ASD ISM 1222 Destroy unsanitised televisions and monitors
What it says
Televisions and computer monitors that cannot be sanitised are destroyed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTelevisions and monitors that can't be cleaned of data are to be physically destroyed.
Televisions and computer monitors that store or display data need to be destroyed if they can't be cleaned of any sensitive information. This is important because if these devices are not properly dealt with, sensitive information could leak out and cause security issues or privacy breaches.
Free. Save your status, tasks and notes.
Why it matters
If unsanitised TVs/monitors aren't destroyed, residual images or stored data can be recovered, causing sensitive data exposure and reputational harm.
How to implement
The IT team should assess each television or monitor to determine if any sensitive data is stored or displayed.
They should check the device's specifications and manuals to see if data storage is possible.
Managers should create an inventory of all TVs and monitors and determine which ones cannot be sanitised, marking them for destruction.
This involves coordinating with the IT team to confirm which devices need this action.
The procurement team should collaborate with a certified e-waste recycling company that specialises in securely destroying electronic equipment.
Ensure they are able to provide certification of destruction to prove devices have been properly disposed.
System owners should provide training to staff on recognising which devices might hold sensitive information.
Conduct workshops or provide materials that explain the risks and what should trigger a destruction decision.
The finance department should allocate budget resources for the destruction process, ensuring there is funding available to cover the costs associated with secure disposal of these electronic devices.
Keep it running
Tag any TV/monitor that can't be sanitised, remove it from service, and record certificate of destruction with serial number and date in the asset register.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
An up-to-date inventory of televisions and monitors: Request this document from the IT team or asset manager.
Look at
The details included for each device, like the make and model, and whether it can store data.
Good evidence
Inventory will clearly list devices set for destruction.
- Check 2 of 5What an auditor asks for
Look at
Certificates of destruction provided by the e-waste company.
Good evidence
Document will include dates and identification of each destroyed device.
- Check 3 of 5What an auditor asks for
Ask for
Training records from the system owners: Ensure they have conducted training sessions for staff regarding device sanitisation and destruction.
Look at
The attendance and topics covered. Good records will show recent sessions and wide participation.
- Check 4 of 5What an auditor asks for
Look at
Specific line items or allocations.
Good evidence
Report shows a designated budget entry for secure destruction.
- Check 5 of 5What an auditor asks for
Ask for
The IT team for their assessment criteria used to determine unsanitised devices: Review how they assess whether a device stores data.
Look at
The criteria used in their assessments.
Good evidence
Will show a thorough and consistent methodology.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.14.
ISM-1222 requires televisions and computer monitors that cannot be sanitised to be physically destroyed to prevent residual data compromise. Annex A 7.14 requires secure disposal or re-use of equipment by verifying sensitive data and licensed software are removed or securely overwritten before disposal or re-use. ISM-1222 is a specific, stricter end-of-life treatment for a particular equipment class when sanitisation is not possible, whereas Annex A 7.14 covers broader equipment disposal scenarios and includes re-use/overwrite pathways.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.