What A.7.10 storage media asks for and why it is harder than it looks
An assessor or a customer questionnaire asks how storage media are handled, and A.7.10 Storage media is the control that answers it. In short, the control requires that storage media are managed through their whole life cycle of acquisition, use, transport and disposal, in line with the organization's classification scheme and handling requirements. The risk it addresses is simple to state: data leaves the organization on a removable drive, a backup tape, a retired disk or a parcel handed to a courier, and nobody can show who handled it or whether it was protected. The difficulty is coverage. Media are spread across laptops, USB drives, backup tapes, servers, printers with storage, and third-party couriers and disposal firms, and many of them are not in the same inventory. The 2022 edition merged four 2013 controls into this one: A.8.3.1 Management of removable media, A.8.3.2 Disposal of media, A.8.3.3 Physical media transfer and A.11.2.5 Removal of assets. Organizations that ran four separate procedures for these areas often find that the merged control expects one story across all of them.
Start by confirming which media your organization actually holds. Ask the owners of endpoints, servers, backup systems and cloud exports for a list of every place data can be written to a removable or detachable form, and compare that list with your asset inventory. Then check that each media type maps to a handling rule tied to a classification level in your information classification scheme, since A.5.12 Classification of information is the control that defines those levels. A rule such as 'confidential data may not be written to unencrypted removable media' only works if someone can show the rule is enforced on the endpoints where it matters, and that disposal and transfer records exist for the media that were retired or sent out.
Because the control spans four life cycle stages, the evidence is spread across teams. Usage records come from endpoint management and device control, disposal records come from the disposal provider or internal sanitization logs, and transfer records come from courier manifests and chain of custody forms. Before committing to a certification body's audit plan, confirm with your auditor which records they will sample and how far back they will look, because that decides how much of this trail you need to produce. Disposal of equipment is closely tied to A.7.14 Secure disposal or re-use of equipment and data deletion to A.8.10 Information deletion, so the handoffs between these controls should be written down once rather than explained three times.
Which storage media and third parties fall under A.7.10
A.7.10 applies to whatever storage media sit inside the ISMS boundary, so the first job is deciding which media and which third-party handling arrangements the boundary and risk assessment cover. The cards below group the decisions that most often change the workload, from removable devices to media that leave the building with couriers, repair vendors or hosting providers.
Removable media
USB drives, external disks, memory cards and optical discs are the media most often named in A.7.10, because they move data quickly and leave few traces. Confirm whether your policy allows them at all, and if so, which classifications they may carry. Record who issues them, how they are logged, and how they are wiped or destroyed when retired. An auditor will expect to see the register and the handling rule, not just a general prohibition.
Fixed media in servers and endpoints
Internal disks and SSDs in laptops, workstations and servers hold most of an organization's information at rest. They are usually in scope because they are managed through the asset inventory, but the handling rules differ: they are removed during repairs, replacements and decommissioning. Check that every drive is traceable to an asset record and that removal triggers a documented sanitization step before the drive leaves custody.
Backup and archive media
Tapes, backup appliances, replicated snapshots and cold-storage copies often hold the same classified data as production systems, and they tend to outlive their owners' attention. Decide whether backup media are inside the ISMS boundary, how long each copy is kept, and who approves restores or off-site rotation. Retention and disposal of expired backups is a common gap, so check that your schedule includes destruction, not just rotation.
Media in transit to third parties
Couriers, repair vendors, forensic labs and cloud-hosted storage can all take custody of media that hold organizational information. Each handoff is a point where the handling rules must follow the media, through contract terms, chain-of-custody forms and proof of destruction from the recipient. Confirm which vendors appear in the supplier register and which ones receive media, since those arrangements are often missed in the first scoping pass.
Media holding classified information
The strictest handling applies where the information classification scheme under A.5.12 marks the content as confidential or restricted. Start from the classification labels, then trace which media carry that content, including copies made for testing or analysis. Media holding the highest classifications may need encryption, restricted storage, dual custody or witnessed destruction, so the scope decision should state which classification levels trigger which rules.
