Develop and Maintain a Removable Media Register
Ensure a register for tracking removable media is created, kept up-to-date, and routinely checked.
Plain language
Tracking removable media like USB sticks and external hard drives matters because these items can easily be lost or stolen, leading to data breaches. If we don't keep a proper register, we might not know what's missing, leaving sensitive information exposed and risking non-compliance with regulations.
Framework
ASD Information Security Manual (ISM)
Control effect
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
18 June 2026
E8 maturity levels
N/A
Official control statement
A removable media register is developed, implemented, maintained and regularly verified.
Why it matters
Without a proper register, data on removable media could be lost or stolen, leading to data breaches and compliance failures.
Operational notes
Regularly updating and auditing the register prevents lapses in tracking and ensures quick action if media are misplaced or stolen.
Implementation tips
- Office Manager should create a register: Write down details like the type of media, its serial number, who has it, and when it was checked out. Use a simple spreadsheet or inventory app to keep it clear and organised.
- IT Team should assign responsibility: Appoint a person in charge of the register to update it every time media is issued or returned. Make sure this person understands the importance of prompt and accurate log entries.
- Office Staff should be trained: Conduct a session to explain why keeping track of removable media is important and how to accurately log items in the register. Use everyday examples to highlight the risks of lost media.
- Manager should schedule regular checks: Set a monthly reminder to review the register and verify that all items are accounted for. Use this time to spot any discrepancies and address them immediately.
- Procurement Manager should document purchases: Whenever new removable media is bought, it should be immediately logged into the register before being distributed. This ensures all assets start tracked from the get-go.
Audit / evidence tips
- Askthe removable media register: Request to see the current document or file used to track removable mediaLook atrecent entries and details such as dates, serial numbers, and user detailsGoodregister will be up-to-date and have no missing information
- Askevidence of regular reviews: Request recent records or logs showing when the register was last reviewedLook atconfirmed dates and outcomes of these reviewsGoodreview log will mention any discrepancies and corrective actions taken
- Askabout staff training materials: Request a copy of training materials or records of sessions on using the registerLook atclear instructions and attendance records showing staff participation. Good evidence includes recent training dates and signed attendance sheets
- Askwhich team member is responsible for the register: Confirm their knowledge of recent check-ins and check-outsLook atclear ownership and understanding of process details. A strong response includes accurate, prompt answers and demonstrated familiarity
- Askpurchase records: Review purchase documents for removable media since implementing the registerLook attimely entries and matching data in the register. Good records align with register entries showing an organised receipt and tracking process
Cross-framework mappings
How ISM-1713 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.9 | Annex A 5.9 requires an inventory of information and associated assets, including ownership, to be developed and maintained | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Media
See all Guidelines for media controls, or browse the full ASD ISM library.