Control A.7.10Storage media
Storage media must be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organisation’s classification scheme and handling requirements.
The 2022 edition consolidated several earlier media controls into one life cycle. The stages that generate incidents are transportation and disposal — media in transit is outside every other control, and media at disposal has usually been forgotten before it becomes a problem.
The connection to A.5.12 and A.5.10 is explicit: how media is handled follows from the classification of what is on it.
The category most often overlooked is media that is not recognised as media. Backup tapes and USB devices are obvious; the drives inside decommissioned laptops, printers and multifunction devices are not, and A.7.14 covers their disposal only if somebody remembers they are there.
Where media leaves under a supplier arrangement — destruction, recycling, repair — A.5.20’s contractual terms and evidence of destruction are what make the control verifiable.
How to put this in place
Removable media and storage can carry information out of your control. The project needs to decide where media is allowed, protect it, and dispose of it safely.
- List the media types in use, such as USB drives, backup media and printed archives.
- Limit removable media to where the business needs it and block or encrypt the rest.
- Keep a register of media that holds confidential information.
- Set rules for transfer, storage and the end of life.
- Dispose of media through a recorded secure route.
Evidence an auditor usually looks for: device control settings, a media register where media is used, and disposal certificates.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.