ASD ISM 1742 Destroy un-sanitizable IT equipment safely
What it says
IT equipment that cannot be sanitised is destroyed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIf IT equipment can't be cleaned properly, it must be destroyed to ensure security.
Sometimes, old computers or gadgets can't be properly wiped clean of sensitive data. In that case, it's important to physically destroy them so nobody can retrieve personal or business data. If we don't, this information could fall into the wrong hands, leading to privacy breaches or financial harm.
Free. Save your status, tasks and notes.
Why it matters
Failure to destroy unsanitiseable IT equipment may expose sensitive data via recovered media, causing reportable breaches and financial loss.
How to implement
IT team should identify devices: The IT staff should list all devices that can no longer be cleaned properly.
This involves checking devices like old computers, hard drives, and USB sticks to determine if they can be securely wiped or need destruction.
Managers should develop a destruction policy: Managers need to create a clear policy for destroying un-sanitizable equipment.
They should outline who is responsible, where destruction takes place, and how to keep records of destroyed items.
Procurement should select a certified service provider: The procurement team should hire a professional company that specialises in destroying IT equipment safely.
Choose a service provider with the necessary certifications from the Australian Cyber Security Centre (ACSC) to ensure compliance.
Staff should conduct destruction events: Arrange regular events where identified equipment is collected and destroyed.
IT staff should manage these events, ensuring the secure handling and transport of devices to the destruction site.
IT team should log destroyed equipment: After destruction, IT staff should document the process for each item.
Record details like the device type, serial number, date of destruction, and supervising staff member to maintain a secure audit trail.
Keep it running
Maintain a register of unsanitiseable assets and require vendor-certified physical destruction (e.g., shredding) with witnessed chain-of-custody records.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The destruction policy document: Request the written destruction policy from management.
Look at
The process defined for handling un-sanitizable equipment.
Good evidence
Policy will have clear roles, procedures, and compliant service providers listed.
- Check 2 of 5What an auditor asks for
Ask for
Destruction logs: Request the logs or records of destroyed equipment from the IT team.
Look at
The details recorded, such as device serial numbers and destruction dates.
Good evidence
Record is complete and shows that no device is overlooked.
- Check 3 of 5What an auditor asks for
Ask for
Service provider contracts: Request the contract with the equipment destruction service.
Look at
The certification and credentials of the provider.
Good evidence
Contract is with a provider accredited by the ACSC, proving their reliability in handling data destruction.
- Check 4 of 5What an auditor asks for
Ask for
To see a destruction event in progress: Request a demonstration or video of a destruction event.
Look at
The adherence to the outlined procedures and the secure transportation of devices.
Good evidence
Event is orderly and aligns with the policy.
- Check 5 of 5What an auditor asks for
Ask for
Staff training records: Request records of training sessions for staff on data destruction procedures.
Look at
The attendance and feedback from IT staff.
Good evidence
Record shows all relevant staff are trained and understand their roles.
Mappings
Closest match in ISO/IEC 27001: A.7.14, Secure disposal or re-use of equipment, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.7.14.
ISM-1742 requires that IT equipment that cannot be sanitised is destroyed to prevent residual data compromise. This overlaps with Annex A 7.14, which requires verification that sensitive data and licensed software are removed or securely overwritten prior to disposal or re-use, and implicitly requires secure handling when sanitisation is not feasible. Annex A 7.14 is broader across both disposal and re-use and focuses on verification and secure overwriting, whereas ISM-1742 is a specific mandate to destroy when sanitisation cannot be achieved.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.