ISO 27001 Annex A 7.10 Secure management of storage media
What it says
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization's classification scheme and handling requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishManage storage media safely from purchase to disposal based on your risk policies.
This control is about making sure any storage media, like USB drives or paper documents, are handled safely from the moment you buy them until you throw them out. If you don't do this, sensitive information can end up in the wrong hands, leading to data breaches or financial and reputational damage for your organisation.
Free. Save your status, tasks and notes.
Why it matters
Poor storage media lifecycle controls can cause data leakage or unauthorised access in transit or disposal, damaging reputation and compliance.
How to implement
The IT manager should develop a clear policy specifically for managing removable storage media.
This policy should include rules on how to store, use, and dispose of these items securely and must be communicated to all staff handling such media. Refer to ISO 27002:2022 for guidance on information classification and storage practices.
Procurement staff should ensure that all storage media are acquired from reputable suppliers who follow security standards.
This involves checking supplier credentials and reading through their security procedures to decide if they meet your organisation's requirements.
Office managers should ensure that storage media, such as USB sticks or external hard drives, are kept in secure locations when not in use.
This means using lockable cabinets or safes, and organising storage based on the sensitivity of the information they contain, as per Australian Privacy Act requirements.
An IT staff member should oversee the use of cryptographic techniques on storage media containing sensitive data.
This can be done by setting up encryption software and ensuring it is correctly applied before the media leaves the organisation, protecting against unauthorised access.
HR should train all employees on secure storage media handling practices, including proper disposal methods.
This training should cover how to securely delete or destroy media containing confidential information, following ISO 27001, ensuring staff understand the importance of these actions to prevent data breaches.
Keep it running
Classify and label media, record chain-of-custody for transport, encrypt where possible, and securely sanitise or shred media before disposal.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the organisation's policy on storage media management.
Look at
Check if the policy includes detailed procedures for acquisition, storage, use, and disposal of storage media.
Good evidence
The policy should be comprehensive, updated regularly, and be well-known by employees who handle storage media.
- Check 2 of 5What an auditor asks for
Ask for
Request a log of removed media and their current status.
Look at
Verify entries are complete, accurate and show who authorised the removal and what the media contained.
Good evidence
There should be a clear audit trail showing all movements of media up till disposal, including authorised sign-offs.
- Check 3 of 5What an auditor asks for
Ask for
Ask for training records and materials related to secure handling of storage media.
Look at
Ensure the training covers practical knowledge and is conducted regularly.
Good evidence
Training should be mandatory, with records showing up-to-date training completion for relevant staff.
- Check 4 of 5What an auditor asks for
Ask for
Request specific examples of encrypted storage media.
Look at
Ensure encryption technology is appropriate and currently applied as intended.
Good evidence
Encryption should be consistently applied to all sensitive media, with no unencrypted sensitive information stored on removable devices.
- Check 5 of 5What an auditor asks for
Ask for
Request evidence of secure disposal procedures, such as certificates from disposal companies.
Look at
Check if the disposal process is documented and disposal companies are vetted for security clearance.
Good evidence
Disposal records should show compliance with policies and confirm destruction through secure methods, with certificates from reputable providers.
Mappings
Closest match in ASD Information Security Manual: ISM-0831, Ensure proper handling of sensitive media, which asks for the same thing.
ASD Information Security Manual: 64 mappings
This control is equivalent to ISM-0831.
ISM-0831 requires media to be handled in a manner suitable for its sensitivity or classification. Annex A 7.10 similarly requires storage media to be managed across its life cycle (acquisition, use, transport and disposal) in accordance with classification and handling requirements. Both controls directly address classification-driven handling expectations for media, with Annex A 7.10 making the life-cycle stages explicit while ISM-0831 states the overarching requirement.
This control is broader than ISM-0307.
ISM-0307 requires sanitising IT equipment and associated media before maintenance or repairs when work is performed by a technician who is not appropriately cleared. Annex A 7.10 covers managing storage media across its entire life cycle, including handling, transport, and disposal, which encompasses sanitisation processes where required. ISM-0307 is a specific scenario-based requirement.
