ISO 27001 A.7.10 - Storage Media

Requirement

“Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.”

Plain-language meaning

The organization should control storage media from the moment it is obtained until it is erased, destroyed, disposed of, or transferred. Media includes digital and physical carriers such as USB drives, backup tapes, disks, removable drives, CDs/DVDs, printed records, and other portable media.

The rule is simple: if media can store or carry organizational information, it needs handling rules that match the classification of the information it contains.

Why this matters

Storage media is easy to lose, copy, steal, transport, reuse, or dispose of badly. A discarded disk, old backup tape, unapproved USB stick, damaged drive sent for repair, or paper archive moved by an unverified courier can expose sensitive information.

Media can also create availability and integrity risk: obsolete media may not be readable, poor storage conditions may degrade backups, and newly acquired removable media may contain malware.

Implementation guidance

1. Define approved media and handling rules

Procedures should define:

• which media types are approved;
• who may authorize media use;
• how media is inventoried;
• how media is labelled;
• how media is stored;
• how media is transported;
• how media is erased, reused, repaired, destroyed, or disposed of;
• what records must be retained.

Handling should align to A.5.12 Classification of Information and A.5.13 Labelling of Information.

2. Control acquisition and use

Unapproved media can introduce malware or bypass controls.

Examples:

• only approved encrypted USB drives may be used;
• backup media must be tracked and stored under defined conditions;
• newly acquired media should be checked before use where risk justifies it;
• media should be replaced before deterioration or obsolescence creates availability risk.

3. Control removal and transportation

Media removal and dispatch should be authorized and recorded.

Transport controls may include:

• secure courier;
• verified courier identity;
• tamper-evident packaging;
• locked containers;
• personal delivery for high-risk items;
• shipment splitting;
• encryption;
• not transporting encryption keys with encrypted media;
• delivery confirmation records.

4. Control disposal, destruction, and damaged media

Obsolete, redundant, damaged, or discarded media can still contain recoverable information.

Procedures should define:

• secure erasure;
• destruction method;
• destruction records;
• contractor due diligence;
• chain of custody;
• rules for damaged media repair;
• when damaged media must be destroyed rather than returned or repaired.

5. Keep audit trails

Records should show what media was moved, who authorized it, who carried it, when it left, when it arrived, what was destroyed, and how destruction was verified.

Audit guidance

Auditors should verify:

• approved media policy and risk basis;
• media inventory;
• classification and labelling alignment;
• storage conditions and manufacturer recommendations where relevant;
• authorization for media removal and transport;
• transport records and courier controls;
• encryption and key separation where used;
• disposal/destruction procedure;
• destruction logs and certificates;
• damaged media handling decisions;
• staff awareness and actual practice.

Sample records should show what was delivered, when it was picked up, who authorized transport, who carried it, when it arrived, and what protection was used.

Evidence examples

Strong evidence

• Media handling rules align to classification.
• Media is inventoried and labelled where appropriate.
• Dispatches are authorized and recorded.
• Sensitive media is encrypted or protected during transport.
• Encryption keys are not transported with encrypted media.
• Secure destruction records are detailed and traceable.
• Damaged media is risk-assessed before repair or return.

Weak evidence

• Staff use any USB stick they prefer.
• Media inventory is incomplete.
• Sensitive media is transported by default courier with no risk decision.
• Disposal contractor certificates lack item-level traceability.
• Damaged drives are sent for repair without data risk assessment.
• Encryption keys travel with encrypted media.
• Paper records are destroyed without logging.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.9 Security of Assets Off-Premises
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.11 Return of Assets
• A.5.12 Classification of Information
• A.5.13 Labelling of Information
• A.5.14 Information Transfer
• A.5.33 Protection of Records
• A.5.34 Privacy and Protection of PII
• Risk Assessment
• Storage Media Handling Procedure
• Storage Media Movement Log
• Secure Media Disposal and Destruction Register
• Damaged Media Handling Decision Record
• A.7.10 Audit Evidence Pack
• A.7.10 Audit Checklist

KB-ready summary

• Define approved media and handling rules.
• Inventory and label media where appropriate.
• Authorize and record media movement.
• Protect media in transport.
• Keep encryption keys separate from encrypted media.
• Erase or destroy media securely before reuse, repair, disposal, or transfer.

Templates and checklists

• Storage Media Handling Procedure
• Storage Media Movement Log
• Secure Media Disposal and Destruction Register
• Damaged Media Handling Decision Record
• A.7.10 Audit Checklist