Media in shared or leased hardware
Storage in leased equipment, shared hosting, rented devices and multi-tenant infrastructure raises questions about who controls the media at end of life. Identify which devices return to a lessor or a shared pool, and whether the contract requires the provider to sanitize them. Where the organization cannot verify the provider's process directly, record that limitation in the risk assessment and confirm the provider's disposal evidence before accepting the arrangement.
How an assessor tests storage media handling
This table sets out what an assessor checks for A.7.10, what evidence they ask for, and where organizations most often fall short. Read each row as a test the assessor runs, and prepare the matching record before the audit starts. The main takeaway is that an assessor follows the trail from classification to inventory to disposal, so each link needs a record.
| Test area | Test approach | Evidence requested | Common findings |
|---|---|---|---|
| Classification scheme and handling rules | Confirm the classification levels exist, are approved, and that each handling rule names the levels it applies to | Approved classification scheme, handling rules for each level, and records showing staff were told about them | Handling rules that never reference the classification scheme, so storage media has no defined level to follow |
| Media inventory | Select a sample of storage media in use and trace each item back to an inventory entry, and check the reverse direction too | Asset register or inventory listing media, owner, classification, location and status, with change history | Inventory that does not match the media in use, including unlisted USB drives, backup tapes and spare disks |
| Removable media policy and enforcement | Review the policy, then check the technical settings on a sample of endpoints that the policy says should block or restrict removable media | Removable media policy, endpoint configuration exports, approval records for exceptions, and logs of blocked or permitted use | Policy exists but endpoints allow unrestricted use, or removable media is not encrypted when it holds classified data |
| Encryption of media in use | Select removable media and portable storage holding classified information and ask how encryption is applied and verified | Encryption standard for portable media, configuration evidence, and records of devices issued and their encryption status | Unencrypted removable media used for sensitive data without a documented exception |
| Transport and courier records | Pick recent shipments or movements of storage media and follow custody from dispatch to receipt | Chain-of-custody forms, courier agreements, packaging rules, and receipt confirmations | Media sent between sites or to third parties with no custody record or no confirmed receipt |
| Disposal and destruction | Select media that has left the inventory and trace the disposal route to a sanitization method and a destruction or wiping record | Disposal procedure, sanitization method by classification level, destruction certificates or logs, and inventory removal entries | Disposal without records, or media marked as destroyed that cannot be matched to a certificate |
| Exceptions | Review the exception register and check that each exception has an owner, a risk decision and an expiry or review date | Exception register, risk acceptance records, and evidence that compensating controls were applied | Standing exceptions that were never reviewed or that were approved by someone without authority to accept the risk |
| Sampling approach | Assessors choose samples across the life cycle stages, weighting toward higher classifications and recent activity, and they expect the sample to be explained | Access to the full inventory and logs so the assessor can select items independently | Records that exist only for a few hand-picked items, which weakens confidence in the rest of the population |
Implementing storage media handling step by step
This sequence turns A.7.10 from a policy statement into working handling rules, a maintained media register and disposal records that an auditor can sample. Each step produces a named output and a sign-off, so the control can be tested rather than only described.
Confirm the classification scheme with A.5.12
Start from the information classification scheme that the organization already uses under A.5.12 Classification of information, and confirm that each level has a defined handling requirement for storage media. The compliance lead drafts the mapping between classification levels and media types, and the information owners and the CISO approve it. The output is an approved table of classification levels, media types and minimum handling requirements. The step is done when every media type in use has a level that applies to it, and no level is left without a handling rule.
Build and maintain a media register
Create a register of storage media that holds sensitive or classified information, covering laptops, servers, backup tapes, USB drives, external disks and removable devices in use. An IT administrator populates it from endpoint inventory and manual records, with an owner, classification, location and status for each item. The output is a register that the compliance lead reviews and signs off each quarter, or at a frequency the organization sets. The step is done when a sample of media found in the environment can be traced to a register entry.
