ASD ISM 1361 Use approved equipment for media destruction
What it says
Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse officially approved devices for destroying media to ensure proper disposal.
When you have old or unnecessary storage devices like hard drives or USBs, it's important to destroy them properly so that sensitive data can't be recovered by anyone else. Using equipment approved by security bodies like the Security Construction and Equipment Committee ensures that the data is absolutely unrecoverable. If you don't do this, you risk private information getting into the wrong hands, which can lead to identity theft, data breaches, or financial losses.
Free. Save your status, tasks and notes.
Why it matters
Improper media destruction using unapproved equipment can allow sensitive data recovery, causing data breaches, legal exposure and reputational damage.
How to implement
The IT team should identify all storage devices that need to be destroyed, such as old computers, hard drives, and USB drives.
They can do this by conducting an inventory of all decommissioned or outdated electronic devices within the organisation.
Managers should ensure that only officially approved media destruction equipment is used.
They can do this by checking the lists of equipment approved by Australian security authorities like ASIO and ensuring these are available and used by the IT team.
Procurement officers should only purchase media destruction equipment that is listed on the official approval lists.
They can do this by consulting the Security Construction and Equipment Committee's approved equipment list before placing any orders.
Office managers should organise periodic training sessions for staff on the importance of using approved devices for media destruction and the risks involved in improper disposal.
They can arrange this by coordinating with external security experts or internal IT staff for the training.
The IT team should document all instances of media destruction using approved equipment, including details like date, type of media destroyed, and the specific approved equipment used.
They should keep these records organised and accessible for future audits.
Keep it running
Maintain a register of ASIO/SCEC-approved destroyers, verify approvals before use, and train staff to operate devices per vendor guidance.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of media destruction equipment used by the IT team.
Look at
The model numbers and compare them to the approved list from ASIO or the Security Construction and Equipment Committee.
Good evidence
Equipment list matches the approved list exactly.
- Check 2 of 5What an auditor asks for
Look at
The dates, types of media destroyed, and equipment used for each event.
Good evidence
Entries are complete and show the use of approved equipment for each destruction event.
- Check 3 of 5What an auditor asks for
Ask for
The procurement records for media destruction equipment.
Look at
Purchasing decisions to ensure they reference approved lists.
Good evidence
Purchases are only made from the approved equipment list and records are well documented.
- Check 4 of 5What an auditor asks for
Ask for
A copy of the training materials related to media destruction.
Look at
The content to ensure there's specific guidance on using approved equipment.
Good evidence
Training materials clearly outline the importance of using approved equipment and include relevant lists.
- Check 5 of 5What an auditor asks for
Ask for
Attendance records of media destruction training sessions.
Look at
The names and roles of attendees.
Good evidence
All key personnel, especially those from IT and procurement, have attended relevant training sessions.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1361 requires that when destroying media, organisations use SC&E Committee-approved or ASIO-approved destruction equipment. ISO/IEC 27001:2022 Annex A 7.10 covers management of storage media across its full lifecycle, including disposal, to meet classification and handling requirements. ISM-1361 is a specific implementation requirement within the disposal/destruction portion of Annex A 7.10 rather than covering lifecycle management overall.
This control partially overlaps A.7.14.
Annex A 7.14 requires verification that data and licensed software are removed or securely overwritten before equipment is disposed of or re-used. ISM-1361 focuses on using SCEC-approved or ASIO-approved equipment when destroying media, which is one disposal/sanitisation pathway that can satisfy the secure removal intent of Annex A 7.14. ISM-1361 is narrower (destruction only and tooling approval), while Annex A 7.14 also covers secure overwrite/erasure, reuse scenarios, and explicitly mentions licensed software.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.