Storage media

Plain-language summary

Managing storage media through their whole life — buying, issuing, using, moving, storing and disposing of USB drives, external disks, memory cards and backup media — under your classification and handling rules, so the information on them stays protected.

What the clause is really asking

Removable media are small, cheap and easy to lose, and they carry malware in as readily as they carry data out. This control asks you to control media from the day they are bought to the day they are destroyed, applying the classification and handling rules you use for the information itself. It brings together the 2013 controls on removable media, media disposal and physical media transfer. Practical requirements include a rule on when removable media may be used; encryption where sensitive information is held; registering or authorising media used for sensitive data; secure storage; protecting media in transit with trusted couriers and suitable packaging; secure disposal or reuse; and keeping a second copy where losing the media would hurt. The misunderstanding is that blocking USB ports settles it; media also include backup disks, camera and instrument memory cards, and drives inside equipment. On a manufacturing site engineers move CNC programmes, machine recipes and measurement data on USB sticks between isolated machines and the network, which needs an approved, scanned route rather than a ban nobody follows.

What auditors look for

Auditors ask for the storage media rules and the technical settings that enforce them: whether USB storage is blocked, allowed only for authorised devices, or forced to encrypt. They ask for the register of backup and sensitive media and check a few entries physically. They ask how media is sent to an offsite store or a customer and look at the transfer log. They ask how media is wiped or destroyed and ask for certificates. On a plant they ask how programmes reach isolated machines. The hard question: if someone plugged in a USB stick right now, what would happen?

Typical evidence

Storage media rules within the acceptable use or handling policy; endpoint configuration for USB and removable storage; register of backup and sensitive media; encryption settings for removable media; transfer records for physical media with courier details; scanning station or approved transfer route for production equipment; disposal and destruction certificates; secure storage arrangements.

How to comply — recommendations

Decide your position and write it on one page: removable storage blocked by default, with exceptions for named, encrypted devices. Enforce it centrally through endpoint management. Issue encrypted USB drives to the people who need them and register them. For the shop floor, set up a dedicated scanning station and approved sticks for moving machine programmes, instead of personal ones. Log backup media and any media sent offsite, using trusted couriers and tamper-evident packaging. Route all retired media through the disposal process and keep certificates of destruction.

Common nonconformities

No rules on removable media; USB storage unrestricted on all endpoints; unencrypted media holding personal or confidential information; no register of backup or sensitive media; media sent by ordinary post without tracking; personal USB sticks used to load programmes onto production machines; retired media disposed of without wiping or certificates.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.