Set handling rules for use, transport and disposal
Write handling rules for each classification level that cover how media is used, how it is transported and how it is disposed of. The information security team drafts the rules, and the document owner and the CISO approve them before publication. The output is a short standard that staff can follow, with rules such as encryption requirements, custody during transport and approved disposal routes. The step is done when each rule can be traced to a classification level and an owner who has accepted it.
Configure removable media and disposal controls
Apply the rules in technical settings, such as blocking or restricting removable media on endpoints where policy requires it, enforcing encryption on portable storage, and setting up a disposal route with a named vendor or internal team. The endpoint or platform engineer configures the controls, and the security lead tests them on sample devices. The output is a configuration record and a disposal procedure that lists the methods used for each media type. The step is done when a test device shows the restriction working and a sample disposal produces a certificate or log entry.
Run a review cycle and record exceptions
Set a review cycle that compares the register against actual media, checks disposal records and reviews each exception, such as a device allowed outside policy for a documented business reason. The compliance lead runs the review, and the risk owner signs off each approved exception with an expiry or review date. The output is a review record, an exceptions log and corrective actions for gaps found. The step is done when every exception has an approver and a reason, and the review record can be shown to an auditor as evidence that the control operates.
Evidence that passes A.7.10 testing and how to keep it current
An assessor testing A.7.10 looks for a written rule, a current inventory of media, and records showing the rule was followed from acquisition through disposal. The cards below cover six artifacts that connect those three points, with the routine checks that keep each one accurate between audits.
Approved media handling procedure
The written procedure sets how each media class is acquired, labeled, stored, used, moved and destroyed, and it ties each step to the classification scheme in A.5.12. Assessors check that the procedure names owners, that it matches what staff actually do, and that its approval date is recent. Keep it current by reviewing it on a fixed schedule and after any change to classification levels, tooling or disposal providers. Record every revision with an approver and date.
Media register with owner and classification
The register lists every storage device in scope, including laptops, drives, tapes and removable media, with its owner, classification, location and status. Assessors sample entries and trace them to physical items or asset records. Reconcile the register monthly against asset inventory exports, such as GLPI Assets or Wazuh Syscollector output, and flag devices that appear in one source but not the other.
Removable media policy and configuration exports
The removable media policy states which devices and file types are permitted, who approves exceptions and how encryption is applied. Assessors look for configuration evidence that enforces the policy, such as endpoint settings that block or restrict USB storage. Export those settings with a date stamp each month and store them with the change record that produced them, so the assessor can see the control was working in the period tested.
Transport and handover records
Records for media moved between sites, couriers or service providers show who released the media, who received it, what it contained and when it moved. Assessors compare these records with the register to confirm custody was never broken. Keep a sign-off log for each movement and close open items weekly so that no media stays in transit without a named custodian. Confirm with your legal team how long these records must be kept, since that period comes from your own policy.
Disposal and sanitization records
Disposal records document each device or media item that was wiped, degraded or destroyed, the method used and the date. For external disposal, keep the certificate of destruction issued by the disposal provider, and match each serial number to a register entry. Assessors check that the certificate names the items, the method and the completion date. Reconcile these records against the register after every collection so retired devices never remain listed as active.
Periodic review minutes
Minutes from scheduled reviews show that owners examined the register, exceptions, incidents and disposal volumes, and decided what to change. Assessors use them to test whether the control is maintained rather than set up once. Hold these reviews at a fixed interval, record attendees and open actions, and link each action to the register or procedure it updated. Dated minutes with follow-up evidence are usually more persuasive than a single annual sign-off.
