ASD ISM 1728 Handling media waste based on particle size
What it says
The resulting media waste particles from the destruction of SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, PROTECTED if greater than 3 mm and less than or equal to 6 mm, or SECRET if greater than 6 mm and less than or equal to 9 mm.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStore shredded media differently based on particle size: OFFICIAL up to 3 mm, PROTECTED up to 6 mm, SECRET up to 9 mm.
When you shred sensitive documents and materials, the pieces left over need to be handled carefully based on how small they are. This is important because if someone with bad intentions gets hold of these pieces, they might be able to piece together confidential information, potentially leading to data breaches or leaks that can harm your business or privacy.
Free. Save your status, tasks and notes.
Why it matters
If SECRET media waste particle sizes are not handled to the ≤3mm/3-6mm/6-9mm rules, fragments may be reconstructed, causing a classified data breach.
How to implement
The office manager should train staff on identifying and separating shredded waste based on particle size.
Use a simple ruler to check sizes: up to 3 mm are handled as standard waste, up to 6 mm as protected, and 9 mm as secret waste.
The procurement officer should ensure shredders are equipped to produce particles in the required size range.
Check the shredder specifications when purchasing and ensure they match your organisation's requirements for different levels of document security.
The facilities team should set up designated bins for different types of shredded waste.
Label them clearly according to the particle size and corresponding security classification (OFFICIAL, PROTECTED, SECRET).
Managers should develop a policy for the secure storage and disposal of shredded waste.
This includes instructions for staff to follow and partnership with a secure waste disposal service that is aware of your handling requirements based on particle size.
The security officer should periodically audit the storage and disposal system for shredded materials.
Ensure it aligns with the guidelines by checking that bins are correctly used and emptied by trusted service providers familiar with your organisation's security needs.
Keep it running
Measure shred particle sizes and label/store waste as OFFICIAL (≤3mm), PROTECTED (>3-6mm) or SECRET (>6-9mm); reject batches outside limits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's shredded waste management policy.
Look at
Whether it includes instructions on classifying waste by particle size.
Good evidence
Policy will have specific sections covering up to 3 mm as OFFICIAL, up to 6 mm as PROTECTED, and up to 9 mm as SECRET.
- Check 2 of 5What an auditor asks for
Ask for
Training records that show staff have been briefed on handling shredded waste.
Look at
Attendance sheets or certificates of completion related to especially the waste classification training.
Good evidence
Will include a training schedule, attendance lists, and feedback results.
- Check 3 of 5What an auditor asks for
Look at
How shredders were chosen or upgraded based on their shredding output size.
Good evidence
Document will show specifications of shredders versus required particle sizes.
- Check 4 of 5What an auditor asks for
Ask for
To view the designated storage areas for shredded waste.
Look at
Clearly labelled bins and whether staff are storing shredded waste correctly.
Good evidence
Setup will include bins marked according to the particle size classification and instructions for use.
- Check 5 of 5What an auditor asks for
Ask for
Contracts or service agreements with secure waste disposal companies.
Look at
Clauses about understanding and adhering to your waste particle size handling requirements.
Good evidence
Will demonstrate that the disposal company complies with your classifications and regularly handles waste on schedule.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.7.10.
ISM-1728 requires organisations to store and handle destroyed SECRET media waste at downgraded classifications based on the resulting particle size (e.g. OFFICIAL up to 3 mm). Annex A 7.10 requires storage media to be managed across its lifecycle, including disposal, in line with the organisation's classification and handling rules. ISM-1728 is a highly specific disposal/handling rule for shredded waste, whereas Annex A 7.10 is broader and covers end-to-end media lifecycle management and classification-aligned handling.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.