ASD ISM 1223 Methods for sanitising network device memory
What it says
Memory in network devices is sanitised using the following processes, in order of preference: - following device-specific guidance provided in evaluation documentation - following vendor sanitisation guidance - loading a dummy configuration file, performing a factory reset and then reinstalling firmware.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNetwork device memory is cleaned by following specific guidance or doing a reset and reinstalling firmware.
This control is about thoroughly erasing any sensitive information that might be stored in the memory of network devices, like routers or switches, before they are disposed of or reused. If this isn't done properly, there's a risk that unauthorised people could access your data, potentially leading to data breaches or privacy violations.
Free. Save your status, tasks and notes.
Why it matters
If network device memory isn't sanitised, residual configs, credentials or keys may be recovered, enabling unauthorised access and data compromise.
How to implement
IT team should gather the device-specific documentation: First, the IT team should find and review any instructions provided by the device manufacturer for sanitising memory.
This is usually found in the technical manual or support section of the manufacturer's website.
IT team should consult vendor guidelines: If device-specific instructions are unavailable, the IT team should check for any broader vendor guidelines on memory sanitisation.
They might need to reach out to the vendor support or check their online resources.
System owners should load a dummy configuration: As a precaution, system owners should load a harmless, blank configuration file onto the device.
This ensures that the memory no longer contains active configuration data.
IT team should perform a factory reset: The IT team should reset the device to its original factory settings.
This can typically be done through the device's menu options or using a special reset button or combination.
IT team should reinstall the latest firmware: After a reset, the IT team should reinstall the latest firmware.
This ensures the device is up-to-date and doesn't retain any old, potentially exploitable software versions.
Keep it running
Sanitise device memory before disposal/transfer: use evaluation docs first, then vendor guidance; otherwise load a dummy config, factory reset, and reinstall firmware.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Device-specific sanitisation records: Request records or logs that detail the sanitisation process for each device.
Look at
Whether the specific instructions or vendor guidelines were followed.
Good evidence
Includes date-stamped records that clearly outline the steps taken for sanitisation.
- Check 2 of 5What an auditor asks for
Ask for
To see dummy configuration documentation: Verify documentation that shows the dummy configuration file used.
Look at
The details of the file and ensure it's blank and irrelevant to operations.
Good evidence
Is a simple, clear file that contains no sensitive data.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of factory resets: Request to see records or logs indicating a factory reset was performed.
Look at
The date and confirmation that the reset procedure was followed.
Good evidence
Is a log or report that notes the reset date and any checks completed post-reset.
- Check 4 of 5What an auditor asks for
Ask for
Firmware reinstallation records: Request a document showing that firmware was reinstalled after the reset.
Look at
The version number and installation date of the firmware applied.
Good evidence
Includes current version details and recent dates that coincide with the resets.
- Check 5 of 5What an auditor asks for
Ask for
About vendor communication logs: Request copies of any communication with vendors regarding sanitisation processes.
Look at
Email confirmations or guideline references.
Good evidence
Contains correspondence detailing verified sanitisation practices recommended by the vendor.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.14.
ISM-1223 requires network device memory to be sanitised using device-specific evaluation guidance, vendor sanitisation guidance, or a dummy configuration plus factory reset and firmware reinstallation. Annex A 7.14 requires verifying that sensitive data and licensed software have been removed or securely overwritten prior to disposal or re-use of equipment containing storage media. ISM-1223 is a specific sanitisation method set for network devices, while Annex A 7.14 is broader across equipment types and disposal/re-use scenarios.
This control partially meets A.8.10.
Annex A 8.10 requires organisations to delete information from devices and storage media when it is no longer needed. ISM-1223 specifies approved methods to sanitise network device memory, which is one concrete subset of securely deleting information from particular device types. ISM-1223 is technical and device-specific, while Annex A 8.10 is broader and technology-agnostic across all storage locations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.