ASD ISM 1217 Remove identifying labels from IT equipment before disposal
What it says
Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore throwing away IT equipment, remove any labels that show ownership or use.
This control is about making sure you remove any labels on IT equipment, like computers or phones, before getting rid of them. These labels can contain sensitive information about who owned the equipment or what it was used for. If you don't do this, someone could potentially trace back sensitive information, which could lead to privacy breaches or data leaks.
Free. Save your status, tasks and notes.
Why it matters
Failure to remove labels can expose sensitive ownership or usage data, risking privacy breaches and unintended information disclosure.
How to implement
Office managers should designate a responsible person to oversee the removal of labels from IT equipment before disposal.
They can ensure that all computers, printers, and other devices have their labels removed as part of the decommissioning process. This involves physically checking each item and using a simple scraper or alcohol solution to remove sticky residues.
IT teams should create a checklist for equipment disposal that includes steps for removing any identifying information.
This checklist should be shared with all staff involved in equipment decommissioning to follow easily. By having this checklist, everyone can understand the exact steps and ensure nothing is left with identifying labels.
Procurement officers should include label removal as a requirement in any disposal contracts with third-party providers.
This means they need to ensure that any company hired to take away old equipment is contractually obligated to remove all labels. They can do this by updating the terms covered in disposal agreements.
HR departments should train employees on the importance of label removal when equipment is broken or replaced.
They can provide a simple handout or part of an IT policy manual outlining what information labels may contain and why their removal is crucial. This ensures that anyone handling equipment understands their role in protecting sensitive information.
Executives need to allocate the necessary resources and support for IT equipment disposal processes.
This includes budgeting for proper disposal materials like solvents for label removal or hiring services to ensure compliance. By doing this, they facilitate proper procedures and prevent shortcuts that could compromise data security.
Keep it running
Before disposal, remove or obscure all asset tags and classification markings; also remove adhesive residue to prevent traceability.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment disposal checklist: Request the checklist used by staff for decommissioning IT equipment. Look to see if label removal is included as a specific step.
Good evidence
Is a checklist clearly listing label removal and showing who is responsible for the task.
- Check 2 of 5What an auditor asks for
Ask for
To see agreements with third-party disposal companies: Request a copy of the contract or agreement where label removal is mentioned. Look to ensure that there is a clause specifying that all identifying labels must be removed before disposal.
Good evidence
Example has this clause included and signed off by both parties.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request evidence of training sessions or materials where equipment disposal and label removal practices are covered.
Look at
Records of completed sessions or distributed materials, especially to those involved in IT and facilities management.
Good evidence
Includes dated records showing who was trained and when.
- Check 4 of 5What an auditor asks for
Ask for
A sample of recently disposed equipment: Request a demonstration of the label removal process on equipment ready to be disposed. Look to see if no labels indicating ownership or use remain on the equipment.
Good evidence
Shows clean equipment with no identifying information left visible.
- Check 5 of 5What an auditor asks for
Ask for
Incident reports related to disposal: Request any reports or logs where disposal practices were not followed properly.
Look at
These to identify any breaches or potential issues around label removal.
Good evidence
Is the absence of any incidents or a clear record that shows prompt action was taken to address them.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.7.10.
Annex A 7.10 requires organisations to manage storage media (and associated handling requirements) securely through to disposal. ISM-1217 supports secure disposal by requiring identifying labels on IT equipment to be removed before disposal to reduce association and sensitivity leakage. ISM-1217 is narrower, focusing on label/marking removal for equipment, and does not address other phases like acquisition, transport, or sanitisation covered by Annex A 7.10.
This control partially overlaps A.7.14.
ISM-1217 requires labels and markings that could identify the owner, sensitivity or classification of IT equipment to be removed before disposal. Annex A 7.14 requires verifying that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or re-used. They overlap as both are disposal-time controls intended to prevent information compromise from disposed assets, but ISM-1217 focuses on removing visible identifiers while Annex A 7.14 focuses on sanitising storage media contents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.