NIST SP 800-88 Rev 2
Sections 1 and 2: purpose, scope, audience, media types, the target of sanitization and decision factors – NIST SP 800-88 Rev 2

NIST SP 800-88 Rev 2 2.4: Weigh the decision factors: media type, size and capacity, confidentiality requirement, controlled area, in-house or third party, on-site or off-site, volume, equipment, training, duration and cost

What does 2.4 require?

Alongside the system's confidentiality categorisation, sanitization decisions for ISM take account of the cost against benefit of the process and the following factors: the media types, physical sizes, density and capacities; the confidentiality requirement of the information; whether the media are processed in a controlled area; whether the organisation or a third party performs the technique; whether it is done on-site or off-site (loss of control of ISM holding certain sensitive data may itself be a breach); the expected volume by type; the availability of equipment and tools; the training of the personnel using them; how long the technique takes; and the cost including tools, training, verification and re-entry of ISM into the supply stream. The organisation may raise the level of sanitization where its risk assessment indicates.

Maintained by Gerard Blokdyk

Other controls in Sections 1 and 2: purpose, scope, audience, media types, the target of sanitization and decision factors – NIST SP 800-88 Rev 2

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-88 Rev 2 controls