SR-12 asks you to dispose of defined items using defined techniques and methods. The organization selects both. NIST 800-53 binds US federal systems and, by contract, some others. For everyone else it is a reference for retirement and disposal practices.
What it means in practice
The guidance says disposal can happen at any time in the system life cycle, not only at retirement. It can occur in research, design, prototyping and operations. Methods include disk cleaning, removal of cryptographic keys and partial reuse of components. The risk covers physical and logical data, including documentation, shipping paperwork and memory sticks with software.
In software terms that includes decommissioned services, old build agents, cloud volumes, and keys tied to retired systems.
Evidence to collect
- A disposal procedure listing items and the method for each.
- Certificates or tickets for hardware wipe or destruction.
- Records of key revocation and snapshot or volume deletion.
- A decommission checklist signed per system.
Common gaps
- Cloud resources removed from billing but not wiped.
- Keys and tokens from retired systems left active.
- Laptops returned without a recorded wipe.
How to implement it
Create a decommission checklist covering data, keys, accounts and documents, and require it to close the ticket.
Quick check
Does SR-12 apply only at end of life?
No. The guidance says disposal can occur at any phase of the development life cycle.
