ASD ISM 1727 Methods for destroying semiconductor memory
What it says
Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSpecialised equipment like a furnace or hammer mill is used to destroy semiconductor memory to ensure security.
This control is about making sure that when you don't need your computer memory chips anymore, they're completely destroyed. If you don't do this properly, confidential data could be recovered by someone else later, posing a risk to your privacy and security.
Free. Save your status, tasks and notes.
Why it matters
Failure to physically destroy semiconductor memory can allow data recovery from chips, leading to leakage of sensitive information and compromise.
How to implement
IT team members should gather old or broken semiconductor memory from computers or devices that are no longer in use.
Collect them in a secure location to prevent loss or theft before destruction.
The IT manager should choose an appropriate method for destruction based on available resources.
This might involve finding a local company with a furnace that can securely incinerate the memory chips.
Procurement should ensure any third-party service providers used for destruction are reputable and follow security protocols, such as having necessary certifications.
Check references and industry standards before making a decision.
Facilities management should coordinate the physical transportation of semiconductor memory to the destruction site.
Ensure the transport is secure by using a sealed and tracked container.
Once the memory is destroyed, IT or an authorised third party should document the process with photos or a certificate.
This documentation should include date and method of destruction for records.
Keep it running
Regularly verify furnaces/incinerators, hammer mills or disintegrators meet required destruction outcomes, and record device IDs and destruction logs for audit.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Transportation records of semiconductor memory: Request documents or logs showing how the memory was transported to the destruction site.
Look at
The transport method details and security measures described.
Good evidence
Includes secure transport logs with dates and responsible parties clearly listed.
- Check 2 of 5What an auditor asks for
Ask for
Contracts with destruction service providers: Request to see the contracts that outline agreements with external companies that destroy memory for you.
Look at
Clauses detailing security measures and compliance.
Good evidence
Shows a signed agreement that mentions adherence to current security standards.
- Check 3 of 5What an auditor asks for
Ask for
Certificates or reports showing the destruction of memory.
Look at
The document details such as dates, quantities, and methods used.
Good evidence
Includes certificates that are specific and signed by the service provider.
- Check 4 of 5What an auditor asks for
Ask for
To see the procedure for memory destruction: Request the documented policy or procedure your organisation uses for this process.
Look at
Clear steps on how to collect, transport, and destroy memory securely.
Good evidence
Provides a detailed, step-by-step procedure with defined roles.
- Check 5 of 5What an auditor asks for
Ask for
Incident reports related to memory disposal: Request any records of security incidents connected to memory disposal issues.
Look at
Details on incidents and their resolutions.
Good evidence
Shows a low number of incidents with swift, documented responses.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1727 addresses secure end-of-life handling by mandating specific physical destruction methods for semiconductor memory. Annex A 7.10 requires storage media to be securely managed throughout its life cycle, including disposal, in line with classification and handling requirements. ISM-1727 is one specific disposal/destruction treatment within the broader life-cycle media management expectations of Annex A 7.10.
This control partially meets A.7.14.
ISM-1727 requires semiconductor memory to be physically destroyed using specialised destruction methods (e.g., furnace/incinerator, hammer mill, or disintegrator) to prevent data recovery. Annex A 7.14 mandates that sensitive data and licensed software be removed or securely overwritten before equipment is disposed of or re-used. It can be achieved via destruction where overwrite is not feasible. Annex A 7.14 is broader because it covers disposal and re-use of equipment generally, while ISM-1727 is a specific, prescriptive method for destroying semiconductor memory.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.