ASD ISM 1726 Methods for destructing optical disks
What it says
Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOptical disks should be destroyed using various methods like incineration or grinding to ensure data is unreadable.
This control is about making sure that old or unwanted optical disks, like CDs or DVDs, are disposed of in a way that any data on them can't be read anymore. This is important because if someone finds a disk you threw away, they might access sensitive information, which could lead to financial loss, embarrassment, or legal troubles.
Free. Save your status, tasks and notes.
Why it matters
If optical disks are not physically destroyed (e.g., cut, disintegrated or incinerated), data may be recovered, causing compromise and reportable breaches.
How to implement
Office managers should gather all old optical disks that are no longer needed.
You can do this by setting a specific place in the office where everyone can drop off disks they want destroyed.
Procurement staff should ensure the organisation has the right tools for disk destruction.
This might involve buying or hiring access to a device like a grinder or arranging with a specialised service that can burn or shred disks.
IT teams should coordinate the actual destruction of the disks.
Clearly schedule a regular time, like the end of every quarter, for destroying accumulated disks using the furnace, grinder, or cutter.
Security officers should document the disk destruction process.
This includes keeping a list of each disk destroyed, the method used, and the date of destruction, helping track and verify the process.
Management should communicate with staff about the importance of proper media destruction.
Hold a short training or send a memo explaining why disks need to be destroyed and ensuring everyone knows the procedure for depositing unwanted disks.
Keep it running
Use approved methods (furnace/incinerator, hammer mill, disintegrator, grinder/sander or cutting) and record disposal details, including method and date, for traceability.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The media destruction log: Request the documentation that records each destroyed disk, the method used, and who performed the destruction.
Look at
The log for detailed entries like dates and destruction methods.
Good evidence
Log clearly shows disks are regularly and thoroughly destroyed.
- Check 2 of 5What an auditor asks for
Ask for
To see the destruction equipment: Physically check the grinder, furnace, or other equipment used for disk destruction.
Look at
The equipment for signs of regular use and maintenance records. A well-maintained and operational tool shows the process is regularly followed.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of training or communication: Request records of memos or meetings that inform staff about media destruction processes.
Look at
Clear mentions of what to do with old disks. Good communication is regular and understandable by all staff members.
- Check 4 of 5What an auditor asks for
Ask for
To witness a destruction session: If possible, observe an actual disk destruction process.
Look at
The steps taken and ensure they're consistent with documented procedures.
Good evidence
Process is smooth, follows the guidelines, and results in unreadable, destroyed disks.
- Check 5 of 5What an auditor asks for
Ask for
Service contracts if using a third-party: Check contracts with external services for media destruction.
Look at
Terms that specify confidentiality and clear procedures.
Good evidence
Contract ensures secure, regular, and accountable destruction service.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1726 requires secure end-of-life handling by physically destroying optical disks using approved destruction methods. ISO/IEC 27001:2022 Annex A 7.10 covers managing storage media across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1726 fits within Annex A 7.10 as a specific disposal/destruction requirement for one media type, while Annex A 7.10 also includes acquisition, use and transportation controls not addressed by ISM-1726.
This control partially meets A.7.14.
ISM-1726 requires optical disks to be physically destroyed using specific methods (e.g. incineration, disintegration, grinding or cutting) to ensure data is unreadable. ISO/IEC 27001:2022 Annex A 7.14 requires storage media in equipment to have sensitive data removed or securely overwritten before disposal or re-use, which can be achieved via destruction for applicable media types. ISM-1726 is a specific, prescriptive implementation focused on optical disks, whereas Annex A 7.14 is broader and technology-agnostic across equipment and media types.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.