ASD ISM 1218 Sanitise overseas IT equipment handling sensitive data
What it says
IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOverseas IT equipment with sensitive data must be sanitised where it is located.
When your business uses IT equipment overseas that handles very sensitive Australian data, it's important to clean out or 'sanitise' that data before the equipment leaves its location. This matters because if this data is not properly removed, it could fall into the wrong hands, leading to data breaches that can harm your business's reputation and result in legal consequences.
Free. Save your status, tasks and notes.
Why it matters
Without in-situ sanitisation overseas, AUSTEO/AGAO data on equipment or media may be recovered, enabling unauthorised disclosure and damaging Australian interests.
How to implement
The IT team should develop a data sanitisation plan for overseas equipment.
This plan should include steps on how to securely erase data using software or methods recommended by the Australian Cyber Security Centre (ACSC). Make sure the plan is clear and includes who will carry out each step.
System owners should identify which pieces of overseas IT equipment store sensitive data.
They can do this by reviewing inventory records and talking to staff who use the equipment. Document which devices require sanitisation according to the plan.
Managers should ensure staff are trained on the importance of data sanitisation.
Organise training sessions that explain why cleaning data is necessary and what could happen if data is leaked. Use examples of real-world data breaches to illustrate the risks.
Procurement officers must check any service contracts with overseas partners or suppliers to ensure they include data sanitisation obligations.
Review all contracts and update them if they don't meet the required standards laid out by the ACSC.
The IT team should verify data is properly erased from the overseas equipment before it is reused or disposed of.
Use software that provides a data erasure certificate, and ensure that verification is documented as proof that data sanitisation took place.
Keep it running
Ensure overseas equipment/media that handled AUSTEO/AGAO is sanitised in situ before reuse, repair, return or disposal, and keep records of the method, date and verifier.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data sanitisation plan: Request the documented process that outlines how data is removed from overseas IT equipment.
Look at
The methods listed and who is responsible for each step.
Good evidence
Will be a comprehensive plan with clear roles, responsibilities, and procedures.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request the schedule and attendance records for staff training on data sanitisation.
Look at
Regular training sessions and full attendance by relevant staff. Good records will show up-to-date sessions with clear agendas and participant lists.
- Check 3 of 5What an auditor asks for
Ask for
Contract reviews: Request documents showing reviews of contracts with overseas suppliers or partners.
Look at
Clauses that specify data sanitisation requirements.
Good evidence
Includes identified and updated contracts to ensure compliance with data handling standards.
- Check 4 of 5What an auditor asks for
Ask for
Proof of sanitised devices: Request logs or certificates that show data has been erased from equipment.
Look at
Detailed records that show the equipment serial number and the date of sanitisation. Good evidence includes certificates generated by data erasure software with clear timestamps and signatures.
- Check 5 of 5What an auditor asks for
Ask for
Inventory lists: Request the list of overseas IT equipment handling AUSTEO or AGAO data. Check that the list matches with the items that underwent data sanitisation.
Good evidence
List should be current, detailed, and correspond to sanitisation logs.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.14.
ISM-1218 requires IT equipment (and associated media) located overseas that has handled AUSTEO or AGAO data to be sanitised in situ. ISO/IEC 27001:2022 Annex A 7.14 covers secure disposal or re-use of equipment by verifying sensitive data is removed or securely overwritten before disposal or re-use, which includes sanitisation outcomes. ISM-1218 is a specific situational requirement (overseas location + particular Australian government data types + in situ sanitisation), while Annex A 7.14 is broader and not location- or classification-specific.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.