search account_circle

policyASD ISM

Guidelines for media

56 controls in this part of theAustralian Government Information Security Manual. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Media destruction

Destroy Unsanitizable Media Before Disposal

Media that can't be cleaned of data must be destroyed before getting rid of it.

Using Degaussers for Magnetic Media Destruction

Magnetic media is destroyed by ensuring the degausser has the right strength and orientation of the

Follow Manufacturer's Directions for Degaussing

Ensure magnetic media is degaussed according to the manufacturer's instructions to properly erase da

Develop and Maintain Media Destruction Processes

Ensure your organisation creates and follows proper media destruction procedures to securely dispose

Ensuring Media Particles Are No Larger Than 9 mm

Destroy media so resulting particles are no bigger than 9 mm to prevent data recovery.

Supervise Media Destruction with Cleared Personnel

Ensure destroyed media is supervised by a qualified person for security purposes.

Ensure Proper Supervision of Media Destruction

Staff must oversee media destruction to ensure it is done correctly and completely.

Supervision of Media Destruction Procedures

Media destruction must be overseen by at least two security-cleared staff members.

Supervise and Certify Accountable Material Destruction

Supervisors ensure accountable material is destroyed properly and sign a certificate to confirm it.

Prohibit Outsourcing of Media Destruction

Do not allow external companies to destroy media with sensitive data.

Certified Services for Outsourced Media Destruction

Use certified services for destroying non-accountable material to ensure security and compliance wit

Use NSA-evaluated Degaussers for Media Destruction

Only use NSA-approved degaussers to securely erase data from storage media.

Use Approved Equipment for Media Destruction

Use officially approved devices for destroying media to ensure proper disposal.

Microform Destruction Using Fine Powder Method

Machines destroy microfiche by turning them into fine powder so no more than five characters remain

Ensure Degaussed Media is Physically Damaged

After using a degausser, damage internal components of magnetic media to prevent data recovery.

Methods for Destroying Electrostatic Memory Devices

Use specialised machines or incineration to securely destroy memory storage devices.

Methods for Destroying Magnetic Floppy Disks

Magnetic floppy disks should be destroyed by burning, grinding, degaussing, or cutting to prevent da

Methods for Destroying Magnetic Hard Disks

Magnetic hard drives must be destroyed using specific approved methods, like incinerating or degauss

Methods for Destroying Magnetic Tapes

Magnetic tapes should be destroyed using specific methods like incineration or degaussing to ensure

Methods for Destructing Optical Disks

Optical disks should be destroyed using various methods like incineration or grinding to ensure data

Methods for Destroying Semiconductor Memory

Specialised equipment like a furnace or hammer mill is used to destroy semiconductor memory to ensur

Handling Media Waste Based on Particle Size

Store shredded media differently based on particle size: OFFICIAL up to 3 mm, PROTECTED up to 6 mm,

Storage Classification of Media Waste Particles

Store destroyed TOP SECRET media waste as OFFICIAL if under 3 mm, or as SECRET if 3-9 mm.

Media disposal

Develop and Maintain Media Disposal Procedures

Organisations must create and uphold procedures for securely disposing of media.

Decide on Public Release of Data Storage Media

After data is erased or destroyed, a formal decision allows media to be sent to the public.

Remove Labels from Media Before Disposal

Remove all identifying labels from media before throwing it away to ensure no information can be tra

Media sanitisation

Develop and Maintain Media Sanitisation Procedures

Organisations must create, apply, and keep up media sanitisation methods and procedures.

Proper Method for Volatile Media Sanitisation

Turn off power to the storage device for 10 minutes to fully clear data.

Secure Volatile Media by Overwriting with Random Data

Ensure SECRET and TOP SECRET media are made unreadable by overwriting with random data and verifying

Ensuring Proper Sanitisation of Magnetic Media

Erase non-volatile magnetic media by overwriting with random data, ensuring old data cannot be acces

Classify Magnetic Media After Sanitisation

After cleaning, classified magnetic media must still be treated as classified.

Sanitising Non-volatile EPROM Media

Erase and overwrite EPROM with UV exposure and a random pattern to ensure data is completely removed

Classification Retention for Sanitised EPROM and EEPROM

Even after erasure, certain memory devices stay classified as SECRET or TOP SECRET.

Proper Sanitisation of Non-Volatile Flash Memory

Non-volatile flash memory is wiped by overwriting it twice with random data, then checked to ensure

Classification Retention After Flash Memory Sanitisation

Even after being sanitised, flash drives for SECRET and TOP SECRET still need to be treated as class

Overwriting EEPROM for Complete Data Sanitisation

Erase EEPROM data by overwriting it with random data and checking it to ensure it's properly wiped.

Reset Device Settings Before Media Sanitisation

Reset hidden and configuration settings on hard drives before erasing them to ensure nothing is over

Secure Erase for Non-Volatile Magnetic Media

Use secure erase plus software to fully overwrite data on hard drives, including hidden areas.

Destroy Unsanitised Media Before Disposal

Media that can't be safely sanitised should be destroyed before being thrown away.

Media Sanitisation

TOP SECRET Volatile Media Retains Classification After Sanitisation

Volatile media (memory that normally loses its contents when power is removed, such as RAM modules)

Media usage

Classifying Media by Data Sensitivity

Media should be classified by the highest level of data sensitivity it contains.

Reclassify Media to Higher Sensitivity

Media connected to more sensitive systems is upgraded to match the highest security level.

Proper Sanitisation and Reclassification of Media

Before lowering media classification, it must be cleaned or destroyed and a formal decision made.

Ensure Media is Used with Authorised Systems

Media must only be used with systems that are authorised for its sensitivity level.

Use Write-Once Media for Secure Data Transfers

When moving data between different security levels, make sure to use media that can't be changed, un

Ensure Proper Handling of Sensitive Media

Handle media carefully based on its sensitivity to keep information safe.

Sanitise Media After Data Transfers Between Domains

Clean rewriteable media after transferring data between systems of different security levels.

Establish and Maintain Removable Media Policy

Organisations must create and uphold a policy for using removable media safely.

Develop and Maintain Media Management Policy

Create and update a policy to manage media handling effectively.

Ensure Media is Sanitised Before Initial Use

Before using any media, clean it to ensure no unwanted data is present.

Ensure Media is Sanitised Before Reuse

Clean media thoroughly before using it in a new security area to prevent data leaks.

Media Usage

Label Media With Protective Markings Reflecting Sensitivity Or Classification

All media, apart from fixed drives built inside equipment, must carry a label showing how sensitive

Implement Full or Partial Disk Encryption

Use encryption to protect data on disks, ensuring all writings are to encrypted areas only.

Encrypt All Data Stored on Media Using ASD-Approved Cryptography

All data held on storage media must be encrypted using cryptography approved by the Australian Signa

Develop and Maintain a Removable Media Register

Ensure a register for tracking removable media is created, kept up-to-date, and routinely checked.

Pre-Boot Authentication for Encrypted System Volume Media

Devices with encrypted system volumes must require a password at start-up, or release the unlock key

Back to the full Information Security Manual (ISM) control list, or browse the complete control library.