Storage media
Storage media are to be controlled through acquisition, use, transport and disposal in line with how the organization classifies information and the handling rules that follow.
What the requirement asks
Storage media are to be controlled through acquisition, use, transport and disposal in line with how the organization classifies information and the handling rules that follow. Purpose: allow information on storage media to be disclosed, changed, removed or destroyed only with authorization. Guidance for removable media: set a topic-specific policy on removable media and tell everyone who uses or handles it; where needed and practical, require authorization to take media out of the organization and record removals as an audit trail; keep media in a safe environment matching their classification and protected, per manufacturer specifications, from heat, moisture, humidity, electromagnetic fields and ageing; encrypt information on removable media where confidentiality or integrity matters; copy information to fresh media before old media degrade while the information is still needed; keep several copies of valuable information on separate media to reduce the chance of losing it all at once; consider registering removable media to limit loss; enable media ports such as SD slots and USB ports only when there is a business reason; monitor information copied to removable media where its use is necessary; and remember that information in physical transit by post or courier can be accessed, misused or corrupted. Paper counts as media here, and 5.14 applies when media are moved. Reuse and disposal: set procedures, proportionate to sensitivity, to limit leakage of confidential information: securely erase or format media before internal reuse (8.10); securely dispose of media no longer needed by destruction, shredding or secure deletion; identify which items need secure disposal; choose external collection and disposal providers with adequate controls and experience; log disposal of sensitive items for an audit trail; and consider that aggregating large amounts of non-sensitive media for disposal can make the whole sensitive. Damaged devices holding sensitive data should be risk assessed to decide whether to destroy them rather than repair or discard them (7.14). Other information: unencrypted confidential media may need extra physical protection. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Storage media need a lifecycle. The guidance asks for the issue, the label, the storage, the transfer and the destruction record.
Status of the guidance. The guidance lens for 7.10 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific removable media policy and evidence it was communicated to users and one live sample together.
Evidence an assessor asks for
- Removable media controlThe topic-specific removable media policy and evidence it was communicated to users
- Removable media controlEndpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
- Removable media controlEncryption enforcement for removable media holding confidential or integrity-critical information
- Removable media controlMedia removal authorizations and registers of removable media
- Removable media controlDisposal logs and certificates of destruction from vetted disposal providers
- Removable media controlProcedures and records for migrating information from ageing media and for risk-assessing damaged media
The question an assessor will ask
An assessor will ask for the topic-specific removable media policy and evidence it was communicated to users, then trace it to the system it protects. For A.7.10 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- USB ports are open on all endpoints with no business justification
- Removable media are not encrypted
- Disposal providers are chosen on price with no check of their controls
- Long-term archives sit on media that has degraded and was never refreshed
Before the next audit
Before the next audit, check one live sample for this gap: usb ports are open on all endpoints with no business justification.