+MP-06 [H] Media Sanitization
---+MP-06(01) [H] Review, Approve, Track, Document, and Verify
---+MP-06(02) [H] Equipment Testing
---+MP-06(03) [H] Nondestructive Techniques

MP-06 [H] Media Sanitization

Control

  1. Sanitize [Assignement: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignement: organization-defined sanitization techniques and procedures] ; and
  2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

Discussion

Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.

Assessment Objective

    1. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to disposal;
    2. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to release from organizational control;
    3. [Assignement: system media] is sanitized using [Assignement: sanitization techniques and procedures] prior to release for reuse;
  2. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.

Assessment Method

Examine

System media protection policy procedures addressing media sanitization and disposal applicable federal standards and policies addressing media sanitization policy media sanitization records system audit records system design documentation records retention and disposition policy records retention and disposition procedures system configuration settings and associated documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with media sanitization responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities system/network administrators

1. Prehľad

MP-06(01) [H] Review, Approve, Track, Document, and Verify

Control

Review, approve, track, document, and verify media sanitization and disposal actions.

Discussion

Organizations review and approve media to be sanitized to ensure compliance with records retention policies. Tracking and documenting actions include listing personnel who reviewed and approved sanitization and disposal actions, types of media sanitized, files stored on the media, sanitization methods used, date and time of the sanitization actions, personnel who performed the sanitization, verification actions taken and personnel who performed the verification, and the disposal actions taken. Organizations verify that the sanitization of the media was effective prior to disposal.

Assessment Objective

  1. media sanitization and disposal actions are reviewed;
  2. media sanitization and disposal actions are approved;
  3. media sanitization and disposal actions are tracked;
  4. media sanitization and disposal actions are documented;
  5. media sanitization and disposal actions are verified.

Assessment Method

Examine

System media protection policy procedures addressing media sanitization and disposal records retention and disposition policy records retention and disposition procedures media sanitization and disposal records review records for media sanitization and disposal actions approvals for media sanitization and disposal actions tracking records verification records system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system media sanitization and disposal responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
MP-06(02) [H] Equipment Testing

Control

Test sanitization equipment and procedures [Assignement: organization-defined frequency] to ensure that the intended sanitization is being achieved.

Discussion

Testing of sanitization equipment and procedures may be conducted by qualified and authorized external entities, including federal agencies or external service providers.

Assessment Objective

  1. sanitization equipment is tested [Assignement: frequency] to ensure that the intended sanitization is being achieved;
  2. sanitization procedures are tested [Assignement: frequency] to ensure that the intended sanitization is being achieved.

Assessment Method

Examine

System media protection policy procedures addressing media sanitization and disposal procedures addressing testing of media sanitization equipment results of media sanitization equipment and procedures testing system audit records records retention and disposition policy records retention and disposition procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with system media sanitization responsibilities organizational personnel with records retention and disposition responsibilities organizational personnel with information security and privacy responsibilities
MP-06(03) [H] Nondestructive Techniques

Control

Apply nondestructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [Assignement: circumstances].

Discussion

Portable storage devices include external or removable hard disk drives (e.g., solid state, magnetic), optical discs, magnetic or optical tapes, flash memory devices, flash memory cards, and other external or removable disks. Portable storage devices can be obtained from untrustworthy sources and contain malicious code that can be inserted into or transferred to organizational systems through USB ports or other entry portals. While scanning storage devices is recommended, sanitization provides additional assurance that such devices are free of malicious code. Organizations consider nondestructive sanitization of portable storage devices when the devices are purchased from manufacturers or vendors prior to initial use or when organizations cannot maintain a positive chain of custody for the devices.

Assessment Objective

non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under [Assignement: circumstances].

Assessment Method

Examine

System media protection policy procedures addressing media sanitization and disposal information on portable storage devices for the system list of circumstances requiring sanitization of portable storage devices media sanitization records audit records system security plan other relevant documents or records

Interview

Organizational personnel with system media sanitization responsibilities organizational personnel with information security responsibilities

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy

Prepojené úlohy

Prepojenia
is blocked by MP-06 [H] Media Sanitization – Assessment Procedure
is blocked by Digital & Non-Digital Media Disposal
is blocked by Digital Media Sanitization
is blocked by Sanitization of Sensitive / Regulated Data