This control is broader than ISM-0312.
ISM-0312 mandates a specific handling outcome for overseas storage-bearing equipment that handled AUSTEO or AGAO data and cannot be sanitised in situ: return it to Australia for destruction. Annex A 7.10 requires lifecycle management of storage media, including transportation and disposal, aligned to classification and handling requirements. ISM-0312 fits as a specific, high-assurance transportation/disposal rule within the broader storage media lifecycle controls in Annex A 7.10.
This control is broader than ISM-0317.
ISM-0317 requires a specific sanitisation action for printer cartridges and MFD drums by printing three full pages of random text to eliminate residual stored image/data. This supports the life-cycle handling expectations in Annex A 7.10, which requires storage media to be managed through acquisition, use, transport and disposal in line with classification and handling requirements, including secure end-of-life treatment. ISM-0317 is a single procedural step for one niche medium, while Annex A 7.10 covers broader media governance and controls beyond sanitisation.
This control is broader than ISM-0318.
ISM-0318 requires organisations to destroy printer cartridges or MFD print drums when they cannot be sanitised, treating them as electrostatic memory devices. This relates directly to Annex A 7.10, which requires secure life-cycle management of storage media including disposal in line with classification and handling requirements. Annex A 7.10 is broader because it covers all storage media across acquisition, transport, use and disposal, whereas ISM-0318 is a specific disposal treatment for a particular media type.
This control is broader than ISM-0323.
ISM-0323 requires media to be classified to the highest sensitivity/classification of the data it stores. ISO/IEC 27001:2022 Annex A 7.10 mandates that storage media be managed according to the organisation's classification scheme throughout its lifecycle. ISM-0323 informs the classification value that drives the handling requirements in Annex A 7.10, which covers broader lifecycle management beyond classification.
This control is broader than ISM-0325.
ISM-0325 requires reclassifying media to the higher sensitivity/classification when it is connected to a more sensitive system, with an exception for read-only media or enforced read-only access. Annex A 7.10 requires secure lifecycle management of storage media in accordance with the organisation's classification and handling requirements. ISM-0325 is a specific handling/labelling escalation rule within the broader media management lifecycle covered by Annex A 7.10.
This control is broader than ISM-0330.
ISM-0330 requires that before media is reclassified to a lower sensitivity or classification, it is sanitised or destroyed and a formal administrative decision is made to reclassify it. ISO/IEC 27001:2022 Annex A 7.10 governs secure management of storage media across its full lifecycle, including disposal, in accordance with classification and handling requirements, which encompasses sanitisation activities. ISM-0330 is a specific rule within that broader lifecycle management requirement, adding an explicit reclassification trigger and decision point.
This control is broader than ISM-0337.
ISM-0337 requires media to only be used with systems authorised for its classification. Annex A 7.10 covers the full lifecycle management of storage media, aligning classification and handling requirements. Within this broader control, ISM-0337's focus on authorised system use is a specific aspect.
This control is broader than ISM-0350.
ISM-0350 requires organisations to destroy storage media that cannot be sanitised, including types like microfiche, microfilm, optical discs, ROM/PROM, before disposal. This aligns with Annex A 7.10's requirement for secure management of storage media throughout its lifecycle, including disposal, according to classification and handling guidelines. ISM-0350 is a specific disposal requirement within the broader lifecycle management expectations of Annex A 7.10.
This control is broader than ISM-0351.
ISM-0351 requires volatile media to be sanitised by removing power for at least 10 minutes to clear residual data. Annex A 7.10 requires secure management of storage media across its lifecycle, including disposal, consistent with classification and handling requirements. ISM-0351 is one specific sanitisation method that can sit within the broader storage media lifecycle management expected by Annex A 7.10.
This control is broader than ISM-0352.
