Skip to content
Media
ASD ISMISM-1713

ASD ISM 1713 Develop and maintain a removable media register

What it says

A removable media register is developed, implemented, maintained and regularly verified.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure a register for tracking removable media is created, kept up-to-date, and routinely checked.

Tracking removable media like USB sticks and external hard drives matters because these items can easily be lost or stolen, leading to data breaches. If we don't keep a proper register, we might not know what's missing, leaving sensitive information exposed and risking non-compliance with regulations.

Why it matters

Without a proper register, data on removable media could be lost or stolen, leading to data breaches and compliance failures.

How to implement

  1. Office Manager should create a register: Write down details like the type of media, its serial number, who has it, and when it was checked out.

    Use a simple spreadsheet or inventory app to keep it clear and organised.

  2. IT Team should assign responsibility: Appoint a person in charge of the register to update it every time media is issued or returned.

    Make sure this person understands the importance of prompt and accurate log entries.

  3. Office Staff should be trained: Conduct a session to explain why keeping track of removable media is important and how to accurately log items in the register.

    Use everyday examples to highlight the risks of lost media.

  4. Manager should schedule regular checks: Set a monthly reminder to review the register and verify that all items are accounted for.

    Use this time to spot any discrepancies and address them immediately.

  5. Procurement Manager should document purchases: Whenever new removable media is bought, it should be immediately logged into the register before being distributed.

    This ensures all assets start tracked from the get-go.

Keep it running

Regularly updating and auditing the register prevents lapses in tracking and ensures quick action if media are misplaced or stolen.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the removable media register: Request to see the current document or file used to track removable media.

    Look at

    recent entries and details such as dates, serial numbers, and user details.

    Good evidence

    register will be up-to-date and have no missing information.

  2. Check 2 of 5What an auditor asks for

    Ask for

    evidence of regular reviews: Request recent records or logs showing when the register was last reviewed.

    Look at

    confirmed dates and outcomes of these reviews.

    Good evidence

    review log will mention any discrepancies and corrective actions taken.

  3. Check 3 of 5What an auditor asks for

    Ask for

    about staff training materials: Request a copy of training materials or records of sessions on using the register.

    Look at

    clear instructions and attendance records showing staff participation. Good evidence includes recent training dates and signed attendance sheets.

  4. Check 4 of 5What an auditor asks for

    Ask for

    which team member is responsible for the register: Confirm their knowledge of recent check-ins and check-outs.

    Look at

    clear ownership and understanding of process details. A strong response includes accurate, prompt answers and demonstrated familiarity.

  5. Check 5 of 5What an auditor asks for

    Ask for

    purchase records: Review purchase documents for removable media since implementing the register.

    Look at

    timely entries and matching data in the register. Good records align with register entries showing an organised receipt and tracking process.

Mappings

Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.9Inventory management of information and associated assetsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.