ASD ISM 1549 Develop and maintain media management policy
What it says
A media management policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and update a policy to manage media handling effectively.
A media management policy is like a rulebook for how everyone in your organisation should handle items such as USB drives, CDs, or DVDs that store information. It matters because without proper guidance, sensitive information could be lost, damaged, or stolen, leading to serious problems like data breaches or reputational harm.
Free. Save your status, tasks and notes.
Why it matters
Without a media management policy, removable media (e.g., USBs) may be used or disposed of insecurely, causing data leakage and reputational harm.
How to implement
The IT manager should draft a media management policy detailing how different types of media should be handled, stored, and disposed of.
They can start by listing the various types of media the organisation uses and outlining acceptable uses and handling requirements for each type.
The HR department should assist in training employees on the new media management policy.
This could involve organising group sessions or online courses that explain the policy in easy-to-understand language and why it's important to follow it.
The operations manager should ensure secure storage is available for media when it's not in use.
They can set up a designated locked area or secure cabinets within the office where media is stored safely.
The IT team should establish procedures for regularly reviewing and updating the media management policy to keep it relevant.
They should schedule a review every 12 months or whenever there is a significant change in technology or business operations.
The system owners should implement a check-in and check-out system for media to maintain accountability.
This can be a simple logbook or software that records who is taking media out and when it must be returned.
Keep it running
Review and reissue the media management policy at least annually, covering approved media types, labelling, storage, transport, sanitisation and disposal.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media management policy document: Request the most recent version of the organisation's media management policy.
Look at
Clear guidelines on media handling, storage, and disposal.
Good evidence
Includes specific instructions for different types of media and is dated within the last year.
- Check 2 of 5What an auditor asks for
Look at
Records of all employees, especially those handling sensitive data.
Good evidence
Is a complete list showing most or all employees trained within the last year.
- Check 3 of 5What an auditor asks for
Ask for
To see the secure storage area for media: Request a demonstration or photos of where the media is securely stored.
Look at
The physical set-up to ensure it has secure locks and limited access.
Good evidence
Is a well-secured area with evidence of controlled access.
- Check 4 of 5What an auditor asks for
Ask for
The schedule or calendar showing planned reviews of the media management policy.
Look at
A clearly defined timeline showing regular reviews or updates.
Good evidence
Is a calendar with entries showing reviews conducted annually or as needed.
- Check 5 of 5What an auditor asks for
Ask for
The media usage log: Request to see logs of media being checked in and out.
Look at
Detailed entries showing date, user name, and media type.
Good evidence
Is a comprehensive log with most recent entries showing proper usage tracking and accountability.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.1.
ISM-1549 requires an organisation to develop, implement, and maintain a media management policy for how media is handled and controlled. Annex A 5.1 requires information security policies (including topic-specific policies) to be defined, approved, communicated, and reviewed, which would include a media management policy as one such topic. Annex A 5.1 is broader because it sets governance expectations for the whole policy framework, while ISM-1549 is specific to the media management policy topic.
This control partially overlaps A.5.10.
Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets to be documented and implemented. ISM-1549 overlaps by requiring a media management policy, which is a concrete set of handling procedures for a specific asset category (removable/physical media). ISM-1549 goes deeper into media governance, while Annex A 5.10 is broader and covers acceptable use beyond media (e.g. user conduct across systems and services).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.