ITAD Glossary
Data Sanitization
Data Security
Also known as: Media sanitization
Making access to data on media infeasible for a specified level of effort. Method selection depends on risk and media.
Decide how to handle the media before pickup
List the storage types, identify what can be reused, and agree on the sanitization method and evidence for each group. Define an exception route for media that cannot be identified, accessed or successfully processed.
Ask for results that distinguish successfully sanitized media from exceptions. The NIST media sanitization guidance can help shape the program. A physical destruction project should also define what is recorded on the certificate of destruction.
How ecoTech handles it
- The sanitization or destruction method is approved for each project with your information security team, based on the media and your requirements.
- We use both software (virtual) and physical sanitization, and we use NIST SP 800-88 as the framework for choosing controls.
- Deleting files is never treated as evidence of sanitization.
- A device that fails the selected process gets an authorized next step before it is released for reuse or recycling.
- Serial numbers are tracked for software-sanitized devices.
Question to ask your ITAD provider
Which method fits our media and data sensitivity?
Source: NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization