A.7.10 Storage Media would include:
-
Data Storage Policy: Documentation of a comprehensive data storage policy that outlines the rules and guidelines for storing data on various types of storage media, including physical and electronic storage devices.
-
Secure Data Storage Facilities: Proof of secure storage facilities, such as data centers, server rooms, or physical filing cabinets, with controlled access, environmental controls, and appropriate security measures.
-
Data Classification and Access Controls: Evidence of data classification practices and access controls that define who can access and modify data stored on different storage media based on the sensitivity and criticality of the information.
-
Data Encryption: Records of data encryption practices, particularly for data stored on portable storage media like USB drives or external hard disks, to protect against unauthorized access in case of loss or theft.
-
Media Handling Procedures: Documentation of procedures for the proper handling, transportation, and disposal of storage media to prevent data breaches or accidental exposure of sensitive information.
-
Media Sanitization and Destruction: Evidence of procedures for securely sanitizing or destroying data stored on storage media that are no longer in use or have reached the end of their lifecycle.
-
Data Backup and Recovery: Proof of data backup and recovery mechanisms to ensure that critical information is regularly backed up and can be restored in case of data loss or hardware failure
-
Physical Security Controls: Documentation of physical security controls in place to protect storage media from unauthorized access, theft, or damage, such as locked cabinets, access control systems, and surveillance.
-
Inventory Management: Records of inventory management practices to keep track of all storage media, including their location, status, and purpose.
-
Compliance with Regulations: Assurance that the organization's storage media practices comply with relevant legal and regulatory requirements related to data protection and privacy.
-
Employee Training and Awareness: Evidence of training and awareness programs provided to employees on data storage best practices and the importance of securely handling storage media.
By reviewing these pieces of evidence, an auditor can assess whether the organization has implemented appropriate measures to protect data stored on different storage media and mitigate the risks associated with data storage, ensuring the confidentiality, integrity, and availability of sensitive information
