An organization has implemented a control that enables the company to manage storage media through their life cycle of use. acquisition, transportation and disposal. Which control category does this control belong to?

The control described, which involves managing storage media throughout its lifecycle (acquisition, use, transportation, and disposal), directly corresponds to control A.7.10 "Storage media" in ISO/IEC 27001:2022. This control is explicitly listed under the "Physical controls" theme (Clause 7 of Annex A). Physical controls are concerned with the protection of tangible assets, including the equipment and media on which information is stored. The management of the physical media's journey from acquisition to secure destruction is a fundamental aspect of physical security, preventing unauthorized access, theft, or damage to the media itself.

A. Organizational: These controls establish the management framework, policies, and responsibilities. While a policy for media handling is an organizational control (A.5.1), the actual lifecycle management described is a physical action.
C. Technological: These controls pertain to logical measures like encryption, access control systems, or network security. They protect the data on the media, not the physical handling of the media device itself.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A, Clause 7, Control A.7.10.

Details: This standard categorizes the controls into four themes. Clause 7 is titled "Physical controls," and it contains control A.7.10, "Storage media," which is defined as managing media through its lifecycle. This directly places the described control within the Physical category.

2. ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection — Information security controls.

Reference: Section 7.10, "Storage media."

Details: This standard provides implementation guidance for the controls listed in ISO/IEC 27001 Annex A. Section 7.10 elaborates on procedures for managing physical storage media, including acquisition, transportation, and secure disposal, confirming its nature as a physical control.

3. PECB. (2022). ISO/IEC 27001:2022 Lead Implementer Training Course Material.

Reference: Module 4: The ISMS implementation plan, Section on Annex A Controls.

Details: Official PECB training materials for the Lead Implementer certification explicitly map the Annex A controls to their respective categories. The courseware explains that controls under Clause 7, including A.7.10 Storage media, are classified as Physical controls.