ASD ISM 1642 Ensure media is sanitised before reuse
What it says
Media is sanitised before it is reused in a different security domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishClean media thoroughly before using it in a new security area to prevent data leaks.
Before using storage media, like USB drives or hard disks, in a new area with different security rules, you need to make sure all previous data is wiped clean. This is important because if old data remains, there's a risk of exposing sensitive information to people who shouldn't have access to it, potentially leading to data breaches and loss of trust.
Free. Save your status, tasks and notes.
Why it matters
Reusing unsanitised media across security domains can expose residual data to unauthorised users, causing sensitive information disclosure.
How to implement
IT staff should ensure all media is correctly wiped before reuse: Use software or hardware tools specifically designed for data sanitisation to clear drives of old data.
Ensure the entire storage area of the device is overwritten and verified clean.
Managers should have a media management policy: Create a clear set of rules outlining how media should be cleaned and tracked before it's reassigned to different departments or security zones.
Include steps for sanitising and a checklist for compliance.
Procurement officers should purchase sanitisation tools: Ensure your organisation has the necessary equipment or software to effectively erase data from multiple types of media.
Compare products based on customer reviews and IT expert recommendations.
Record keepers should document sanitisation processes: Maintain logs of when each device is sanitised, who performed the task, and the method used.
Use these logs to show compliance with your organisation's policy during audits.
Business owners should educate staff about data erasure: Organise training sessions for employees on the importance of media sanitisation and how to properly clean devices before reuse.
Provide practical demonstrations and keep training materials updated.
Keep it running
Verify media sanitisation before reuse across security domains using approved methods, and keep records of wipe/clear outcomes to prevent data remanence.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media sanitisation policy document: Ensure that it outlines procedures for wiping devices before reuse and specifies approved sanitisation tools.
Look at
Clarity in instructions and designated responsibilities.
Good evidence
Includes a detailed policy document with up-to-date procedures and assigned roles.
- Check 2 of 5What an auditor asks for
Ask for
Logs of sanitised media: Review the records of media that have been cleaned before being used in a new security zone.
Look at
The dates, methods, and personnel involved. Good logs are complete, showing consistent cleaning efforts with verifiable dates and signatures.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration of the sanitisation process: Request a live demonstration or video recording showing how a random piece of media is cleaned.
Look at
The step-by-step procedure and final verification of data erasure.
Good evidence
Demonstration follows documented procedures and verifies that data cannot be recovered.
- Check 4 of 5What an auditor asks for
Ask for
Which tools are used for data wiping: Check that tools listed match those recommended in your organisation's policy.
Look at
Consistent usage of these tools across all sanitisation activities.
Good evidence
Includes recognised and approved software or devices listed by the ACSC (Australian Cyber Security Centre).
- Check 5 of 5What an auditor asks for
Ask for
Staff about their understanding of the media policy: Interview a few IT and non-IT staff members about the organisation's media sanitisation policy.
Look at
Accurate recall of procedures and importance.
Good evidence
Show staff are well-informed and aligned with organisational practices.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.14.
ISM-1642 requires media to be sanitised before it is reused in a different security domain to prevent data leakage across domains. Annex A 7.14 similarly requires verification that sensitive data is removed or securely overwritten prior to equipment disposal or re-use, which includes storage media. Annex A 7.14 is broader in covering disposal and also explicitly mentions licensed software, while ISM-1642 is specifically focused on reuse across security domains.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.