Assessment Objective

Determine if:

• MP-06a.
  • MP-06a.[01] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to disposal;
  • MP-06a.[02] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release from organizational control;
  • MP-06a.[03] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release for reuse;
• MP-06b. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.

Assessment Methods

Examine

• System media protection policy
• procedures addressing media sanitization and disposal
• applicable federal standards and policies addressing media sanitization policy
• media sanitization records
• system audit records
• system design documentation
• records retention and disposition policy
• records retention and disposition procedures
• system configuration settings and associated documentation
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with media sanitization responsibilities
• organizational personnel with records retention and disposition responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Organizational processes for media sanitization
• mechanisms supporting and/or implementing media sanitization

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final