DoD Cloud Computing Security Requirements Guide (CC SRG) v1r3 5.9: Media sanitisation before reuse or disposal: purge to NIST SP 800-88 at Levels 4 and 5, destroy where purge is uncertain

What does 5.9 require?

CSPs ensure no residual DoD data remains on storage devices that are decommissioned, disposed of, reused outside a DoD agreement or passed to another party, in line with FedRAMP control MP-6. At Levels 4 and 5 storage hardware is not reused or disposed of until all DoD data has been removed by purging under NIST SP 800-88 (Rev 1 at the time of the guide; Rev 2 is now current); devices that cannot be cleared or purged, or where success is in doubt, are physically destroyed. Level 6 media follows classified destruction rules.