Electronic Media

Electronic media in information security means digital or machine-readable systems and storage locations that hold, process, transmit, or preserve information. Examples include laptops, servers, cloud storage, removable drives, databases, mobile devices, backup media, and shared file repositories.

Examples of electronic media include hard drives, solid-state drives, USB drives, memory cards, backup tapes, laptops, mobile phones, servers, virtual disks, cloud file storage, databases, email systems, and collaboration platforms. The key factor is that the medium stores or transmits information electronically.

Electronic media is often used as a broad compliance and security term for electronic storage, processing, and transmission environments. Digital media is commonly used in a similar way, but it may also refer to digital content such as images, videos, documents, or web content. In security programs, the focus is usually on the information, storage location, access, lifecycle, and protection controls.

Electronic media is important for compliance because it is where many sensitive records and business-critical files are stored, copied, backed up, transferred, and eventually deleted. Weak controls over electronic media can lead to unauthorized access, data loss, incomplete retention, failed evidence collection, or improper disposal.

Information Security & GRC requirements for electronic media typically include inventory, ownership, access control, encryption, acceptable use, retention, backup, secure transfer, disposal, monitoring, and incident response. Organizations should also maintain evidence that these controls are defined, assigned, reviewed, and operating consistently.

Organizations should protect electronic media by classifying the information it contains, limiting access to authorized users, encrypting sensitive data, maintaining device and storage inventories, monitoring unusual activity, backing up critical records, and applying clear procedures for transfer, retention, and disposal.

Electronic media should be disposed of using methods appropriate to the sensitivity of the data and the type of media. Common approaches include secure wiping, cryptographic erasure, degaussing, physical destruction, certified recycling, and documenting the disposal process for accountability and audit evidence.

An electronic media policy should define what media types are covered, who owns them, how they may be used, how sensitive information must be protected, when encryption is required, how removable media is controlled, how backups are retained, and how media must be transferred, returned, sanitized, or destroyed.

Electronic media should be retained for as long as needed to meet business, contractual, operational, legal, and compliance obligations. Organizations should define retention schedules by data type or record category, apply them consistently across storage locations, and securely dispose of media or records when retention periods expire.

Responsibility for electronic media is usually shared across IT, security, compliance, legal, records management, business owners, and employees. IT and security teams typically manage technical controls, while business and compliance owners define retention, acceptable use, access expectations, and evidence requirements.