ASD ISM 1722 Methods for destroying electrostatic memory devices
What it says
Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse specialised machines or incineration to securely destroy memory storage devices.
Electrostatic memory devices, like USB drives and solid-state drives, need to be destroyed properly to ensure sensitive information doesn't fall into the wrong hands. If these devices are not securely destroyed, data can be recovered and lead to privacy violations or even financial losses.
Free. Save your status, tasks and notes.
Why it matters
Improper destruction of electrostatic memory devices could allow data recovery, exposing sensitive information and causing financial loss.
How to implement
IT team should identify all electrostatic memory devices needing destruction.
Create an inventory list and schedule regular checks to ensure all such devices are accounted for before they are destroyed safely.
Procurement team should engage a reputable data destruction service.
Research and select a service provider that offers furnace/incinerator, hammer mill, disintegrator, or grinder/sander options for destroying memory devices.
Office managers should ensure staff are trained on data disposal policies.
Conduct training sessions that explain the importance of proper disposal and the steps to report unused devices to the IT team.
Facilities staff should set up secure collection points for old devices.
Place locked bins in designated areas where employees can drop off outdated devices awaiting destruction.
Company leaders should document the destruction process.
Work with the IT team to ensure there is a written policy outlining how and when devices are destroyed, and retain records of each destruction event.
Keep it running
Verify furnaces/incinerators and grinders/disintegrators are used correctly and document destruction to ensure electrostatic memory devices cannot be recovered.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The inventory list of electrostatic memory devices.
Look at
Whether it includes all types of devices used and regularly updated entries.
Good evidence
: The list is comprehensive, up-to-date, and includes destruction dates.
- Check 2 of 5What an auditor asks for
Good evidence
Contracts clearly outline methods compliant with ISM standards.
- Check 3 of 5What an auditor asks for
Ask for
Training records for staff involved in media destruction.
Look at
Attendance sheets and training materials to ensure training covers policy and practical steps.
Good evidence
Records show regular training sessions with comprehensive coverage.
- Check 4 of 5What an auditor asks for
Look at
Details around procedures used and roles responsible for oversight.
Good evidence
Policy is clear, includes all necessary steps and roles, and is regularly reviewed.
- Check 5 of 5What an auditor asks for
Ask for
Destruction certificates or reports. Check the documents for details of destroyed items and methods used.
Good evidence
Certificates detail the devices destroyed, date, and methods used, confirming compliance with policy.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1722 requires electrostatic memory devices to be physically destroyed using specific methods (e.g. furnace/incinerator, hammer mill, disintegrator, grinder/sander). Annex A 7.10 requires storage media to be securely managed across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1722 is a specific disposal/destruction implementation within the broader life-cycle media management expectations of Annex A 7.10.
This control partially meets A.8.10.
ISM-1722 addresses secure destruction of electrostatic memory devices via physical destruction techniques to ensure information cannot be recovered. Annex A 8.10 requires information in systems and storage media to be securely deleted when no longer required, covering a broad range of deletion/sanitisation approaches. ISM-1722 is a specific, high-assurance physical destruction method that fits within the broader secure deletion objective of Annex A 8.10.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.