How to Audit ISO 27001 Annex A 7.10: Storage Media

In this ultimate how to audit guide to ISO 27001 Annex A 7.10 Storage Media, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.10 Storage Media Audit Checklist

Auditing ISO 27001 Annex A 7.10 Storage Media is the technical verification of the full lifecycle management of physical and removable assets. The Primary Implementation Requirement is the enforcement of encryption and secure sanitisation, ensuring the Business Benefit of preventing data breaches from lost, stolen, or decommissioned storage media.

This technical verification tool is designed for lead auditors to establish the security integrity of information stored on removable and physical media throughout its lifecycle. Use this checklist to validate compliance with ISO 27001 Annex A 7.10.

1. Media Handling Policy Formalisation Verified

Verification Criteria: A documented policy exists defining the mandatory security requirements for the management of storage media, including removable types.

Required Evidence: Approved “Media Handling Policy” or “Removable Media Standard” with explicit version control and management sign-off.

Pass/Fail Test: If the organisation cannot produce a formal policy that defines how storage media is classified, handled, and protected, mark as Non-Compliant.

2. Removable Media Usage Restrictions Confirmed

Verification Criteria: Technical or organisational controls are in place to restrict the use of unauthorised removable media (e.g. USB drives, external HDDs) on corporate endpoints.

Required Evidence: GPO configuration reports or Endpoint Detection and Response (EDR) settings showing USB port blocking or “Read-Only” enforcement.

Pass/Fail Test: If any corporate laptop allows the unencrypted transfer of sensitive data to an unmanaged personal USB drive, mark as Non-Compliant.

3. Cryptographic Protection of Removable Media Validated

Verification Criteria: Mandatory encryption is enforced for all sensitive data stored on removable media to prevent unauthorised access in the event of loss or theft.

Required Evidence: Technical configuration logs showing BitLocker-to-Go, FileVault, or equivalent encryption enforcement for external storage devices.

Pass/Fail Test: If an active removable media device containing confidential organisational data is found to be unencrypted, mark as Non-Compliant.