Audit — MP-6 — Media Sanitization

Examine Examine the media sanitization policy and procedures: do they define approved sanitization techniques (Clear, Purge, Destroy) mapped to each media type (HDD, SSD, flash/USB, tape, optical, mobile, paper) and to the information's security category, and do they explicitly reference NIST SP 800-88 Rev.1?

Examine Examine sanitization records / certificates of destruction for a sample of retired, reused, or transferred media: does each record capture the asset/serial ID, media type, data classification, sanitization method used, tool/operator, date, and verification result, and does it cover disposal, release out of organizational control, and reuse events?

Examine Examine the mapping of sanitization strength to classification: for high-security or classified media, is Purge or Destroy required (never Clear alone), and for SSD/flash is a technique appropriate to solid-state media (e.g., cryptographic erase or physical destruction) used rather than legacy overwrite-only methods?

Interview Interview the personnel responsible for media sanitization (IT asset disposition, storage/backup, or custodial staff): can they describe when sanitization is triggered, how they select the method by media type and data sensitivity, and how sanitized/pending media is physically secured and tracked until sanitized?

Test Test by observing an operator sanitize a sample device end to end: does the approved tool/process run to completion, is the outcome verified (e.g., readback/inspection confirming data is unrecoverable), and does a full audit trail get generated matching the retired asset record?

Examine Examine third-party media destruction arrangements (CIS Control v8 3.5): is there a current contract/agreement with the vendor, are certificates of destruction obtained and reconciled against the media inventory, and is chain-of-custody maintained from pickup through destruction?

Test Test reconciliation of the asset/media inventory against sanitization and disposal records: can every decommissioned storage asset be traced to a completed sanitization or destruction event with no unaccounted-for media, and are sanitization tools/equipment approved, maintained, and periodically tested for effectiveness?