ASD ISM 1724 Methods for destroying magnetic hard disks
What it says
Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMagnetic hard drives must be destroyed using specific approved methods, like incinerating or degaussing.
When it's time to get rid of old magnetic hard drives, it's important that they're destroyed in a way that permanently erases all data. If this isn't done properly, sensitive information could be recovered by someone else, leading to data breaches or identity theft. This control is about making sure that doesn't happen by using approved destruction methods.
Free. Save your status, tasks and notes.
Why it matters
Improper destruction of magnetic hard disks can allow data recovery, causing data breaches and financial and reputational harm.
How to implement
IT team should arrange for secure transport: When old hard drives are ready for destruction, it's crucial that the IT team coordinates with a secure transport provider to ensure the drives remain safe until they reach the destruction site.
This involves choosing a reputable service with a good track record in handling sensitive media.
Office manager should document disposal procedures: The office manager should document the procedures for hard drive disposal, including the approved destruction methods like incinerator or degausser use.
Make sure these documented procedures are accessible to relevant staff and are reviewed periodically.
IT team should conduct regular checks: Set up a routine for the IT team to check on-site data destruction equipment like degaussers or grinders to ensure they are functioning correctly.
Include checking for wear and tear and that user guidelines are visibly displayed.
Security officer should monitor processes: The security officer should oversee the entire destruction process if done in-house, or verify that all procedures are followed if outsourced.
This involves ensuring all steps in the destruction process are witnessed by authorised personnel and any certificates of destruction are correctly issued and filed.
Keep it running
Confirm destruction uses approved methods (degausser, incinerator, disintegrator, grinder) and keep evidence that disks are unrecoverable.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The hard drive disposal policy: Request the document outlining the methods for destroying magnetic hard disks.
Look at
References to specific methods like incinerators or degaussers and clear instructions for staff.
Good evidence
Includes detailed procedures aligned with recommended practices.
- Check 2 of 5What an auditor asks for
Ask for
Vendor certificates of destruction: Request certificates from external vendors confirming that hard drives were destroyed.
Look at
The certification details, including date, method used, and confirmation that it was witnessed.
Good evidence
Certificate will clearly confirm destruction, include vendor details and a contact person.
- Check 3 of 5What an auditor asks for
Ask for
Equipment maintenance logs: Request the maintenance records for any in-house destruction equipment like degaussers.
Look at
Regular checks and servicing aligned with manufacturer recommendations. A complete log will show consistent upkeep and any repairs undertaken quickly.
- Check 4 of 5What an auditor asks for
Ask for
To see the authorisation list: Request the list of authorised personnel allowed to handle or witness the destruction of drives.
Look at
Updated lists that reflect current staff and roles.
Good evidence
List should have recent date, staff names, and roles confirmed by management.
- Check 5 of 5What an auditor asks for
Ask for
Training records: Request proof of training for staff involved in the media destruction process.
Look at
Completion of training sessions on using destruction equipment and understanding of procedures. Good records will show who attended, what was covered, and regular refresher courses.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1724 requires magnetic hard disks to be destroyed using specific approved destruction methods (e.g., incineration, grinding or degaussing). ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed securely across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1724 fits within Annex A 7.10 as a prescriptive disposal/destruction requirement for one media type, while Annex A 7.10 is broader and less prescriptive about exact destruction techniques.
This control partially overlaps A.7.14.
ISM-1724 requires magnetic hard disks to be physically destroyed using approved methods to prevent data recovery. ISO/IEC 27001:2022 Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten prior to equipment disposal or reuse. They overlap on ensuring data is not recoverable when disposing of equipment with storage media, but ISM-1724 is specifically about destruction methods for magnetic HDDs, while Annex A 7.14 includes reuse scenarios and allows non-destructive approaches (e.g., secure overwrite) with an explicit verification requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.