ISM-0352 requires SECRET and TOP SECRET volatile media to be sanitised by overwriting the entire medium at least once with a random pattern and then performing a read-back verification. Annex A 7.10 covers secure management of storage media across its full lifecycle (acquisition, use, transport and disposal) in line with classification and handling requirements, which includes sanitisation expectations. ISM-0352 is a specific, high-assurance sanitisation method for a particular classification and media type, whereas Annex A 7.10 is broader lifecycle governance and handling.
This control is broader than ISM-0354.
ISM-0354 requires non-volatile magnetic media to be sanitised by overwriting the entire medium with a random pattern (with specified pass requirements) and verifying by read-back. ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed securely across its lifecycle, including disposal, in line with classification and handling rules, which would encompass having sanitisation methods for media. ISM-0354 is a specific technical sanitisation method for one media type, whereas Annex A 7.10 is broader lifecycle governance covering acquisition, use, transport and disposal.
This control is broader than ISM-0356.
ISM-0356 requires organisations to continue treating sanitised SECRET and TOP SECRET non-volatile magnetic media as retaining its original classification. Annex A 7.10 addresses secure management of storage media across its lifecycle, including disposal and re-use, in accordance with classification and handling requirements, which includes maintaining correct classification controls for media after sanitisation. ISM-0356 is narrower and more explicit (classification persistence for specific high classifications and media), while Annex A 7.10 is broader lifecycle media governance.
This control is broader than ISM-0357.
ISM-0357 requires a precise EPROM sanitisation procedure to ensure data is irrecoverable, including verification by read back. Annex A 7.10 requires organisations to manage storage media across its lifecycle (acquisition, use, transport, disposal) according to classification and handling rules, within which sanitisation prior to disposal/re-use is a key activity. ISM-0357 only covers one media type and one sanitisation approach, whereas Annex A 7.10 covers governance and handling controls for many media types and scenarios.
This control is broader than ISM-0358.
ISM-0358 requires that after any sanitisation attempt, SECRET and TOP SECRET non-volatile EPROM/EEPROM media must still be handled as retaining its original classification. Annex A 7.10 requires storage media to be managed through acquisition, use, transport and disposal in accordance with the organisation's classification scheme and handling requirements. ISM-0358 is a highly specific classification-handling rule for particular memory technologies and high classifications, whereas Annex A 7.10 is a general lifecycle control that would typically be implemented via policies/procedures that can incorporate ISM-0358's exception rule.
This control is broader than ISM-0359.
ISM-0359 mandates a specific sanitisation technique for non-volatile flash memory (double random overwrite plus read-back verification). Annex A 7.10 governs secure management of storage media across its lifecycle, including disposal activities where sanitisation may be required by classification and handling rules. ISM-0359 fits within the disposal/sanitisation portion of media lifecycle management, but Annex A 7.10 also covers acquisition, transport, custody and general handling beyond sanitisation.
This control is broader than ISM-0361.
ISM-0361 requires magnetic media to be destroyed using a degausser with suitable magnetic field strength and correct magnetic orientation. This relates directly to Annex A 7.10, which requires secure management of storage media across its lifecycle, including disposal, in line with classification and handling requirements. ISM-0361 is a specific technical method for the disposal/destruction phase that would sit within the broader media lifecycle controls of Annex A 7.10.
This control is broader than ISM-0362.
ISM-0362 specifies adherence to manufacturer directions for degaussing magnetic media as a sanitisation measure. Annex A 7.10 entails comprehensive media management throughout its lifecycle, including disposal in compliance with handling guidelines, incorporating sanitisation like degaussing. Thus, ISM-0362 is a detailed aspect of the broader lifecycle management in Annex A 7.10.
This control is broader than ISM-0363.
ISM-0363 requires organisations to establish and maintain media destruction processes and procedures to securely dispose of data-bearing media. ISO/IEC 27001:2022 Annex A 7.10 covers secure management of storage media across its full lifecycle, explicitly including acquisition, use, transportation and disposal in line with classification and handling requirements. Media destruction is one component of lifecycle management, so ISM-0363 is a subset of Annex A 7.10 with a deeper focus on the destruction/disposal procedures themselves.
