📋ISO 27001 A.7.10Rule: ISO27001-A710medium

Storage Media

Description

Storage media shall be managed through its life cycle of acquisition, use, transportation, and disposal in accordance with the organisation's classification scheme.

⚠️ Risk Impact

Storage media (laptops, removable drives, backup tapes) retains data after the device's operational life ends. Improperly disposed media is a recurring source of data breaches years after the device leaves the organisation.

🔍 How EchelonGraph Detects This

ISO27001-A710Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.

🔧 Remediation

Track all storage media in inventory. Encrypt at rest. Apply cryptographic erasure or DoD-grade wipe before disposal. Use certified disposal vendors with chain-of-custody documentation.

💀 Real-World Attack Scenario

A federal agency disposed of 47 retired laptops via a recycling vendor. Spot-check inspection by an OIG audit found 31 of 47 still contained recoverable PII including SSN + DOB on former employees. Recycling contract had no verification mechanism. Remediation: emergency staff notification + monitoring + $2.4M settlement.

💰 Cost of Non-Compliance

Data-leak from disposed media: avg $1.8M per incident (Privacy Rights Clearinghouse 2024). HIPAA disposal violations: $4.45M avg.

📋 Audit Questions

  • 1.Storage media inventory?
  • 2.Disposal procedure?
  • 3.Chain-of-custody documentation?
  • 4.Last disposal event evidence?

🎯 MITRE ATT&CK Mapping

T1485 — Data Destruction

⚡ Common Pitfalls

  • ⛔Cloud-only orgs ignoring laptop disposal
  • ⛔Trusting recyclers without verification
  • ⛔Maintenance log incomplete

📈 Business Value

Controlled media lifecycle prevents the 'forgotten disk' breach pattern.

⏱️ Effort Estimate

Manual

4-8 hours per disposal event for documented sanitisation

With EchelonGraph

EchelonGraph tracks cloud-volume disposal + cryptographic erasure events

🔗 Cross-Framework References

SOC2-CC6.5NIST-MP-6

Automate ISO 27001 A.7.10 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →