ASD ISM 1550 Develop and maintain IT equipment disposal procedures
What it says
IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure IT equipment is disposed of properly by following established procedures.
Properly getting rid of old IT equipment is important because if you don't, sensitive information could end up in the wrong hands. Think of all the data stored on your phones, computers, and servers-without a secure disposal process, this information could be accessed by someone it shouldn't be, leading to privacy breaches and potential financial loss.
Free. Save your status, tasks and notes.
Why it matters
Improper disposal of IT equipment can expose residual data, causing data breaches, regulatory consequences and reputational damage.
How to implement
IT team should develop a clear disposal policy: Define exactly what needs to happen when IT equipment is no longer in use.
Include steps like securely wiping all data and determining whether equipment should be recycled, donated, or scrapped.
Office manager should audit current device inventory: Conduct a check of all devices currently in use to ensure there are no outdated pieces that need disposal.
Create a list of equipment with details about its age and condition.
Procurement manager should liaise with a certified e-waste disposal company: Choose a company authorised to handle secure data destruction.
Verify their credentials and compliance with Australian privacy standards to ensure data is destroyed safely.
Manager should train staff on disposal procedures: Organise short educational sessions for team members highlighting the importance of data security and walk them through the correct disposal process for IT equipment.
IT team should maintain records of disposal actions: Keep detailed logs of each piece of equipment disposed of, including dates, methods used, and confirmation of successful data destruction.
This helps track compliance and monitors the effectiveness of the process.
Keep it running
Maintain disposal procedures: track assets, sanitise media per approved methods, and keep records of destruction or certified wipe for each device.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The IT equipment disposal policy document: Request to see the written procedures that outline the disposal process.
Look at
Clear instructions on data wiping, authorised contacts, and decision-making for disposal methods.
Good evidence
Document will be detailed, covering all aspects from data deletion to final equipment fate.
- Check 2 of 5What an auditor asks for
Ask for
Recent disposal records: Request the logs that show recent equipment disposals.
Look at
Entries with dates, equipment types, and disposal methods used.
Good evidence
Will include all relevant details and proof that procedures were followed.
- Check 3 of 5What an auditor asks for
Ask for
Training session records: Request documentation showing that staff training on disposal procedures has been conducted.
Look at
Participant lists, dates, and session content outlines.
Good evidence
Would confirm regular training occurs and participants understand their roles.
- Check 4 of 5What an auditor asks for
Ask for
A list of approved disposal vendors: Request the list of vendors authorised for disposing of IT equipment.
Look at
Evidence of vendor approvals and compliance with Australian standards.
Good evidence
Confirms vendors' credentials are verified and up-to-date.
- Check 5 of 5What an auditor asks for
Ask for
An inventory audit report: Request the most recent audit of IT equipment inventory.
Look at
Discrepancies between listed equipment and what was actually found.
Good evidence
Shows that inventory is current and any missing devices have documented explanations.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control is broader than A.7.10.
ISM-1550 requires organisations to develop, implement and maintain procedures for disposing of IT equipment. Annex A 7.10 governs storage media management across the full lifecycle (acquisition, use, transport and disposal) aligned to classification and handling requirements, and disposal procedures are one lifecycle component. ISM-1550 is therefore a specific subset focused on disposal, whereas Annex A 7.10 is broader and includes multiple phases and control points beyond disposal.
This control partially overlaps A.7.14.
ISM-1550 requires organisations to develop, implement and maintain IT equipment disposal processes and supporting procedures. Annex A 7.14 specifically requires verification that sensitive data and licensed software are removed or securely overwritten before equipment is disposed of or re-used, which is a core step that disposal procedures under ISM-1550 should mandate. ISM-1550 is broader in focusing on end-to-end procedural governance for disposal, while Annex A 7.14 is narrower and technically focused on sanitisation and software/licensing removal.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.