This control is broader than ISM-0368.
ISM-0368 requires media destruction to a defined particle size (≤9 mm) as an anti-recovery measure. This directly supports Annex A 7.10, which requires storage media to be securely managed across its lifecycle including disposal in line with handling requirements. Annex A 7.10 is broader across acquisition, transport and disposal methods, whereas ISM-0368 specifies one measurable destruction outcome for disposal/destruction.
This control is broader than ISM-0370.
ISM-0370 requires media destruction to be carried out under the supervision of at least one cleared person. This is a specific handling requirement for the disposal stage of the media life cycle that Annex A 7.10 requires to be managed in line with the organisation's classification scheme and handling requirements. Annex A 7.10 also covers acquisition, use and transportation of media, which ISM-0370 does not address.
This control is broader than ISM-0371.
ISM-0371 requires organisations to supervise media destruction end-to-end, ensuring the media is controlled to the point of destruction and that destruction is successful. Annex A 7.10 relates by requiring storage media to be managed across its full lifecycle, including acquisition, use, transport and disposal, in line with classification and handling requirements. ISM-0371 is a specific control within the broader media lifecycle management expectations of Annex A 7.10, focusing specifically on supervision during destruction/disposal.
This control is broader than ISM-0372.
ISM-0372 requires the destruction of media storing accountable material to be supervised by at least two cleared personnel. This is a specific, heightened handling requirement for the disposal stage of the media life cycle that Annex A 7.10 requires to follow the organisation's classification scheme and handling requirements. Annex A 7.10 also covers acquisition, use and transportation of all storage media.
This control is broader than ISM-0374.
ISM-0374 requires organisations to develop, implement and maintain procedures for securely disposing of media. Annex A 7.10 requires storage media to be managed through its full life cycle, explicitly including acquisition, use, transportation and disposal in line with classification and handling requirements. ISM-0374 aligns to the disposal component only, while Annex A 7.10 is broader by covering governance and controls across the entire media lifecycle.
This control is broader than ISM-0375.
ISM-0375 requires a formal administrative decision to release storage media or its waste into the public domain following sanitisation, destruction or declassification. Annex A 7.10 requires storage media to be managed across its full lifecycle (acquisition to disposal) in line with classification and handling requirements, which encompasses disposal and release controls. ISM-0375 is a specific governance gate within the broader lifecycle management requirement in Annex A 7.10.
This control is broader than ISM-0378.
ISM-0378 requires organisations to remove identifying labels and markings from media prior to disposal to prevent traceability and inadvertent disclosure. ISO/IEC 27001:2022 Annex A 7.10 requires secure management of storage media across its full lifecycle, including acquisition, handling, transport and disposal, aligned to classification and handling rules. ISM-0378 is a specific disposal control that fits within the broader media lifecycle governance required by Annex A 7.10.
This control is broader than ISM-0836.
ISM-0836 requires sanitising EEPROM by fully overwriting it with a random pattern and verifying the overwrite via read back. This relates to ISO/IEC 27001:2022 Annex A 7.10 because sanitisation and secure handling at end-of-life are part of managing storage media through its lifecycle in accordance with classification and handling requirements. Annex A 7.10 is broader lifecycle governance including acquisition, use, transport, and disposal, whereas ISM-0836 is a specific technical sanitisation technique for one non-volatile media type.
This control is broader than ISM-0839.
ISM-0839 requires that destruction of media storing accountable material is not outsourced, keeping media destruction under the organisation's direct control. Annex A 7.10 requires secure life-cycle management of storage media, including disposal, in line with classification and handling requirements, which can include controls over who performs destruction. Annex A 7.10 is broader because it covers acquisition, use, transport and disposal, while ISM-0839 is a specific prohibition focused only on outsourcing the destruction step.
This control is broader than ISM-0947.
