ASD ISM 1723 Methods for destroying magnetic floppy disks
What it says
Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMagnetic floppy disks should be destroyed by burning, grinding, degaussing, or cutting to prevent data recovery.
This control is about making sure old magnetic floppy disks are completely destroyed so no one can access the data on them. If this isn't done, sensitive information could be stolen, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If magnetic floppy disks are not destroyed (e.g., degaussed, incinerated or cut), recoverable data may be extracted, causing a breach and reputational and financial harm.
How to implement
Office manager should organise the scanning of office storage to identify and collect any old floppy disks lying around.
This can be done by setting a day when all staff bring in any old disks they find at their desks or in storage.
IT team should assess the gathered floppy disks to determine the best method for destruction based on the volume and available resources.
This might involve researching local services that can provide certified destruction services.
Office manager should engage a professional service that specialises in secure media destruction.
Contact a few vendors to compare prices and ensure they offer certified destruction methods like burning or grinding.
Procurement team should purchase or hire equipment if professional services are not an option.
This could be a high-quality shredder that can destroy floppy disks or a strong degaussing tool.
HR should inform all staff about the data destruction policy and the reasons behind it, emphasising the importance of protecting sensitive data even from outdated media like floppy disks.
Keep it running
Use only approved floppy disk destruction methods (incinerator/furnace, hammer mill, disintegrator, degausser or cutting) and record chain-of-custody and completion.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media destruction policy document.
Look at
The outlined procedures for destroying obsolete media like floppy disks.
Good evidence
Policy will clearly specify approved destruction methods and roles responsible.
- Check 2 of 5What an auditor asks for
Good evidence
Certificate will include all these details, proving data was securely destroyed.
- Check 3 of 5What an auditor asks for
Ask for
Staff involved in the destruction process to describe how they identified the disks and chose a destruction method.
Look at
Their explanation for comprehensiveness and knowledge of the policy.
Good evidence
Will show awareness of the policy and an understanding of destruction methods used.
- Check 4 of 5What an auditor asks for
Look at
Equipment specifications to ensure it can effectively destroy floppy disks. Verified equipment should match the requirements needed for complete data destruction.
- Check 5 of 5What an auditor asks for
Ask for
Records of communications or trainings provided to staff about data destruction policies. Review these records for evidence that staff are informed and reminded regularly about media destruction practices.
Good evidence
Outcome will show periodic training sessions or reminders.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1723 mandates secure end-of-life handling for one specific removable medium type by specifying acceptable destruction methods for magnetic floppy disks. Annex A 7.10 requires storage media to be managed across its full life cycle (acquisition through disposal) in line with classification and handling requirements, which includes secure disposal/destruction practices. ISM-1723 fits within the disposal portion of Annex A 7.10 but does not address the broader life-cycle governance and handling controls.
This control partially meets A.8.10.
ISM-1723 addresses preventing information recovery by requiring physical destruction of magnetic floppy disks using specific approved methods. Annex A 8.10 requires information to be securely deleted from systems, devices, or any storage media when no longer needed, which can be achieved via deletion, overwriting, or destruction depending on the medium and risk. ISM-1723 is a specific destruction-based way to meet secure deletion objectives for a particular legacy medium, whereas Annex A 8.10 is broader and technology-agnostic.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.