Component Disposal SR-12

Source: NIST SP 800-53 Rev.5, Supply Chain Risk Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SR-12 (Component Disposal) is about getting rid of data, documentation, tools, and system components in a way that leaves nothing useful behind for whoever handles the hardware next. It belongs to the Supply Chain Risk Management (SR) family and sits in the Low baseline. The core question: when a disk, machine, or file leaves your control, can its contents still be recovered?

What good looks like

• Decide what needs secure disposal (drives, backups, configuration files, and printed notes) and which method each one gets.
• Sanitize before disposal — wipe or destroy the data so it cannot be reconstructed, rather than just deleting a file or reformatting.
• Match the method to the media: overwrite or cryptographic-erase for drives you will reuse, physical destruction for media you will not.
• Do not forget documentation and tools — network diagrams, saved credentials, and scripts can be as sensitive as the data itself.
• Record each disposal: what it was, the method, the date, and who did it — a certificate of destruction is your proof.

Framework mapping

• NIST CSF 2.0 — ID.AM-08 — Systems, hardware, software, services, and data are managed throughout their life cycles
• CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

• For a whole reusable Solid-State Drive (SSD) or NVMe (Non-Volatile Memory Express) drive, use the drive’s built-in secure erase — nvme format /dev/nvme0n1 --ses=1, or nvme sanitize — which tells the controller to purge every cell. Plain blkdiscard only issues a TRIM (discard) hint and is not guaranteed to make data unrecoverable, so do not rely on it alone.
• For a single sensitive file on a spinning Hard Disk Drive (HDD), overwrite it in place with shred -u -n 3 <file>. Note that shred is unreliable on SSDs and copy-on-write filesystems, so use full-device erase there instead.
• Where the disk was encrypted from the start — for example with LUKS (Linux Unified Key Setup) — destroy the key slots using cryptsetup luksErase /dev/sdX so the ciphertext can never be decrypted. This is called cryptographic erase.
• For media you will not reuse, record that it was physically destroyed (shredded or degaussed) rather than wiped.
• Write a short disposal procedure and log each event — media, method, date, and who did it — as a dated record.
• Attach that disposal log as hardening evidence on the asset, naming SR-12 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.