ISM-0947 requires sanitising rewritable media after each manual transfer of data between different security domains. Annex A 7.10 requires storage media be managed across its lifecycle in line with classification and handling requirements, which would include controls for secure handling and cleansing where appropriate. ISM-0947 is a specific procedural requirement within the broader media-management lifecycle, with a narrower focus on cross-domain transfer and post-transfer sanitisation.
This control is broader than ISM-1059.
ISM-1059 mandates encryption of all data stored on media as a fundamental security measure. Annex A 7.10 governs storage media management across its lifecycle, including acquisition, use, transport, and disposal according to classification and handling requirements, where encryption is a critical component for compliance. Annex A 7.10 is broader due to its inclusion of governance and procedure-related controls beyond just encryption.
This control is broader than ISM-1065.
ISM-1065 requires resetting HPA and DCO on non-volatile magnetic hard drives prior to sanitisation to prevent hidden storage areas persisting after a wipe. Annex A 7.10 addresses secure management of storage media across its lifecycle, including disposal handling requirements where sanitisation expectations are typically governed. ISM-1065 is a specific technical requirement within the broader lifecycle media management practices set by Annex A 7.10.
This control is broader than ISM-1067.
ISM-1067 addresses secure erasure of non-volatile magnetic hard drives by mandating ATA Secure Erase plus block overwriting to cover hidden/remapped sectors such as the growth defects table. Annex A 7.10 requires storage media to be managed through its lifecycle, including disposal, in line with classification and handling requirements. ISM-1067 provides a concrete sanitisation technique that supports implementing the disposal/sanitisation component of Annex A 7.10, but Annex A 7.10 also covers broader lifecycle controls (e.g. acquisition, transport, custody) that ISM-1067 does not.
This control is broader than ISM-1160.
ISM-1160 specifies an approved standard for degaussing equipment when degaussing is used to destroy storage media. Annex A 7.10 covers secure management of storage media across its full life cycle, including disposal, and therefore includes the need for appropriate sanitisation/destruction controls when media reaches end of life. Annex A 7.10 is broader life-cycle governance, whereas ISM-1160 is a prescriptive control for selecting an evaluated degausser within that disposal/destruction activity.
This control is broader than ISM-1361.
ISM-1361 requires that when destroying media, organisations use SC&E Committee-approved or ASIO-approved destruction equipment. ISO/IEC 27001:2022 Annex A 7.10 covers management of storage media across its full lifecycle, including disposal, to meet classification and handling requirements. ISM-1361 is a specific implementation requirement within the disposal/destruction portion of Annex A 7.10 rather than covering lifecycle management overall.
This control is broader than ISM-1517.
ISM-1517 requires microfiche and microfilm to be destroyed using equipment that reduces the microform to a fine powder, with no particle showing more than five consecutive characters. This is a specific disposal requirement for one media type within the storage media life cycle that Annex A 7.10 requires to be managed, including disposal in line with classification and handling requirements. Annex A 7.10 covers all storage media across acquisition, use, transport and disposal, while ISM-1517 prescribes only the destruction standard for microform.
This control is broader than ISM-1600.
ISM-1600 requires media to be sanitised before it is used for the first time to prevent introduction of unwanted or residual data. Annex A 7.10 requires storage media to be managed across its full life cycle (acquisition, use, transport and disposal) in line with classification and handling rules, which would include establishing controls for initial preparation of media. ISM-1600 is a specific, point-in-time requirement (initial use), whereas Annex A 7.10 is broader governance over multiple stages and handling scenarios.
This control is broader than ISM-1641.
ISM-1641 mandates a specific end-of-life handling step for magnetic media: once degaussed, it must be physically damaged to defeat recovery. This fits within Annex A 7.10's lifecycle management of storage media, particularly the disposal phase where handling must align to classification and secure media processes. Annex A 7.10 covers many additional lifecycle activities (acquisition, transport, storage, tracking), whereas ISM-1641 only addresses a specific destruction technique for one media type and scenario.
This control is broader than ISM-1722.
