The most embarrassing data breaches are often the dullest. A resold laptop with a readable disk. A copier hard drive returned to a lessor. A cloud volume that was never wiped. NIST SP 800-53 Rev 5 control MP-6 Media Sanitization exists to stop them.
800-53 binds US federal systems and, through contract, some of their suppliers. For others it is a reference. Customers often ask how you dispose of devices and what proof you keep.
What the control asks
Two requirements. Sanitize certain media before disposal, release out of organizational control, or release for reuse, using techniques and procedures you define. And use mechanisms whose strength and integrity match the security category or classification of the information.
The guidance says sanitization applies to all digital and non digital media subject to disposal or reuse, removable or not. Examples include scanners, copiers, printers, laptops, workstations, network components, mobile devices, paper and microfilm. The process removes information so it cannot be retrieved or reconstructed.
What it means in practice
For each device or medium that leaves your hands, you need three things. A method suited to the data on it. A person who did the work. A record that it happened.
The guidance distinguishes techniques such as clearing, purging and destruction. Pick based on sensitivity. Wiping a drive that held public marketing files is different from destroying one that held keys.
Do not forget devices with hidden storage. Printers, phones, routers and badge readers all keep data.
Evidence to collect
- The sanitization policy and approved methods for each media type and data class.
- A sanitization log with asset tag, date, method, operator and result.
- Certificates of destruction from vendors.
- Tool output or verification records for wipes.
- Contracts with disposal or recycling vendors that require sanitization.
- Records showing the link between the asset inventory and the disposal record.
Common gaps
Wipes happen but are not logged. A vendor provides a certificate that lists a quantity and not asset identifiers. Cloud and virtual storage are left out. Leased equipment goes back unwiped. People assume that deleting files or formatting a disk is enough.
Another gap is the strength of the method. A single pass overwrite may be fine for a modern drive in some cases, and wrong for others. Follow the method set by your own standard and record why.
How to implement it
Tie sanitization to the asset lifecycle. When an asset is retired, a ticket opens, and the ticket cannot close without a sanitization record. Use encryption from the start so that destroying the key is part of the process.
Collect proof automatically where possible. An evidence collection workflow can gather device records and tickets so the log builds as work happens.
Click through it at your own pace, or open it full screen.
Read the enhancements for a sense of how far the control can go. MP-6.1 Review, Approve, Track, Document, and Verify, MP-6.2 Equipment Testing, MP-6.3 Nondestructive Techniques, MP-6.7 Dual Authorization and MP-6.8 Remote Purging or Wiping of Information are the ones most likely to matter to a commercial company. MP-6.4, MP-6.5 and MP-6.6 Media Destruction are withdrawn in Rev 5.
Quick check
Is deleting files enough?
No. Sanitization means removing information so it cannot be retrieved or reconstructed. Deleting or formatting often leaves recoverable data.
Does MP-6 cover printers and copiers?
Yes. The guidance lists scanners, copiers and printers among the devices that can hold data.
What does a certificate of destruction need to say?
It should identify the media, the method, the date and the operator. A bare quantity is weak evidence.
