ISO 27001 Annex A 7.10: storage media controls that pass audit

The due-diligence questionnaire asks how you control removable media and what happens to drives at end of life. Your estate is cloud-first, so you wonder whether ISO 27001 Annex A 7.10 applies at all. It does, and the answer is smaller than you fear.

This guide is for security leads and compliance managers at UK service providers and SaaS firms of 25–250 staff. It covers what the control requires, how to block removable storage by default, how to dispose of drives and paper with proof, and what auditors test at Stage 2.

What does the ISO 27001 Annex A storage media control require across the lifecycle?

Annex A 7.10 treats every carrier of your information, including USB sticks, external drives, backup tapes and paper, as a managed asset from purchase to destruction. It expects a removable-media policy, ports enabled only for business reasons, records of removal, encryption in storage and transit, and disposal that leaves nothing recoverable.

The lifecycle framing is the point, because the risk is rarely the device. It is the unmanaged moment: the stick that leaves the building unrecorded, the drive reused without a proper wipe, the archive box in a skip.

Read the control as six stages, each with one question to answer:

• Acquire: is this medium company-approved and encrypted by default?
• Issue: who holds it, and what classification may it carry?
• Store: is it locked away according to that classification?
• Move: when it leaves the building, who authorised that, and is it recorded?
• Sanitise: has reused media been wiped to a recognised standard?
• Destroy: can you prove that nothing recoverable remains?

Storage conditions are part of the control. Keep media away from heat, damp and magnets. Copy long-lived archives onto fresh media before the old medium decays. Hold valuable data in more than one copy on more than one device.

Confidentiality, integrity and availability all apply. Media can leak what it carries, be tampered with in transit, or decay until it cannot be read while it holds the only copy. The control is preventive, which is why blocked ports, encryption and certified destruction matter more than logs written after the loss.

What changed in ISO 27001:2022 Annex A 7.10 storage media?

ISO 27001:2022 folds four separate 2013 controls (A.8.3.1, A.8.3.2, A.8.3.3 and A.11.2.5) into a single lifecycle control. Detailed transfer rules now sit with A.5.14, data deletion technique with A.8.10, and the equipment wipe-before-disposal check with A.7.14, leaving A.7.10 to govern the media itself from purchase to destruction.

For a team working from the 2013 edition, the change is mostly one of filing. Use this sequence when you migrate your documents:

1. Merge the separate media procedures into one removable-media policy that follows the lifecycle.
2. Point your transfer procedure at A.5.14 instead of duplicating it. Tamper-evident packaging and tracked couriers for sensitive media belong in that rule set.
3. Reference A.8.10 for deletion technique and A.7.14 for the equipment check, so each neighbour owns its own detail.
4. Update your Statement of Applicability and control mapping so 7.10 appears alongside those three neighbours.

The 7.10 and 7.14 disposal paths pair naturally, so one disposal workflow and one vendor relationship can serve both.

Can a cloud-first firm mark ISO 27001 storage media controls as not applicable?

No. Cloud-first firms still own laptop drives that must be wiped or destroyed at end of life, plus paper records and the occasional USB stick. A 'not applicable' Statement of Applicability entry almost never survives audit; 'blocked by default, with managed exceptions' does, and it is a simpler position to run.

The media a cloud-first firm cannot avoid are mundane. Every laptop carries a drive, printed contracts and notebooks sit in the office, and a conference organiser will eventually hand someone a stick. An auditor walking the floor can find any of them.

Claiming not applicable invites the auditor to test the claim. Blocked by default gives you a configuration export and a short exception list, which together are a complete answer.

For a regulated firm, an unencrypted stick in a taxi or a returned lease laptop with client data intact can be a reportable breach. Incidents like these read as basic negligence in a way a sophisticated attack never does, and the control is cheap to run well at your size.

How do you block USB and removable storage by default with Intune?