ISM-1722 requires electrostatic memory devices to be physically destroyed using specific methods (e.g. furnace/incinerator, hammer mill, disintegrator, grinder/sander). Annex A 7.10 requires storage media to be securely managed across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1722 is a specific disposal/destruction implementation within the broader life-cycle media management expectations of Annex A 7.10.
This control is broader than ISM-1723.
ISM-1723 mandates secure end-of-life handling for one specific removable medium type by specifying acceptable destruction methods for magnetic floppy disks. Annex A 7.10 requires storage media to be managed across its full life cycle (acquisition through disposal) in line with classification and handling requirements, which includes secure disposal/destruction practices. ISM-1723 fits within the disposal portion of Annex A 7.10 but does not address the broader life-cycle governance and handling controls.
This control is broader than ISM-1724.
ISM-1724 requires magnetic hard disks to be destroyed using specific approved destruction methods (e.g., incineration, grinding or degaussing). ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed securely across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1724 fits within Annex A 7.10 as a prescriptive disposal/destruction requirement for one media type, while Annex A 7.10 is broader and less prescriptive about exact destruction techniques.
This control is broader than ISM-1725.
ISM-1725 requires magnetic tapes to be destroyed using approved physical or magnetic destruction methods (e.g. incineration, disintegration, degaussing, or cutting) to prevent data recovery. This relates directly to Annex A 7.10, which requires storage media to be securely managed across its lifecycle, including disposal, in line with classification and handling requirements. ISM-1725 is a specific prescriptive disposal/destruction requirement for one media type (magnetic tape), whereas Annex A 7.10 is broader lifecycle media management across many media types and scenarios.
This control is broader than ISM-1726.
ISM-1726 requires secure end-of-life handling by physically destroying optical disks using approved destruction methods. ISO/IEC 27001:2022 Annex A 7.10 covers managing storage media across its full life cycle, including disposal, in line with classification and handling requirements. ISM-1726 fits within Annex A 7.10 as a specific disposal/destruction requirement for one media type, while Annex A 7.10 also includes acquisition, use and transportation controls not addressed by ISM-1726.
This control is broader than ISM-1727.
ISM-1727 addresses secure end-of-life handling by mandating specific physical destruction methods for semiconductor memory. Annex A 7.10 requires storage media to be securely managed throughout its life cycle, including disposal, in line with classification and handling requirements. ISM-1727 is one specific disposal/destruction treatment within the broader life-cycle media management expectations of Annex A 7.10.
This control is broader than ISM-1728.
ISM-1728 requires organisations to store and handle destroyed SECRET media waste at downgraded classifications based on the resulting particle size (e.g. OFFICIAL up to 3 mm). Annex A 7.10 requires storage media to be managed across its lifecycle, including disposal, in line with the organisation's classification and handling rules. ISM-1728 is a highly specific disposal/handling rule for shredded waste, whereas Annex A 7.10 is broader and covers end-to-end media lifecycle management and classification-aligned handling.
This control is broader than ISM-1729.
ISM-1729 requires organisations to store and handle TOP SECRET media destruction waste at a downgraded classification based on particle size thresholds (≤3 mm as OFFICIAL; >3 mm to ≤9 mm as SECRET). This relates directly to Annex A 7.10, which requires storage media to be managed across its lifecycle (including disposal) in line with the organisation's classification and handling scheme. ISM-1729 is a highly specific, prescriptive rule for a particular disposal by-product, whereas Annex A 7.10 is broader and principles-based across all media types and lifecycle stages.
This control is broader than ISM-1735.
ISM-1735 requires that media which cannot be successfully sanitised is physically destroyed before disposal. Annex A 7.10 requires secure management of storage media across its full lifecycle, including disposal, in line with classification and handling requirements. ISM-1735 is a specific end-of-life treatment (destruction when sanitisation fails) within the broader lifecycle governance expected by Annex A 7.10.
This control is broader than ISM-1866.
