ISO 27001 Control A.7.10: Storage Media

A USB stick is the smallest container for the largest embarrassment. It holds a copy of a customer database, slips into a pocket, travels to a conference, and ends up in a drawer or a washing machine. Storage media come in many forms, from backup tapes and external disks to memory cards, optical discs and plain paper, and each can carry information out of your control. A.7.10 is the tenth of 14 physical controls in our walk through Annex A, and it follows media from the day you buy them to the day they are destroyed.

Do not worry if your organization has few removable devices. The control still applies to the disks inside laptops, the drives in servers and the paper in filing cabinets. What changes is how much effort the control deserves. The aim is a defined routine, not a bureaucratic burden.

What the control requires

Annex A control 7.10 of ISO 27001:2022 states that storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.

The key elements:

Storage media - removable or fixed, digital or physical: USB drives, external disks, tapes, optical discs, memory cards, internal drives and paper records
Life cycle - the four stages of acquisition, use, transportation and disposal, each of which needs its own rules
Classification scheme and handling requirements - the sensitivity of the information decides how strictly the media are handled

A.7.10 is a preventive control as classified in ISO/IEC 27002:2022. Annex A states the control; ISO 27002 gives guidance, which includes managing removable media according to the classification, requiring authorization to remove media from the organization, storing media in a safe environment in line with manufacturer specifications, using cryptographic techniques to protect data on removable media, and keeping records of removable media and their movements. Where media are no longer needed, the guidance points to secure disposal, a topic we treat in detail later under A.7.14, Secure disposal or re-use of equipment.

How to implement storage media management

Decide whether you want removable media at all

The simplest way to manage a risk is to remove it. Many organizations now rely on cloud storage and managed file sharing, and they can block removable media through endpoint settings for most staff. Then allow exceptions for roles that really need them, with approval and a record. Where a team genuinely requires USB drives, for example for field engineers or media production, supply company-owned encrypted devices and ban personal ones. Use the same reasoning for SD cards, external disks and phones used as storage. A single question is a good start: what job is this medium doing that a managed service could not do better?

Control acquisition and use

Buy media from known sources and register them. A small register is enough: an identifier, who holds it, its purpose and its classification of content. For individual USB drives, a label and a spreadsheet beat nothing, and an endpoint tool that recognizes approved devices beats a spreadsheet. During use:

Encrypt removable media that carry anything beyond public information
Keep sensitive media in locked storage when not in use, which follows the same instinct as clear desk and clear screen
Do not plug in found or unsolicited media, a rule worth stating explicitly because curiosity is predictable
Scan removable media for malware when they come from outside the organization
Limit what is copied to the minimum needed, and delete it when the task ends

Where media is used in restricted spaces, the rules for working in secure areas apply as well, such as authorization to bring devices in and out.

Protect media in transit

Media travel by post, courier, hand and car. For anything sensitive, decide the approved method: encrypted media, tamper-evident packaging, a reliable courier with tracking, and confirmation of receipt. Record who sent what, when, and who received it. For very sensitive items, use a signed handover and split the key from the media, so a lost package is not a disclosed secret. Off-site backup tapes and archive boxes need the same care, and they connect to the thinking behind security of assets off-premises, since a medium in a van is, for the moment, an off-site asset.

Plan for disposal from the start

Retire media deliberately. When a drive fails, a tape expires or a project ends, the media must not simply go to a general waste bin. Choose a method that matches the classification: secure erasure verified by a tool, degaussing, or physical destruction through a certified service that provides a certificate. Keep a record of what was destroyed and when, since this is the evidence auditors ask for first. Treat paper in the same way, with locked collection bins and shredding. Failed drives sent back under warranty are a trap: the vendor gets your data along with your claim, so use encryption from the start or destroy the failed media instead of returning it. Our later post on A.7.14, Secure disposal or re-use of equipment, deals with the equipment side of this in depth.

Keep the scheme alive

A media routine decays quietly. Staff change, projects end, and a drawer of old tapes is forgotten until someone needs the space. Once or twice a year, reconcile the register against reality: ask each holder to confirm what they have, check that encrypted devices are still on the approved list, and look for media that nobody can explain. Treat gaps as learning rather than blame, and update the rules where people have found easier ways to do the same job. Report the results to management as part of your normal monitoring, so the topic stays visible between audits.

A.7.6 connection. Working in secure areas often restricts which media may enter or leave the most sensitive rooms.

A.7.7 connection. Clear desk and clear screen covers removable storage media left on desks.

A.7.9 connection. Security of assets off-premises applies when media leave the building, whether in a bag or in the post.

A.6.6 connection. Confidentiality or non-disclosure agreements bind the third parties who may receive or handle your media.

Clause 7.5.3 connection. Control of documented information covers how documented information, including paper and electronic records, is protected and retained.

Forward reference. Secure disposal or re-use of equipment (A.7.14) follows in this series, and the later technological controls on information deletion (A.8.10) and information backup (A.8.13) deal with the digital side of media.

What auditors check

A defined media policy or rule. Auditors look for how removable media are authorized, restricted or banned, and whether the rule is aligned with your classification scheme.

A register or other record. For organizations that use removable media, they ask how devices are tracked, who holds them and what they contain.

Encryption and technical controls. Expect questions about encryption of removable media and whether endpoints block unapproved devices. They may try plugging in a USB stick.

Transport arrangements. Auditors ask how sensitive media are sent and how receipt is confirmed.

Disposal records. Certificates of destruction, erasure logs and bin collection arrangements are among the most commonly requested evidence.

Staff awareness. Interviews show whether people know not to use unknown media and what to do with old drives.

Common mistakes to avoid

A policy with no register. If no one knows which media exist, no one can say that they were managed through their life cycle.

Unencrypted USB drives. The cheapest fix is the most often skipped. Encrypt, or ban.

Forgetting paper. Printed records are storage media too, and they often hold the most readable data in the building.

Disposal by habit. Bins, drawers and the back of the cupboard are where old media go to wait for a problem. Set a disposal route and use it.

Returning failed disks with data on them. Warranty swaps are convenient and risky. Encrypt up front or destroy failed media.

Ignoring personal devices. Personal phones and drives used for work create unmanaged copies. Make the rules explicit.

No evidence of destruction. A disposal contractor with no certificate leaves you with a claim you cannot prove.

How 27kay can help

We help organizations bring media under control without making daily work harder, from deciding which removable media to keep, to setting transport and disposal routines that people follow. As part of ISO 27001 implementation, we align the rules with your classification scheme, help you choose sensible technical settings, and prepare the evidence auditors ask for. For the full picture, see our ISO 27001 knowledge hub.

If you opened the drawer in your IT cupboard today, what would be in it, and what would be on it? Get in touch - we will help you make that a short and comfortable answer.