NIST SP 800-88 Rev 2 4.2: Scope: unclassified federal ISM never holding FOUO, Privacy Act or PII need no sanitization; otherwise target all user data, treat selective and partial sanitization as risky, and prefer whole-ISM sanitization while allowing partial CE where justified

What does 4.2 require?

For federal organisations, unclassified ISM never used in a classified system and holding no For Official Use Only, Privacy Act or personally identifiable information need not be sanitized. For most operations the target is all user data, not just the sensitive subset. Selective sanitization (specific sensitive data wherever it resides) and partial sanitization (a region of the ISM) are possible but risky, because data may have spilled into remapped blocks or overprovisioned areas and vendor sanitize interfaces usually work at device level. On encrypting ISM that use different keys for different partitions, CE can support some partial sanitization when the interface allows a subset of keys to be sanitized, with assurance depending on the vendor implementation and on confidence that data stayed within the sanitizable region. Whole-ISM sanitization is preferred whenever possible; an organisation that applies partial sanitization, for example to retain other customers' data on shared data centre media it still controls, understands the risks and makes a deliberate decision, bearing in mind that partial sanitization is better than none.