ISM-1866 requires that personnel using privately-owned devices to access OFFICIAL: Sensitive or PROTECTED systems/data are prevented from storing classified data on those private devices. ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed across its life cycle in line with classification and handling requirements, which includes controlling where classified data may be stored. Annex A 7.10 is broader (covers all storage media and full life-cycle handling), while ISM-1866 is a specific prohibition focused on BYOD/private endpoints.
This control is broader than ISM-2098.
ISM-2098 requires mobile devices to be configured to prevent data transfers over USB connections. ISO/IEC 27001:2022 Annex A 7.10 requires secure management of storage media across its lifecycle, which includes controlling the use of removable media and interfaces that enable copying to/from such media. ISM-2098 is a specific technical enforcement mechanism (USB data blocking on mobiles) that fits within the broader storage media governance required by Annex A 7.10.
This control partially meets ISM-0316.
ISM-0316 requires a formal administrative decision to release IT equipment into the public domain after sanitisation, destruction or declassification. ISO/IEC 27001:2022 Annex A 7.10 addresses secure management of storage media across its entire life cycle, including disposal, aligned to classification and handling requirements. ISM-0316 is a specific end-of-life governance checkpoint within the broader life-cycle media management expectations of Annex A 7.10.
This control partially meets ISM-1550.
ISM-1550 requires organisations to develop, implement and maintain procedures for disposing of IT equipment. Annex A 7.10 governs storage media management across the full lifecycle (acquisition, use, transport and disposal) aligned to classification and handling requirements, and disposal procedures are one lifecycle component. ISM-1550 is therefore a specific subset focused on disposal, whereas Annex A 7.10 is broader and includes multiple phases and control points beyond disposal.
This control partially overlaps ISM-0311.
Annex A 7.10 requires storage media to be managed securely across its lifecycle, including secure disposal consistent with classification and handling requirements. ISM-0311 overlaps by mandating sanitisation of IT equipment containing media, either by removing the media or sanitising in situ, which is a core disposal/reuse safeguard. ISM-0311 is focused on sanitisation at disposal or reallocation, whereas Annex A 7.10 additionally includes acquisition, transportation, and ongoing handling controls.
This control partially overlaps ISM-0313.
ISM-0313 requires organisations to develop, implement and maintain IT equipment sanitisation processes and procedures. Annex A 7.10 overlaps because lifecycle management of storage media (including disposal) typically includes sanitisation/secure erasure steps and handling requirements that drive when and how sanitisation occurs. Annex A 7.10 is broader across the entire storage media lifecycle (acquisition, transport, handling), whereas ISM-0313 is focused specifically on sanitisation processes for IT equipment.
This control partially overlaps ISM-0315.
ISM-0315 requires physical destruction of high assurance IT equipment before disposal to prevent residual data exposure. Annex A 7.10 requires storage media to be managed across its lifecycle, including disposal, in line with classification and handling requirements. The overlap is specifically in the disposal stage for media/equipment that could contain sensitive data, but Annex A 7.10 is broader lifecycle governance while ISM-0315 mandates a particular disposal outcome (destruction) for a defined class of equipment.
This control partially overlaps ISM-0343.
ISM-0343 requires organisations to disable write functionality to removable media unless there is a clear business requirement, reducing the risk of data loss and malware introduction via portable devices. Annex A 7.10 focuses on the secure management of storage media across its lifecycle (acquisition, use, transport, disposal), which includes governance over how removable media is used and controlled. They overlap on controlling removable media use, but Annex A 7.10 is broader lifecycle management while ISM-0343 is a specific technical restriction on writing via device/interface controls.
This control partially overlaps ISM-0348.
ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures. ISO/IEC 27001:2022 Annex A 7.10 requires secure management of storage media across acquisition, use, transport, and disposal, where sanitisation is a key control for disposal and reuse stages. Annex A 7.10 covers the full storage media life cycle and classification/handling alignment, while ISM-0348 focuses specifically on establishing and maintaining the sanitisation process and procedures.
This control partially overlaps ISM-0360.
