ASD ISM 1600 Ensure media is sanitised before initial use
What it says
Media is sanitised before it is used for the first time.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore using any media, clean it to ensure no unwanted data is present.
Before you use any new storage like USB drives or hard disks, it's important to clean them to make sure there's no leftover data that could cause harm. If you skip this step, you might accidentally use a device that still has someone else's data on it, which could include sensitive information, putting your organisation at risk of data breaches or misuse.
Free. Save your status, tasks and notes.
Why it matters
Using media that has not been sanitised before first use can retain residual data or malware, causing unauthorised disclosure or compromise.
How to implement
IT team should check all new storage devices: Before a USB drive or similar device is first used, IT should ensure it's clear of any old data.
This can be done by using a software tool that securely wipes the device.
Procurement team should buy capable devices: When purchasing new storage devices, choose ones that can easily be wiped clean.
This can involve checking product reviews for secure erase features.
Managers should create a policy: Develop a clear policy that requires cleaning of all new storage media before first use.
Share this policy with everyone who might use these devices.
System owners should oversee compliance: Regularly check that storage cleaning procedures are being followed.
This can be done by scheduling monthly checks or spot audits.
Staff should be trained: Conduct a brief training session to show employees how and why to clean new media.
This can include hands-on demonstrations with common devices like USBs.
Keep it running
Sanitise all newly acquired media before first use (e.g., secure erase/format per policy) and record/verify sanitisation prior to deployment.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The storage sanitisation policy: Request the document that outlines the procedure for sanitising new media before use.
Look at
Clear steps and responsibilities assigned.
Good evidence
Includes a comprehensive policy with clear roles, procedures and consequences for non-compliance.
- Check 2 of 5What an auditor asks for
Ask for
A list of newly purchased media: Request a record of newly acquired storage devices by the procurement team. Look that each device is documented with its sanitisation status before use.
Good evidence
Shows each device with records confirming it was wiped clean and checked.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the sanitisation process: Request IT to show how they wipe a new USB drive. Look that the process is straightforward and completed in a reasonable timeframe.
Good evidence
Is the completion of a successful wipe, confirmed by a tool that shows no remaining data.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Request evidence of training sessions conducted for staff on media sanitisation.
Look at
Dates, attendee lists, and content covered.
Good evidence
Includes regular training dates, consistency in attendance, and comprehensive materials.
- Check 5 of 5What an auditor asks for
Ask for
Incident records regarding media use: Request any incident logs relating to uncleaned media use.
Look at
How often incidents occur and their severity.
Good evidence
Shows an absence of incidents, or well-documented problem resolution if incidents do occur.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1600 requires media to be sanitised before it is used for the first time to prevent introduction of unwanted or residual data. Annex A 7.10 requires storage media to be managed across its full life cycle (acquisition, use, transport and disposal) in line with classification and handling rules, which would include establishing controls for initial preparation of media. ISM-1600 is a specific, point-in-time requirement (initial use), whereas Annex A 7.10 is broader governance over multiple stages and handling scenarios.
This control partially overlaps A.8.10.
ISM-1600 requires media to be sanitised before first use so it does not contain unwanted data that could create security or integrity issues. Annex A 8.10 requires secure deletion of information when it is no longer needed across systems, devices and storage media. Both controls involve sanitisation/secure removal of data on media, but ISM-1600 is focused on preventing pre-existing data at onboarding, while Annex A 8.10 is focused on end-of-life or end-of-need deletion.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.