Decide whether removable media is needed at all. For most cloud-first firms it is not, so block USB storage by default through Intune or equivalent endpoint management, force encryption on any permitted device, and handle genuine needs as named, approved exceptions. NCSC guidance confirms access can be restricted through device installation settings, group policy or MDM.

The NCSC peripheral security guidance adds the reason to act. Removable media opens a route for data theft and data loss, often with no encryption or device authentication to protect a lost stick. It also gives malicious software a way in that bypasses approved installation.

A focused week is realistic at 50 people. Work in this order:

1. Block USB storage by default. Push the restriction through Intune or your equivalent tool to every managed device, so the control lives in configuration rather than a reminder email.
2. Force encryption on permitted devices. BitLocker To Go or hardware-encrypted sticks mean a lost device exposes nothing.
3. Issue company media only. Personal devices stay blocked, and approved needs become named exceptions with an approver and an end date.
4. Keep a register. Record what exists, who holds it and what classification it may carry. A ten-line spreadsheet beats no register, because nothing is anonymous.
5. Write a short policy. State what is allowed, what is banned, who approves an exception and what to do with media handed over at a conference. Everyone who could plug something in should have seen it.

Policy is where most programmes start and where many stop. Acceptable-use wording about USB sticks reads well in a handbook.

A USB policy that every port on the estate ignores is not a control.

The second trap is a register that lists devices but not who holds them or what classification they carry. When one goes missing, you cannot scope the loss, and the breach assessment starts from guesswork. Once the block, the exception list and the register exist, you can answer the questionnaire and the auditor in the same breath.

How should you sanitise or destroy storage media before reuse or disposal?

Deleting files or quick-formatting leaves data recoverable. Use a wipe aligned to a recognised standard such as NIST SP 800-88 Rev. 2, which defines sanitisation as rendering access to target data infeasible through Clear, Purge or Destroy actions. Send end-of-life media to a vetted ITAD vendor and keep a certificate of destruction for each batch.

Formatting rewrites the index, not the data, so recovery tools read straight past it. The NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization tie the method to how sensitive the data is: the more sensitive the contents, the stronger the method, up to destruction.

Choose the route by what the media will do next:

• Reused inside the firm: a logged wipe aligned to the standard before reissue.
• Leaving your control or at end of life: physical destruction through a vetted ITAD vendor.
• Damaged: assess before sending it anywhere, because a broken drive full of client data may need destruction, not repair.

Mind the aggregation effect in bulk disposals. Old phone lists, meeting notes and config printouts are individually dull, yet a pallet of them can map your business for whoever finds the skip. Treat a batch of low-sensitivity media with the care you would give one sensitive item.

Vendor due diligence comes first, then the paperwork. The ICO records disposal and deletion audit framework expects a named staff member to check that destruction certificates match what you sent. Make that a routine:

1. Export the retiring serial numbers from the asset register as the dispatch list.
2. Hand over the batch with a signed record, using tamper-evident packaging for anything sensitive.
3. Collect an itemised certificate of destruction for the batch.
4. Reconcile the certificate to the dispatch list, serial by serial.
5. File the certificate against the asset records.

A destruction certificate that doesn't itemise serial numbers proves a transaction, not a destruction.

The e-waste graveyard is the other way disposal goes wrong: retired laptops, loose drives and archive boxes with unknown contents, waiting years for a disposal decision nobody owns. Give retirement an owner and a deadline, and inventory what is already in the cupboard this week.

A cupboard of retired laptops is an unmanaged data store with a door on it.

How do paper records and printed material fit into storage media controls?

Paper counts as storage media, so the same media storage rules apply: secure storage, controlled movement and shredded disposal with certificates. Locked confidential-waste bins and a shredding contract cover the common cases, and auditors inspect paper handling on the walk-round against the same classification rules as digital media.

