Digital Media Destruction Guidance
The National Security Agency (NSA) provides specific guidance for complying with digtal media and hard drive destruction projects. The manual entitled NSA/CSS Storage Device Sanitization Manual 9-12 details the proper methodology and equipment required for contractors and agencies. In addition, the NSA/CSS Policy 6-22 “Handling of NSA/CSS Information Storage Media” assigns responsibilities for the secure handling of all NSA/CSS information media storage These policies and manuals detail the acceptable equipment and methodology for hard drive destruction.
NSA’s Center for Storage Device Sanitization Research (CSDSR)
NSA’s Center for Storage Device Sanitization Research (CSDSR)
NSA Evaluated Data Destruction Equipment
The NSA has compiled a list of equipment that has been tested and approved for digital media destruction. This list includes equipment for hard drives, SSDs, magnet tapes and other digial media.
Physical Destruction
NSA Digital Media Guidelines requires that hard drives and other digital media be physically destroyed. Magnetic media, solid state and optical media have different requirements for destruction. See the NSA EPL list for the appropriate equipment.
Erasing and wiping software has not been approved!
Vendor Due Diligence
You may use a vetted data destruction vendor if your organization does not have media destruction on the EPL list.
Verify that your data destruction provider has equipment listed on the EPL. Ask the vendor for the make, model and serial number for each machine on the EPL.
Physically Destroy Hard Drives and Digital Media
Degauss and destroy. More specifically, degauss with a machine on the NSA Degausser Evaluated List. Cheaper and less powerful degaussing machines do not have enough magnetic force to penetrate heavily shielded server drives.
The destruction of the hard drive consists of “physically damaging by deforming the internal platters…” The NSA/CSS Policy Manual 9-12 “Storage Device Sanitization and Destruction Manual” does not require shredding the drive to a certain siz