All 93 controls · Physical controls
Control 7.10
Storage media
What ISO/IEC 27002:2022 control 7.10 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Storage media are to be controlled through acquisition, use, transport and disposal in line with how the organization classifies information and the handling rules that follow. Purpose: allow information on storage media to be disclosed, changed, removed or destroyed only with authorization. Guidance for removable media: set a topic-specific policy on removable media and tell everyone who uses or handles it; where needed and practical, require authorization to take media out of the organization and record removals as an audit trail; keep media in a safe environment matching their classification and protected, per manufacturer specifications, from heat, moisture, humidity, electromagnetic fields and ageing; encrypt information on removable media where confidentiality or integrity matters; copy information to fresh media before old media degrade while the information is still needed; keep several copies of valuable information on separate media to reduce the chance of losing it all at once; consider registering removable media to limit loss; enable media ports such as SD slots and USB ports only when there is a business reason; monitor information copied to removable media where its use is necessary; and remember that information in physical transit by post or courier can be accessed, misused or corrupted. Paper counts as media here, and 5.14 applies when media are moved. Reuse and disposal: set procedures, proportionate to sensitivity, to limit leakage of confidential information: securely erase or format media before internal reuse (8.10); securely dispose of media no longer needed by destruction, shredding or secure deletion; identify which items need secure disposal; choose external collection and disposal providers with adequate controls and experience; log disposal of sensitive items for an audit trail; and consider that aggregating large amounts of non-sensitive media for disposal can make the whole sensitive. Damaged devices holding sensitive data should be risk assessed to decide whether to destroy them rather than repair or discard them (7.14). Other information: unencrypted confidential media may need extra physical protection.
Purpose in the standard’s terms, in our words: Ensures information on storage media is disclosed, modified, removed or destroyed only with authorization.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Asset management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific removable media policy and evidence it was communicated to users
- Endpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
- Encryption enforcement for removable media holding confidential or integrity-critical information
- Media removal authorizations and registers of removable media
- Disposal logs and certificates of destruction from vetted disposal providers
- Procedures and records for migrating information from ageing media and for risk-assessing damaged media
Where audits commonly find gaps
- USB ports are open on all endpoints with no business justification
- Removable media are not encrypted
- Disposal providers are chosen on price with no check of their controls
- Long-term archives sit on media that has degraded and was never refreshed
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (08.3.1, 08.3.2) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.