Four measures cover most offices:

• Confidential print: release jobs at the device instead of leaving them in the tray.
• Locked confidential-waste bins: place them where paper is generated, and have the shredding vendor empty them.
• Archive boxes: label them, log them in the register and store them locked according to classification.
• Shredding vendor: keep the due-diligence file and a certificate for every collection.

The same ICO framework expects disposal methods to be documented and evidence of secure disposal to be obtained from third parties, so the reconciliation routine from the disposal section applies to paper too. A client file printed from an encrypted system deserves no less protection on a desk than it had on disk.

The usual failure is paper forgotten entirely: confidential print in the ordinary recycling, or archive boxes handled with none of the care the same data gets on disk. Walk the office once as an auditor would and note every bin, drawer and printer. Keep the bin locations in the register notes, so the walk-round and the paperwork tell the same story.

What evidence and tests do auditors use for ISO 27001 Annex A 7.10?

Auditors cross-check policy, register and enforcement. Expect a removable-media policy, a media register showing holder and encryption status, a live MDM configuration export or USB insertion test, and one disposal batch traced from asset register to certificate of destruction with matching serial numbers. Having no control at all grades major; drift and missing certificates grade minor.

Gather this evidence before Stage 2:

• Removable-media policy, with proof that staff have seen it.
• Media register showing owner, holder, classification and encryption status.
• Endpoint management configuration showing ports blocked and encryption forced. It persuades most, because configuration is harder to stage than paper.
• Removal authorisations and transit records for anything that left the building.
• Endpoint logs of writes to removable devices, where you monitor them.
• Sanitisation logs for reused media.
• Destruction certificates and the due-diligence file on the disposal vendor.

Expect these questions in the room:

• Can I see your media register, and does it say who holds each item and whether it is encrypted?
• What happens if I plug a personal USB stick into this laptop right now?
• Show me the trail for the last time media or records left the building.
• This drive was reused: show me the wipe that preceded it and the standard it followed.
• Where are the destruction certificates for last quarter's retired drives?

Sampling is predictable. The auditor asks for a live test or a config export to prove the USB block is real. They trace a couple of register entries to the physical item and its holder, and follow one disposal batch from register to certificate. The confidential-waste arrangements get inspected on the walk-round. Run the live test yourself first on a spare laptop: if the stick mounts, you have found the finding before the auditor does.

Grading follows certification-body practice. No meaningful control over removable media at all, such as personal sticks freely usable with no policy and no disposal trail, grades major. So does unencrypted sensitive data circulating on unmanaged media. A drifted register, a missing certificate or an undocumented exception grades minor, though a pattern of minors can aggregate to a major.

How do you automate storage media controls so evidence builds itself?

Treat the control as configuration. MDM enforces port blocks and mandatory encryption, scheduled config exports become continuous evidence, and drift raises an alert. Exceptions become tickets with expiry dates, the register reconciles against endpoint telemetry, and asset retirement triggers a disposal ticket that cannot close without a wipe log or destruction certificate.

Each move is small, and together they turn evidence into a by-product. Five patterns carry most of the value:

• Drift alerts. A scheduled export compared with the baseline raises an alert when a port policy loosens, so you hear before the auditor does.
• Register reconciliation. Issued media in the asset system is checked on a schedule against the encrypted volumes endpoint telemetry actually sees, so the register stops decaying between reviews.
• Expiring exceptions. Expiry re-blocks the device, and the ticket trail is the authorisation record.
• Transfer telemetry. Where writes are permitted, endpoint logs feed your log pipeline with alerts on volume anomalies.
• Disposal workflow. The serial-by-serial reconciliation from the disposal section becomes a required field on the retirement ticket.

Keep the exception ticket short: requester, business reason, device, data classification, approver and end date. Six fields are enough to answer "who approved this?" months later.

GRCMANA's GRC Engineering service line builds and runs this set-up for clients. Once it is in place, the audit is an export, not a scramble.

The table maps what an auditor asks to where the evidence now comes from.

Frequently asked questions