ISO 27701, Clause 6.5.3 – Media Handling

ISO 27701 Clause 6.5.3.1 – Management of Removable Media

References ISO 27002 Control 7.10

Removable Storage Media

When developing policies that govern the handling of media assets involved in storing PII, organisations should:

• Develop unique topic-specific policies based upon departmental or job-based requirements.
• Ensure that proper authorisation is sought and granted, before personnel are able to remove storage media from the network (including keeping an accurate and up-to-date record of such activities).
• Store media in accordance with the manufacturers specifications, free from any environmental damage.
• Consider using encryption as a pre-requisite to access, or where this isn’t possible, implementing additional physical security measures.
• Minimise the risk of PII becoming corrupted by transferring information between storage media, as is required.
• Introduce PII redundancy by storing protected information on multiple assets at the same time.
• Only authorise the use of storage media on approved inputs (i.e. SD cards and USB ports), on an asset-by-asset basis.
• Closely monitor the transfer of PII onto storage media, for any purpose.
• Take into consideration the risks inherent within the physical transfer of storage media (and by proxy, the PII contained on it), when moving assets between personnel or premises (see ISO 27002 5.14).

Re-Use and Disposal

When re-purposing, re-using or disposing of storage media, robust procedures should be put in place to ensure that PII is not affected in any way, including:

1. Formatting the storage media, and ensuring that all PII is removed before re-use (see ISO 27002 8.10), including maintaining adequate documentation of all such activities.
2. Securely disposing of any media that the organisation has no further use for, and has been used to store PII.
3. If disposal requires involvement of a third-party, organisation’s should take great care to ensure they are a fit and proper partner to perform such duties, in-line with the organisation’s responsibility towards PII and privacy protection.
4. Implementing procedures that identify which storage media are available for re-use, or can be disposed of accordingly.

If devices that have been used to store PII become damaged, organisation’s should carefully consider whether or not it is more appropriate to destroy such media, or send it for repair (erring on the side of the former).

Additional PII-Related Guidance

ISO warns organisations against using unencrypted storage devices for any PII-related activities.

Relevant ISO 27002 Controls

• ISO 27002 Control 5.14

Applicable GDPR Articles

• Article 5 – (1)(f)
• Article 32 – (1)(a)

ISO 27701 Clause 6.5.3.2 – Disposal of Media

References ISO 27002 Control 7.10

See ISO 27701 Clause 6.5.3.1.

Additional PII-Related Guidance

If media is to be disposed of that previously held PII, organisations should implement procedures that document the destruction of PII and privacy-related data, including categorical assurances that it is no longer available.

Applicable GDPR Articles

• Article 5 – (1)(f)

ISO 27701 Clause 6.5.3.3 – Physical Media Transfer

References ISO 27002 Control 7.10

See ISO 27701 Clause 6.5.3.1.

Additional PII-Related Guidance

Organisations should take extra care when transporting storage media containing PII, as distinct from standard data categories.

Records should be kept of all incoming and outgoing media containing PII, including:

1. Media type (HDD, USB, SD card etc).
2. Authorised senders and internal recipients.
3. Date and time of transfer.
4. The amount of physical media to be transferred.

Applicable GDPR Articles

• Article 5 – (1)(f)
• Article 32 – (1)(a)

Supporting Controls From ISO 27002 and GDPR

How ISMS.online Helps

ISMS.online makes personal information management easy through a great cloud-based solution to support ISO 27701 compliance in your organisation.

On top of this we have information security experts and resources available to guide you through the ISO 27701 accreditation process.

Find out more and get a hands on demonstration by booking a demo.