What meeting A.7.10 storage media costs
This table breaks the cost of meeting A.7.10 into its components, showing who is paid, whether each cost is one-time or recurring, what drives it up and how to keep it down. No prices are supplied for this control, so use the right-hand column to build a written quote and compare like with like. The main takeaway is that media count, site count and disposal volume usually move cost more than the licence line.
| Cost component | One-time or recurring | What drives it | How to keep it down |
|---|---|---|---|
| Tooling and licenses | Recurring licence or subscription, plus one-time setup | Number of endpoints and media managed, and whether device management and inventory tools are commercial or open source | Use self-hosted open-source inventory and endpoint tools where they meet the need, and confirm licence terms for each component |
| Engineering time for removable media controls | One-time, with occasional rework | Number of device types, operating systems and sites, and whether USB or removable media blocking is enforced centrally | Standardize the device build, apply one policy set across the estate and confirm the platform's capabilities before scoping |
| Inventory of storage media | One-time build, then recurring upkeep | Number of media items, including laptops, drives, tapes and backups, and how often assets move between sites | Record media in the same asset register as other equipment and automate collection where the tooling allows |
| Procedure and classification work | One-time, with periodic review | Number of classification levels, handling rules for each, and how many roles handle media | Reuse the information classification scheme and keep handling rules to one page per classification level |
| Evidence upkeep | Recurring | Frequency of media movements, disposal events, exception approvals and reviews kept on file | Store evidence in a single system with fixed naming and retention rules so records are produced as work happens |
| Secure disposal vendor services | Recurring per disposal event, plus any one-time onboarding | Disposal volume, media types, whether destruction is on site or off site, and certificate of destruction requirements | Batch disposals, confirm the destruction method and ask for itemized certificates tied to serial numbers |
| External testing or review | Recurring, usually per engagement | Scope of testing, number of sites, whether media handling is tested in a sample or in full, and whether an independent reviewer is needed | Define scope in writing so the review checks media handling and disposal rather than the whole estate |
| Auditor sampling effort | Recurring, once per certification cycle year | Number of media movements and disposal records the auditor samples, and how easily records can be produced | Keep disposal and transfer records complete and retrievable so sampling takes less time |
Self-hosted open-source tools that produce storage media evidence
A.7.10 is tested through records: what media exists, how it is encrypted, who handled it and how it left service. The four tools below can produce parts of that record inside your own infrastructure, but each one supports a documented procedure rather than replacing it, the disposal certificate or the periodic review.
Wazuh Syscollector inventory
Syscollector collects hardware, operating system, installed software, network interfaces and users from each endpoint and stores them in the Wazuh indexer, where the dashboard shows inventory views and reports. For A.7.10, this gives you a current list of endpoints that may hold removable or local storage, which is the starting point for checking whether media is recorded and handled. Confirm in your environment which hardware fields, such as disk or serial data, your agents report on each operating system before you rely on them as media evidence. Inventory shows what exists, not how media was used.
GLPI Assets register
The GLPI Assets module records computers, monitors, network equipment, peripherals and racks, entered manually or pushed automatically by the GLPI Agent through native inventory available since GLPI version 10. It can hold the asset tag, assignment and status history that an auditor asks for when tracing a storage device from acquisition to disposal. Check that every device that stores data, including external drives, is actually entered, because the register is only as complete as its intake process. Assigned owner and status fields should be mandatory for any device that can hold data.
Nextcloud server-side encryption
Server-side encryption in Nextcloud protects file contents at rest on local and external storage, with the keys held on the server. It does not encrypt file names or folder structure, so sensitive names still appear in the storage layer. This matters for A.7.10 because data on server-side storage may be exposed when a disk leaves service, and you should confirm whether encryption is enabled, which storage backends are covered and how keys are protected and backed up. Document the residual exposure of names and structure in your risk assessment rather than assuming full protection.
