A media sanitization programme gives storage assets a consistent, appropriate disposal path and keeps mishandling from turning into a breach. Following ISO/IEC 27040, sanitization of storage belongs inside the organisation's data governance, which at minimum specifies policies setting expectations for disposal (transfer, reuse, destruction) and minimum acceptable sanitization methods, identifies the scope and the decision criteria, performs the sanitization, determines whether the sanitization performed was adequate, and identifies the records or evidence needed to meet compliance obligations.

NIST SP 800-88 Rev 2 4: Make storage sanitization part...

Other controls in Section 4: the media sanitization programme (policy, scope, decision framework, performance, assurance, documentation, roles) – NIST SP 800-88 Rev 2

4.1 Storage sanitization policy: align data classification with minimum methods; set disposal and reuse requirements, expected outcomes and acceptable techniques, documentation, roles and competencies, tool calibration and maintenance, and the vendor assurances required
4.2 Scope: unclassified federal ISM never holding FOUO, Privacy Act or PII need no sanitization; otherwise target all user data, treat selective and partial sanitization as risky, and prefer whole-ISM sanitization while allowing partial CE where justified
4.3 Decision framework: identify the confidentiality level under FIPS 199 and SP 800-60, accept clear for moderate data only as a conscious risk decision, weigh purge or clear against destroy for lease returns, environment, reuse, cost and feasibility, and decide on confidentiality rather than media type
4.3.1 Plan sanitization from the system security plan onward: choose ISM with sanitization in mind, obtain Statements of Volatility and the Appendix B characteristics, identify every ISM inside each item, combine techniques such as CE before shipment, and dispose without sanitization only where disclosure would cause no harm
4.3.2 Security categorisation set early under FIPS 199, SP 800-60 or CNSSI 1253, revisited at least every three years or on significant change, and internal confidentiality labels assigned to uncategorised information such as hard copy
4.3.3-4.3.4 Decide on reuse (destroy is simplest when media will not be reused) and account for who controls the media: maintenance under contract or on-site supervision stays under organisational control, warranty exchanges and other non-returned media do not, and legal rules may treat loss of unsanitized media as a breach
4.3.5 Consider the data protection level alongside organisational control when deciding whether sanitization is necessary
4.3.6 Make and record the risk-based sanitization decision, then put the process, resources, verification steps and interfaces with key officials in place to carry it out

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-88 Rev 2 controls

NIST SP 800-88 Rev 2 4: Make storage sanitization part of data governance with, at minimum, disposal policies and minimum methods, scope and decision criteria, performance of sanitization, adequacy determination and the records needed for compliance

What does 4 require?

Other controls in Section 4: the media sanitization programme (policy, scope, decision framework, performance, assurance, documentation, roles) – NIST SP 800-88 Rev 2

Query this from an agent