ISO 27001:2022 · Physical controls
ISO 27001:2022 7.10: Storage media
ISO 27001:2022 7.10 covers Storage media. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.10, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is USB ports are open on all endpoints with no business justification.
Storage media are to be controlled through acquisition, use, transport and disposal in line with how the organization classifies information and the handling rules that follow. Purpose (stated in ISO/IEC 27002:2022): ensures information on storage media is disclosed, modified, removed or destroyed only with authorization. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.10.
What evidence supports 7.10?
- Annex A physical controlStatement of Applicability entry for control A.7.10, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlThe topic-specific removable media policy and evidence it was communicated to users
- Annex A physical controlEndpoint configuration showing USB and SD ports disabled unless a business reason is approved, and monitoring of transfers to removable media
- Annex A physical controlEncryption enforcement for removable media holding confidential or integrity-critical information
- Annex A physical controlMedia removal authorizations and registers of removable media
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.10, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- USB ports are open on all endpoints with no business justification
- Removable media are not encrypted
- Disposal providers are chosen on price with no check of their controls
- Long-term archives sit on media that has degraded and was never refreshed
How it maps to SOC 2
- CC6.7 high Storage media controls cover the removable media limb of this criterion.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.