OpenBao transit engine
The OpenBao transit secrets engine encrypts and decrypts application data without storing that data, signs and verifies it, and supports versioned encryption keys with rotation. For A.7.10, this lets applications protect data before it is written to storage media, so a discarded or lost disk holds ciphertext rather than readable records. Confirm how key rotation is scheduled, how old key versions are retired, and who can access the engine, since the protection depends on controlling the keys. Encrypted data is only as safe as the key custody around it.
Who owns storage media controls and what to outsource
Your organization owns control A.7.10 in full. No implementation partner or auditor can accept accountability for how media are classified, who may hold them or when an exception is granted. Your team decides what the storage media rules say, who applies them and who answers for the results when something goes missing or is wrongly destroyed.
- Policy ownership: Someone senior owns the media handling policy and its review cycle, and that person is named in the policy itself.
- Classification decisions: Your information owners decide which classification level applies to the data on each medium, since handling rules depend on that decision under A.5.12.
- Media register accountability: A named role keeps the register of removable and portable media current, including custody changes, transfers and disposal entries.
- Exception sign-off: Any use of unencrypted media, out-of-policy transport or a delayed disposal needs a documented approval from an accountable manager, with a review date.
- Staff instruction: Your managers confirm that staff know the rules, since an auditor will ask people about them during interviews.
Before you engage anyone, confirm that these owners exist by name and have time allocated to the role, because the auditor will test whether they actually act.
An implementation partner can prepare the systems and documents that make control A.7.10 operable and testable. Its work is useful for configuration, record structure and drafting, but it does not take over ownership of the decisions. Set the boundaries in a written scope before work starts, including deliverables, systems covered and who approves each document.
- Inventory and removable media configuration: The partner can configure asset inventory so that endpoints and storage devices are recorded, and set up device controls where your platform supports them.
- Building the register: The partner can structure the media register and import existing records, while your team validates the entries.
- Handling procedures: The partner drafts procedures for transport, labeling, encryption and disposal, which your owners review and approve before adoption.
- Evidence packs: The partner assembles configuration exports, inventory reports, disposal certificates and sample records into an organized pack for the auditor.
- Written scope limits: The partner should not approve exceptions, classify information or sign records on your behalf.
Ask the partner to show how each deliverable maps to a named owner in your organization, and to confirm in writing that its staff will not perform the independent testing.
The certification body's auditor is the only party that tests whether control A.7.10 works and reports that result. The auditor samples media records, observes handling in practice, interviews staff and checks disposal evidence against the stated procedure. The certification decision rests on that independent testing, not on documents you or your partner prepared.
- Independent testing: The auditor selects samples from the register and inventory and traces them to physical custody, transfer and disposal records.
- Sampling: The sample size and selection method are the auditor's decision, so expect questions about media that were never logged.
- Walkthroughs and interviews: Staff who handle media are asked to explain the procedure in their own words.
- Certification decision: Only the certification body issues the certificate, and it does so after its own review.
- Separation of roles: An implementer that prepared the evidence cannot also test it, because the auditor must be independent of the work it examines.
Confirm with the certification body which evidence it expects and whether it has a conflict-of-interest policy you can review before you select it.
Storage media questions buyers ask before hiring help
How much effort does A.7.10 take for a small team?
The effort depends mainly on how many storage media your organization holds, how many sites and locations they sit in, and how many of them move in and out of the business. A team with a few laptops, no removable media in use and one office needs far less work than a team with external drives, backup tapes, USB devices in a lab and staff across several locations. No effort figure has been published for this control, so ask your implementation partner to break the work into inventory, handling rules, transport and disposal steps, then size each one against your actual media count. Ask which parts are one-time (writing the rules and building the register) and which recur (checking the register, logging transfers and recording disposals).
Can a small team meet A.7.10 without outside help?
Yes, a small team can meet A.7.10 in-house if it has three things: a named owner who is accountable for storage media, a register of the media in use, and a documented route for disposing of or reusing media. The control asks that media are managed through acquisition, use, transport and disposal according to your classification scheme, so the rules must reflect the classes of information you already use. Outside help is most useful when the team lacks time to write the handling rules, needs an independent view of gaps before an assessment, or wants the register and disposal records set up on self-hosted tools.
