Media handling and disposal policy

Manage storage media across acquisition, use, transport and disposal per classification and handling rules.

What the ISO 27002 guidance expects the document to say: Requires storage media to be managed across their whole life cycle, covering acquisition, use, transportation and disposal, in accordance with the organisation's classification scheme and handling requirements. Older source material adds that disposal should follow formal procedures scaled to the sensitivity of the information held, and that media in transit needs protection against unauthorised access, misuse and corruption.

Verify that sensitive data and licensed software are removed or securely overwritten before disposal or re-use.

What the ISO 27002 guidance expects the document to say: Requires items of equipment containing storage media to be verified before disposal or re-use, confirming that sensitive data and licensed software have been removed or securely overwritten.

Delete information in systems, devices and media when no longer required.

What the ISO 27002 guidance expects the document to say: Requires information held in information systems, devices or any other storage media to be deleted once it is no longer required. Supporting material frames this as procedures for secure deletion at the point the information ceases to be needed.

The organization shall document any use of removable media or devices for the storage of PII and, wherever feasible, use media and devices that permit encryption, using unencrypted media only where unavoidable and then with procedures and compensating controls such as tamper-evident packaging to mitigate the risk, because media taken outside the organization is prone to loss, damage and inappropriate access; where media on which PII is stored is disposed of, secure disposal procedures shall be documented and implemented so that the previously stored PII is not accessible; and media carrying PII shall be handled under the transfer, logging and authorisation measures of A.3.7.

Whenever storage space is re-assigned the organization shall ensure that any PII previously residing on it is not accessible, using specific technical measures where deletion of PII in an information system cannot practically be made explicit for performance reasons and another user could otherwise access it, and for disposal or re-use it shall treat equipment containing storage media that could possibly contain PII as though it does contain PII.

The organization must hold documented policies, procedures or mechanisms for the disposal of personal data, choosing disposal techniques with regard to factors including the nature and extent of the data, any associated metadata, and the physical characteristics of the media it is stored on, since techniques differ in their properties and outcomes such as the granularity of the resulting media or whether deleted information can be recovered.