitive or private information is thoroughly wiped, protecting you from data leaks and the potential legal and financial consequences that come with them.
Free. Save your status, tasks and notes.
Why it matters
Using non-NSA-evaluated degaussers risks incomplete data erasure, enabling recovery of sensitive data and causing breaches and reputational damage.
How to implement
IT department: Confirm which degaussers are approved by the NSA for secure data destruction.
Check the latest guidance from the NSA to get a list of approved equipment.
Purchasing team: Buy or lease only NSA-evaluated degaussers for your organisation.
Ensure the supplier provides certification that their products are NSA-evaluated before making a purchase decision.
Operations manager: Train staff responsible for data destruction on how to properly use NSA-evaluated degaussers.
Set up a training session with practical demonstrations and supporting materials, such as manuals or videos.
IT team: Set procedures for regularly checking degaussers to ensure they're working correctly.
Establish a routine maintenance schedule, and log your checks in a maintenance record.
Manager: Document your media destruction process and the equipment used to ensure compliance.
Maintain a record of all devices degaussed and staff who performed the process, along with the date and time.
Keep it running
Maintain evidence the degausser is on the NSA Evaluated Products List and re-check model/firmware after servicing or replacement to ensure compliant destruction.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Equipment purchase records: Request documents showing the purchase or leasing of NSA-evaluated degaussers.
Look at
The product details for an NSA evaluation reference.
Good evidence
Includes valid NSA approval documentation tied to each degasser used.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request records of training sessions for staff using degaussers.
Look at
Dated attendance logs and training content.
Good evidence
Shows regular, comprehensive training aligned with current practices.
- Check 3 of 5What an auditor asks for
Ask for
Maintenance logs: Request maintenance logs for the degaussers.
Look at
Recorded service dates and actions taken.
Good evidence
Shows maintenance performed at recommended intervals and any repairs conducted.
- Check 4 of 5What an auditor asks for
Ask for
Documented procedures: Request written procedures on using the degaussers.
Look at
Clear, step-by-step instructions aligned with NSA guidance.
Good evidence
Includes staff roles and responsibility clearances.
- Check 5 of 5What an auditor asks for
Ask for
To observe the process: Request a demonstration of the degaussing process using the approved equipment.
Look at
Adherence to documented procedures.
Good evidence
Shows staff following steps with ensured data destruction.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-1160 specifies an approved standard for degaussing equipment when degaussing is used to destroy storage media. Annex A 7.10 covers secure management of storage media across its full life cycle, including disposal, and therefore includes the need for appropriate sanitisation/destruction controls when media reaches end of life. Annex A 7.10 is broader life-cycle governance, whereas ISM-1160 is a prescriptive control for selecting an evaluated degausser within that disposal/destruction activity.
This control partially meets A.7.14.
Annex A 7.14 requires ensuring sensitive data is removed or securely overwritten before equipment containing storage media is disposed of or re-used. ISM-1160 specifies a particular requirement for degaussing-based media destruction-use NSA-evaluated degaussers-which is one acceptable destruction approach consistent with Annex A 7.14's intent. ISM-1160 is limited to one destruction tool class and does not cover reuse, broader sanitisation methods, or licensed software removal.
This control partially meets A.8.10.
ISM-1160 requires that where degaussing is used as the secure destruction method, the organisation uses NSA-evaluated degaussers to ensure effective sanitisation. Annex A 8.10 requires secure deletion of information from systems, devices, or any storage media when no longer required, which may be met through deletion, overwriting, cryptographic erasure, or physical destruction such as degaussing. Annex A 8.10 is broader and outcome-focused on secure deletion, while ISM-1160 is a specific implementation constraint for one physical sanitisation technique.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.