ASD ISM 1641 Ensure degaussed media is physically damaged
What it says
Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAfter using a degausser, damage internal components of magnetic media to prevent data recovery.
After you erase data from old magnetic storage devices like hard drives using a device called a degausser, it's important to physically damage the device to ensure that no one can recover any old data from it. This matters because if someone were to access that data, it might include sensitive information that could lead to identity theft or business secrets being exposed.
Free. Save your status, tasks and notes.
Why it matters
If degaussed media is not physically damaged, residual data may be recovered from platters, exposing sensitive information.
How to implement
The IT manager should organise a clear process for handling old magnetic media.
First, gather all devices that need degaussing and label them clearly to track them through the process.
The IT team should use a degausser to erase data from the magnetic media.
Ensure the team is trained properly on the degausser's operation to maximise data erasure success.
After degaussing, the designated disposal team member should physically damage the device, like bending or drilling through the platters inside a hard drive, to make data recovery impossible.
Implement a checklist for each device processed to ensure the degaussing and physical damage steps are verified by a second team member, offering a double-check system to prevent mistakes.
The office manager should set up a periodic review schedule to ensure the disposal process is being followed consistently, adjusting the process as necessary based on feedback from the disposal team.
Keep it running
After degaussing, confirm internal platters are deformed (e.g., drilled/shredded) and record checks as part of media disposal.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media degaussing and destruction log: Request records tracking each device processed through the degaussing and destruction steps.
Look at
Each entry for details like who conducted the process, the date, and confirmation of destruction.
Good evidence
A complete, up-to-date log with all devices recorded and confirmed destroyed.
- Check 2 of 5What an auditor asks for
Ask for
To see the disposal procedure documentation: Obtain the written procedure for magnetic media disposal.
Look at
Clear steps outlined for degaussing and physical destruction.
Good evidence
A detailed procedure document that matches actual operations observed on-site.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the degaussing process: Request a live demonstration or a video of a typical device being degaussed.
Look at
Proper handling and safe operation practices by staff.
Good evidence
The staff member correctly uses the degausser with no visible errors or safety concerns.
- Check 4 of 5What an auditor asks for
Ask for
The training records of staff involved in the process: Request evidence of relevant training for all personnel handling media disposal.
Look at
Training completion dates and content covered.
Good evidence
Each staff member has a recent completion certificate and training covers both degaussing and destruction techniques.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of tool maintenance logs: Request information on the maintenance schedule and service records for the degausser.
Look at
The frequency and details of maintenance activities.
Good evidence
Regular, documented maintenance is performed, ensuring the degausser is operational and effective.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1641 mandates a specific end-of-life handling step for magnetic media: once degaussed, it must be physically damaged to defeat recovery. This fits within Annex A 7.10's lifecycle management of storage media, particularly the disposal phase where handling must align to classification and secure media processes. Annex A 7.10 covers many additional lifecycle activities (acquisition, transport, storage, tracking), whereas ISM-1641 only addresses a specific destruction technique for one media type and scenario.
This control partially meets A.7.14.
ISM-1641 requires that after degaussing, magnetic media is physically damaged (e.g. deforming internal platters) to prevent any possibility of data recovery. This relates to Annex A 7.14 because secure disposal/re-use requires ensuring storage media does not retain sensitive data when equipment is disposed or re-used, and physical destruction is one recognised method for meeting that outcome. Annex A 7.14 is broader and technology-agnostic (covering various sanitisation methods and equipment types), while ISM-1641 is a specific, prescriptive requirement for degaussed magnetic media.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.