## 7.10 Storage media

  

| **Control type** | **Information security properties** | **Cybersecurity concepts** | **Operational capabilities** | **Security domains** |

|------------------|-----------------------------------------|---------------------------|---------------------------------------------|---------------------|

| #Preventive | #Confidentiality #Integrity #Availability | #Protect | #Physical_security #Asset_management | #Protection |

  

**Control**

  

Storage media should be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.

  

**Purpose**

  

To ensure only authorized disclosure, modification, removal or destruction of information on storage media.

  

**Guidance**

  

<u>Removable storage media</u>

  

The following guidelines for the management of removable storage media should be considered:

  

a\) establishing a topic-specific policy on the management of removable storage media and communicating such topic-specific policy to anyone who uses or handles removable storage media;

  

b\) where necessary and practical, requiring authorization for storage media to be removed from the organization and keeping a record of such removals in order to maintain an audit trail;

  

c\) storing all storage media in a safe, secure environment according to their information classification and protecting them against environmental threats (such as heat, moisture, humidity, electronic field or ageing), in accordance with manufacturers’ specifications;

  

d\) if information confidentiality or integrity are important considerations, using cryptographic techniques to protect information on removable storage media;

  

e\) to mitigate the risk of storage media degrading while stored information is still needed, transferring the information to fresh storage media before becoming unreadable;

  

f\) storing multiple copies of valuable information on separate storage media to further reduce the risk of coincidental information damage or loss;

  

g\) considering the registration of removable storage media to limit the chance for information loss;

  

h\) only enabling removable storage media ports \[e.g. secure digital (SD) card slots and universal serial bus (USB) ports\] if there is an organizational reason for their use;

  

i\) where there is a need to use removable storage media, monitoring the transfer of information to such storage media;

  

j\) information can be vulnerable to unauthorized access, misuse or corruption during physical transport, for instance when sending storage media via the postal service or via courier.

  

In this control, media includes paper documents. When transferring physical storage media, apply security measures in 5.14.

  

<u>Secure reuse or disposal</u>

  

Procedures for the secure reuse or disposal of storage media should be established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for secure reuse or disposal of storage media containing confidential information should be proportional to the sensitivity of that information. The following items should be considered:

  

a\) if storage media containing confidential information need to be reused within the organization, securely deleting data or formatting the storage media before reuse (see 8.10);

  

b\) disposing of storage media containing confidential information securely when not needed anymore (e.g. by destroying, shredding or securely deleting the content);

  

c\) having procedures in place to identify the items that can require secure disposal;

  

d\) many organizations offer collection and disposal services for storage media. Care should be taken in selecting a suitable external party supplier with adequate controls and experience;

  

e\) logging the disposal of sensitive items in order to maintain an audit trail;

  

f\) when accumulating storage media for disposal, giving consideration to the aggregation effect, which can cause a large quantity of non-sensitive information to become sensitive.

  

A risk assessment should be performed on damaged devices containing sensitive data to determine whether the items should be physically destroyed rather than sent for repair or discarded (see 7.14).

  

**Other information**

When confidential information on storage media is not encrypted, additional physical protection of the storage media should be considered.