ISO 27001 A.7.10: Manage storage media through its lifecycle
Storage media management protects information as the material carrying it is acquired, used, moved, retained and eventually reused or discarded. ISO 27001 Annex A.7.10 applies beyond USB drives: paper documents and other physical media also need handling appropriate to the information they contain. The practical aim is to prevent unauthorised disclosure, alteration or loss throughout that lifecycle.
What A.7.10 requires in practice
Annex A control 7.10 asks that storage media are managed across their whole life: acquisition, use, transport and disposal. It must be done in line with the organisation's classification scheme and its handling rules. Storage media is wider than USB drives; it includes backup tapes, portable disks, memory cards and paper records. The control expects the organisation to know which media are in use and why, to match handling to the sensitivity of the information, to authorise and protect movement, and to dispose of media in a controlled way. It also touches on continuing readability for retained records. The outputs are media handling rules linked to classification, controlled transport and custody, and evidence that disposal and reuse are carried out as intended. The standard does not mandate encryption or a particular disposal method; those depend on the information and the risk.
Connect classification with permitted use
Identify which media are used and why. A removable drive used for an approved equipment transfer, a backup tape and printed customer files serve different purposes. Define the information permitted on each, the responsible owner and the conditions for use. Where removable media are unnecessary, reducing or restricting their use may be more reliable than trying to monitor every possible transfer.
Classification should lead to a practical handling decision. Sensitive information may need stronger physical custody or cryptographic protection, while retained records need continuing readability and integrity. A label that nobody understands does not establish those protections. Include the people who prepare, transport, receive and dispose of media in the communication.
Protect transport and continued readability
When media move, determine who authorises the transfer, how they are protected and how receipt is confirmed. Packaging, courier arrangements and custody records should fit the sensitivity and consequences of loss. Do not assume a sealed envelope or tracked parcel resolves every information-security concern.
Retention creates another challenge: keeping media is not the same as preserving usable information. Consider deterioration, available reading equipment and the ability to interpret retained files. An appropriate migration or copying plan may be needed before material becomes unreadable. Check relevant retention obligations before deletion; an information-security improvement should not inadvertently destroy records the organisation still needs.
Why managing storage media through its lifecycle matters to the business
Media are portable by design, which makes them easy to lose, copy or forget. A single unprotected drive or box of printed records can expose thousands of customer details. At the other end of the lifecycle, media disposed of carelessly can hand sensitive information to strangers. Clear handling rules reduce these risks and also reduce unnecessary cost, since restricting media use often removes the need to monitor it. Clients and regulators ask how portable information is controlled. At audit, media management is tested by following an item from issue to disposal, so a coherent lifecycle with evidence at each stage stands up well.
How to implement A.7.10
Follow the media from the day it arrives to the day it is destroyed. Keep the scheme simple enough that people can follow it without a chart. Include media held by suppliers or storage providers on your behalf, which are often forgotten when the rules are written.
- Identify the media types in use, including paper, and the business reasons for each.
- Decide which information classes may be placed on which media, and who owns each type.
- Consider reducing or restricting removable media where the business does not need it.
- Define authorisation, packaging and custody checks for media that are moved or sent to others.
- Plan for retained media, so that records remain readable and unaltered for as long as they must be kept.
- Set controlled routes for disposal and reuse, matched to the sensitivity of what the media held.
- Include the people who prepare, carry, receive and destroy media in your communication.
Illustrative manufacturing example: an approved machine-file transfer
A hypothetical manufacturer transfers an approved configuration file to equipment using removable media because the process has no suitable direct network route. Staff begin using whichever drive is available, sometimes carrying unrelated information between office and production systems. The business need is legitimate, but the handling arrangement is undefined.
The organisation establishes an authorised transfer route using designated media, appropriate preparation and checks, and a clear recipient. It limits content to the intended purpose and confirms how the media are cleaned or retained after use. A review follows one file from approval to transfer and subsequent media handling. Technical malware and integrity checks are coordinated with the relevant system controls rather than assumed from the physical label.
Illustrative BPO example: paper records awaiting destruction
A fictional BPO provider stores completed customer files in boxes awaiting an approved disposal collection. Individually routine records accumulate into a substantial body of personal and client information. The boxes are moved to an unlocked service area because office space is limited.
The provider treats the accumulated material according to its actual sensitivity, establishes protected custody and records what is released to the authorised disposal provider. It checks the provider's suitability and reconciles the collection with evidence of completed disposal. The example demonstrates why a scheduled collection does not itself protect information during the waiting period or prove what ultimately happened.
Distinguish reuse from routine deletion
Before media are reused, decide what information must remain and what must be removed. The method needs to suit the medium, sensitivity and destination. An ordinary file deletion should not be assumed to remove recoverable information. Appropriate technical advice is necessary when selecting and verifying sanitisation, particularly for damaged or unfamiliar media.
Disposal through a supplier still needs a controlled handover and sufficient assurance of the result. Equipment containing media also connects with secure equipment disposal and reuse. Avoid treating a general service invoice as proof that identified sensitive items received the required treatment.
Evidence that covers the complete lifecycle
Possible evidence includes authorised media use, classification-based handling rules, transfer records, readability checks and verified disposal. These are organising methods rather than fixed document titles mandated for every business. ISMS information should demonstrate the selected control and support accountability at the points where media change use or custody.
Sample the difficult transitions: a damaged drive sent for repair, a record box transferred between sites or a reusable device assigned to another team. Ask what information the receiving party can access and how the previous owner knows the handover is complete. Common weaknesses are controlling acquisition carefully while leaving retirement informal, and keeping an inventory that does not reflect current custody.
Coordinate media decisions with information classification and information deletion. The risk treatment process should explain why the chosen measures are sufficient and where additional controls are necessary.
Common nonconformities with A.7.10
Findings often come from media being treated casually. Most come from rules written for one media type, usually USB drives, while paper and other media escape any control at all.
- Unregistered removable drives circulating with no owner or purpose.
- Classification rules that do not translate into any media handling instruction.
- Backup or archive media sent to storage with no custody record.
- Disposal of media in ordinary waste or through a supplier with no confirmation.
- Printed customer files stored in unsecured cabinets or left in transit vehicles.
Frequently asked questions
Does storage media include paper?
Yes. Paper can carry sensitive information and needs appropriate storage, transport and disposal. Digital-only rules leave a significant gap where printed records are used.
Must all removable media be prohibited?
No blanket prohibition applies to every organisation. Determine whether there is a legitimate need and establish suitable controls for the permitted use, or restrict use where appropriate.
Is a destruction certificate enough on its own?
It can support assurance, but connect it with the identified items, custody and agreed service. A certificate that cannot be reconciled to the media provides limited evidence.
Make information handling consistent from start to finish
Discuss media lifecycle controls with Sterling. Consulting support can combine relevant documentation, staff learning and agreed Effivity ISO & GRC automation software, alongside authorised vulnerability scanning and findings review within the wider agreed scope. Continued support accompanies preparation; an independent body decides certification. Enrol in ISO/IEC 27002 Information Security Controls to connect media handling with the surrounding controls. Return to the physical controls directory for related asset decisions.