How long does a storage media project take?
Duration depends on the scope agreed in writing before work starts, not on a standard template. DeployOpen's engagements are usually fixed-scope, so the timeline follows from the systems, sites and evidence included in the statement of work. The main variables are how much of the media inventory already exists, whether classification levels are defined, how many systems must be connected to inventory tooling, and how quickly your staff can approve rules and sign off disposal records. Ask for milestones tied to deliverables so you can see progress without relying on estimates.
What does an implementation project need from our team?
The project needs decisions and access from your side, because the organization owns its controls. Expect to supply:
- An asset owner for each class of storage media who can confirm where data is held and who may use it
- Classification decisions from your information classification scheme, so handling rules match real information types
- Access to endpoints, file servers and inventory sources so media and device records can be collected
- Copies of past disposal records, certificates of destruction and transport logs, if they exist
- Sign-off on handling rules and on who approves removable media use and disposal
What can an implementation partner do for A.7.10, and what can it not do?
An implementation partner can prepare the systems, rules and evidence that an assessment will examine. That includes drafting handling rules with your team, configuring self-hosted tools that record and report on assets, setting up encryption and key handling for stored data, and organizing disposal and transfer records. It cannot issue audit reports, attestations or certificates. Only an independent auditor or a certification body can assess your conformity and issue a certificate. The organization remains responsible for its controls, its risk decisions and the accuracy of the evidence it keeps.
How do we check a quote against the scope for storage media work?
Compare the quote line by line against a written scope that names the media types, sites, systems, classes of information and disposal routes covered. A sound quote states the deliverables, such as handling rules, a media register, disposal procedure and evidence pack, and says which of them are one-time and which recur. Check whether removable media, backup media, media in transit and third-party disposal services are included or excluded. Ask what the client must provide, how changes to scope are priced, and what happens if the agreed inventory turns out to be larger than expected. Any figure should trace back to a stated scope item, not a general daily rate.
Which open-source tools help keep storage media evidence?
Self-hosted tools can hold the records that A.7.10 evidence depends on, while your organization keeps ownership of the decisions. GLPI's Assets module can record computers, peripherals and other equipment in an inventory, either entered manually or pushed by the GLPI Agent. Wazuh's Syscollector module collects hardware and software details from endpoints for inventory views and reports. For data at rest on file storage, Nextcloud server-side encryption protects file contents but does not encrypt file names or folder structure, so confirm that gap is covered by other measures. Check each tool's fit with your environment in its documentation before you rely on it for evidence.
How DeployOpen works on this
DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure, and prepares the storage media controls and evidence that A.7.10 asks for. Your organization owns the control, its classification scheme and its disposal decisions, while an independent auditor or certification body decides whether the control meets the standard.
How we scope
- Agree in writing which storage media types, sites and business units fall inside the A.7.10 scope
- Map your classification levels to the handling rules that apply to removable media, media in transit and disposal
- List the systems that record media inventory, transfers and destruction so the evidence sources are known before build starts
How we build
- Configure encryption at rest and key management for storage holding classified data, with keys kept under your control
- Deploy asset inventory tooling that records storage devices and their assignment, and set up alerts for unexpected changes
- Test that handling rules and removable media restrictions work as written, and document the results for the assessor
How we hand over
- Deliver written procedures, configuration records, test results and an evidence index mapped to A.7.10 and its related controls
- Walk your team through how to produce disposal and transfer records on demand, so the evidence stays current after handover
- Confirm with your certification body which evidence formats and sampling approach they expect before the audit begins
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts
- Ongoing support, upgrades and continuous testing for the storage platforms are available as a retainer
- Quotes follow from the written scope, so ask for the scope and deliverable list that each quote is based on
