ASD ISM 1735 Destroy unsanitised media before disposal
What it says
Media that cannot be successfully sanitised is destroyed prior to its disposal.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMedia that can't be safely sanitised should be destroyed before being thrown away.
Before throwing away old or unusable media like computer hard drives, CDs, or USB sticks, they need to be completely destroyed if they can't be safely wiped clean. If someone finds your discarded media and can still access the information on them, your business might suffer from data breaches that could lead to privacy violations or financial loss.
Free. Save your status, tasks and notes.
Why it matters
If unsanitised media is disposed of without destruction, attackers may recover sensitive data, causing breaches, legal action and financial loss.
How to implement
The office manager should identify all types of media used in the organisation, such as hard drives, USBs, and DVDs, and make a list of those that cannot be sanitised.
They should class unsanitised media based on their usefulness or obsolescence and then plan for their destruction.
The IT team should safely destroy unsanitised media.
They can do this by using a shredder designed for electronics, degaussing (which involves scrambling the data with a powerful magnet), or physically breaking the media beyond repair.
The IT team should set up a regular schedule for media destruction.
How: Once a month, they should collect all unsanitised media marked for destruction and process them using the appropriate methods. This keeps your media disposal strategy consistent and secure.
An office manager or designated staff should coordinate with a professional destruction service if in-house destruction isn't possible.
How: Contact a specialist service, check credentials, arrange pick-up, and get certification of destruction for record-keeping.
Training should be provided by the HR or security officer to staff on identifying sensitive media types and the procedures for their destruction.
How: Include guidelines in onboarding sessions and refreshers in annual security training to ensure everyone knows not to dispose of unsanitised media in regular trash.
Keep it running
Identify unsanitised media, quarantine it, and destroy it via approved shredding or degaussing before disposal; keep destruction records.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of media that have been marked for destruction: Request to see a log that details each item with its identification number.
Look at
Dates and media types on the log.
Good evidence
Sign is a detailed list showing regular activity and items being processed as expected.
- Check 2 of 5What an auditor asks for
Good evidence
Outcome: certificates that match up with internal records and are recent.
- Check 3 of 5What an auditor asks for
Ask for
A demonstration or explanation of the media destruction process to understand how it's carried out.
Look at
How they ensure the media is completely destroyed. It's effective if the process leaves the media unrecoverable.
- Check 4 of 5What an auditor asks for
Ask for
The schedule of media destruction events. Look to see that they are frequent enough to prevent the build-up of unused media.
Good evidence
Practice: a regular schedule, like monthly or quarterly, that matches the organisation's needs.
- Check 5 of 5What an auditor asks for
Good evidence
Indicator: comprehensive training material that explains how and why to handle unsanitised media safely.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-1735 requires that media which cannot be successfully sanitised is physically destroyed before disposal. Annex A 7.10 requires secure management of storage media across its full lifecycle, including disposal, in line with classification and handling requirements. ISM-1735 is a specific end-of-life treatment (destruction when sanitisation fails) within the broader lifecycle governance expected by Annex A 7.10.
This control partially overlaps A.7.14.
ISM-1735 requires that media which cannot be successfully sanitised is destroyed prior to disposal. Annex A 7.14 requires verification that sensitive data and licensed software has been removed or securely overwritten before equipment disposal or re-use. They overlap on preventing residual data exposure at end-of-life, but ISM-1735 uniquely mandates physical destruction where sanitisation is not achievable, while Annex A 7.14 focuses on data removal/overwriting and includes re-use scenarios.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.