A.7.10
Storage media
Physical controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires that information held on storage media be protected against unauthorized disclosure, alteration, loss, or recovery across the full media life cycle: acquisition, registration, use, storage, movement in and out, transport, re-use, and disposal. The scope covers removable media such as USB drives, external hard disks, optical discs, and backup tapes, as well as fixed media embedded in servers and endpoints. Because physical transport and disposal easily fall outside routine controls and carry high risk of loss, theft, or recovery of residual data, the organization should define a protection level commensurate with the media type and the sensitivity of the stored information, and keep verifiable records of how media are handled and destroyed.
Key checkpoints
- Are procedures and responsibilities defined for the acquisition, registration, use, storage, and disposal of storage media, and are media identified and managed as assets?
- Is the use of removable media restricted to the minimum necessary, so that only approved and registered media may be used?
- When media are moved in/out or physically transported off-site, are protections applied such as encryption, tamper-evident sealing/packaging, and handover records?
- Before reuse/disposal, is sanitization selected for the media type, sensitivity, and anticipated recovery threat, with execution results and suitability verified and recorded?
- Is the storage environment for media holding sensitive information managed (physical access control, temperature/humidity, migration ahead of media ageing)?
- Is protection at the point of storage, such as encryption, applied to important/personal data on media so that exposure is prevented if the media are lost?
Implementation guidance
- Define classification criteria and handling rules by media type (removable/fixed/optical/tape/SSD), and apply labeling and asset-register entries so that location and status can be tracked.
- Restrict removable media use by default, issue media only after approval/registration when there is a genuine business need, and encrypt stored information so that loss or theft does not expose data.
- For off-site transport, use trusted carriers, tamper-evident sealing/packaging, handover and receipt-confirmation records, and in-transit encryption, and retain the transport history.
- Select clearing, purging, or physical destruction according to reuse/disposal needs, media characteristics, and risk. Do not use repeated overwriting or drilling as a universal solution; verify treatment coverage and results.
- Use verifiable, standard methods for sanitization/destruction and record the date, target media, method, responsible person, and result on a certificate; where outsourced, obtain the processing evidence and the contract.
- SSDs/flash may retain data outside ordinary overwrite coverage; use supported purge functions or suitable destruction with validation. Use cryptographic erase only when target data was appropriately encrypted from the outset and all relevant key copies can be removed; account for separate plaintext/backup copies. Degaussing does not erase flash storage.
Evidence
- Storage media management procedure/guideline (type classification, handling/storage/disposal criteria)
- Removable media asset register/registration log and media in/out log
- Media disposal/sanitization certificates and destruction certificates (with contract and processing-result report where outsourced)
- Handover/receipt-confirmation records and sealing/tracking history for off-site transport
- Media encryption status and policy/solution configuration screens
- Media storage-environment (access control, temperature/humidity) management records
Nonconformity examples
- No control policy exists for removable media, so staff freely use personal USB drives for work.
- Hard disks scheduled for disposal are handed to a recycling vendor after only a quick format, leaving data in a recoverable state.
- No disposal/sanitization certificate is retained, so whether and how media were destroyed cannot be tracked or verified.
- Media holding sensitive information are shipped off-site by ordinary courier without encryption, leaving exposure risk unaddressed if lost.
- SSDs are processed by degaussing only, so the data is not actually erased before re-use or disposal.
- Removable media are not identified or registered as assets, so their location and holdings cannot be established.