ASD ISM 1741 Implement IT equipment destruction procedures
What it says
IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and maintain processes for safely destroying IT equipment.
Implementing IT equipment destruction procedures means setting up a clear and safe way to permanently get rid of old computers, servers, or other technology. This is important because if you just throw away or sell old equipment without proper destruction, sensitive information could be retrieved by the wrong people, leading to data breaches or privacy violations.
Free. Save your status, tasks and notes.
Why it matters
Without documented equipment destruction procedures, retired devices may retain recoverable data, causing data breaches, compliance failures, financial loss and reputational damage.
How to implement
IT Team: Develop a clear procedure for destroying old IT equipment, including computers, servers, and other devices.
Use methods like degaussing, shredding, or crushing to ensure data is irretrievable.
Office Manager: Assign a person or team responsible for regularly reviewing which equipment needs destruction.
Make this part of routine maintenance schedules to ensure no devices slip through the cracks.
Procurement: Coordinate with certified e-waste disposal companies to handle the destruction process.
Choose a vendor who provides certificates of destruction as proof.
HR: Train staff to recognise what equipment falls under these procedures and why it's critical.
This includes educating them about the importance of securely managing sensitive data at all stages.
Finance: Budget for the costs associated with proper IT equipment destruction, including vendor services and staff training.
This ensures no corners are cut due to financial constraints.
Keep it running
Maintain documented destruction steps (sanitisation/shredding), chain-of-custody records and certificates of destruction; periodically verify vendors and sample-check destroyed assets.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The equipment destruction procedures document: Request to see the documented process for how IT equipment is to be destroyed in the organisation.
Look at
Whether the procedure includes steps for secure handling and disposal.
Good evidence
Detailed steps that reference specific destruction methods and timescales.
- Check 2 of 5What an auditor asks for
Ask for
Destruction records: Request recent records of destroyed equipment including dates, types of equipment, and methods used.
Look at
Whether there are entries within the established guidelines.
Good evidence
Consistent records showing recent and compliant destruction activities.
- Check 3 of 5What an auditor asks for
Ask for
Vendor agreements: Check copies of agreements or contracts with e-waste vendors.
Look at
Whether the agreement specifies the method of destruction and guarantees data erasure.
Good evidence
Contracts that have data destruction clauses and certifications.
- Check 4 of 5What an auditor asks for
Ask for
Certificates of destruction: Request certificates from the vendor for destroyed items.
Look at
Whether these certificates are detailed and reference specific items and dates.
Good evidence
Certificates linked to the equipment inventory and specific destruction records.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request records indicating staff have been trained on the equipment destruction process.
Look at
Whether training includes legal requirements and secure destruction methods.
Good evidence
Training logs showing names, dates, and completed training specific to data and equipment destruction.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.14.
ISM-1741 requires organisations to develop, implement and maintain end-to-end IT equipment destruction processes and supporting procedures. Annex A 7.14 requires secure disposal or re-use of equipment by verifying sensitive data and licensed software is removed or securely overwritten before disposal or re-use, which directly intersects with destruction activities for data-bearing assets. ISM-1741 is broader in procedural governance of destruction (e.g., methods, chain-of-custody, assurance, and ongoing maintenance of procedures), while Annex A 7.14 also covers re-use scenarios where destruction may not occur.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.