ISM-0360 requires that after sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification and must continue to be handled as classified. This relates to ISO/IEC 27001:2022 Annex A 7.10 because it requires storage media to be managed across its lifecycle in accordance with the organisation's classification scheme and handling requirements. The overlap is specifically around post-sanitisation handling/controls for media, but Annex A 7.10 is broader (all media, all classifications) and does not mandate the ISM's specific rule that sanitised flash media at SECRET/TOP SECRET retains classification.
This control partially overlaps ISM-0462.
ISM-0462 requires that authenticating to encryption does not reduce the sensitivity/classification of IT equipment or media while the user remains authenticated. Annex A 7.10 requires storage media to be managed through its lifecycle in accordance with classification and handling requirements, which includes ensuring encrypted media is still handled as per its classified contents. Annex A 7.10 is broader across lifecycle activities (transport/disposal), while ISM-0462 is specifically about how classification is treated during an encryption-authenticated session.
This control partially overlaps ISM-0835.
ISM-0835 addresses the requirement that sanitised TOP SECRET volatile media can still be treated as TOP SECRET based on storage duration and write-pattern persistence risk. ISO/IEC 27001:2022 Annex A 7.10 requires storage media to be managed through its life cycle in accordance with the organisation's classification scheme and handling requirements, which includes decisions about how media is classified and handled after sanitisation. ISM-0835 is a specific rule for one media type and classification edge case, while Annex A 7.10 is a general life-cycle media management control.
This control partially overlaps ISM-0840.
ISM-0840 addresses secure disposal by requiring a certified outsourced destruction service for media holding non-accountable material. Annex A 7.10 requires storage media to be managed securely through its full lifecycle, including transportation and disposal, in line with classification and handling requirements. They overlap on disposal and third-party handling risks, but Annex A 7.10 is broader across all media lifecycle stages and does not prescribe NAID AAA/PSC-167 certification as ISM-0840 does.
This control partially overlaps ISM-1217.
Annex A 7.10 requires organisations to manage storage media (and associated handling requirements) securely through to disposal. ISM-1217 supports secure disposal by requiring identifying labels on IT equipment to be removed before disposal to reduce association and sensitivity leakage. ISM-1217 is narrower, focusing on label/marking removal for equipment, and does not address other phases like acquisition, transport, or sanitisation covered by Annex A 7.10.
This control partially overlaps ISM-1299.
ISM-1299 instructs personnel to handle mobile devices and removable media securely (e.g. do not leave unattended, do not lend to untrusted people, avoid reusing removable media used with other parties, and scan media for malicious code). This supports ISO/IEC 27001:2022 Annex A 7.10 by providing concrete user-facing practices for safe use and transportation of storage media within its lifecycle. Annex A 7.10 is broader and process-oriented (acquisition through disposal) across all media types, whereas ISM-1299 focuses on day-to-day end-user precautions for mobile devices and associated removable media.
This control partially overlaps ISM-1300.
ISM-1300 requires that after overseas travel, mobile devices and any removable media are sanitised and reset, and any credentials that left the user's possession are decommissioned, with escalation when integrity is in doubt. Annex A 7.10 covers secure management of storage media across its lifecycle, including transportation and disposal, which aligns with the need to control and handle removable media taken overseas and to apply secure disposal/sanitisation on return. Annex A 7.10 does not address mobile device re-imaging or credential decommissioning, while ISM-1300 is a travel-return remediation control rather than a full media lifecycle management requirement.
This control partially overlaps ISM-1418.
ISM-1418 requires organisations to disable reading from removable media and devices where there is no business requirement, using device access control or by disabling external interfaces. Annex A 7.10 requires storage media to be managed across its lifecycle (acquisition, use, transport and disposal) in line with classification and handling requirements, which includes controlling how removable media is used. ISM-1418 is a specific technical prevention measure (disable access), whereas Annex A 7.10 is broader governance and handling across the full media lifecycle (including situations where media use is permitted).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.