ISO 27001 A.7.10: storage media, explained for startups

A.7.10 Storage media

USB drives and other removable media are controlled, encrypted and disposed of safely. What proves it: how removable media is blocked or encrypted, and how it is disposed of.

A certification auditor samples removable media settings and disposal records. A file that usually does the job: device management settings that block or encrypt USB storage.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.7.10 walks you through it in this order.

1. Block removable storage through device management, or require encryption where a team needs it.
2. Wipe or destroy media before disposal.
3. Record any exceptions and who approved them.

The free ISO 27001 readiness assessment asks 3 questions that evidence it:

• How do you wipe or dispose of laptops and drives?
• Are laptops managed by a mobile device management (MDM) tool that enforces disk encryption, screen lock, updates, malware protection and remote wipe?
• Which of these stop data leaving the company: USB storage blocked or encrypted, file sharing limited to your company, email data loss prevention?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Asset Management and Information Classification Policy covers A.7.10. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC6.5, data and device disposal and CC6.7, data in transit.

Physical controls

A.7.10 is one of the 14 physical controls in Annex A. Buildings, rooms, equipment and media. A remote company with no office can exclude several of these in its Statement of Applicability, with the reason written down, and covers the rest through laptop rules and its cloud provider.

Nearby controls in the same theme:

• A.7.7, clear desk and screen
• A.7.8, placing equipment safely
• A.7.9, devices off site
• A.7.11, power and utilities
• A.7.12, cabling
• A.7.13, equipment maintenance

Before it: A.7.9, devices off site. After it: A.7.11, power and utilities. Every control, by theme, is on the Annex A controls page.