Key takeaways
- Manage storage media through its life: use, transport and disposal.
- USB drives and other storage media are easily lost and often forgotten.
- Start here: decide whether removable media is allowed and for what.
Purpose
Manage storage media through its life: use, transport and disposal.
Requirement
Requirement summaryStorage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.
Why it matters
USB drives and other storage media are easily lost and often forgotten.
How to implement
- Decide whether removable media is allowed and for what.
- Encrypt permitted media and record it.
- Block unauthorised media through technical controls.
- Securely wipe or destroy media at end of life.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.10. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for USB drives, external disks and other storage media.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.10 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Approval records for using removable media.
- Settings showing removable media is blocked or encrypted.
- Records of secure destruction of old media.
Things you should be able to show or explain
- Be able to show where any sensitive media is stored.
How much to show: A handful of media items or destruction records.
Common mistakes
- Unencrypted USB drives in use.
- No destruction records.
- Allowing any USB device on every machine.
- Disposing of drives without wiping.
- Tip: Restrict or block USB storage where you can.
Policies & documents to have
- Asset Management Policy
- Data Management Policy
FAQ
Is A.7.10 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.10?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for USB drives, external disks and other storage media…