a. removing power from the media for at least 10 minutes, or b. overwriting all locations of the media with an arbitrary pattern followed by a read back for verification. MS 12. *Non-volatile magnetic media is sanitised by: a. overwriting the media, if pre-2001 or under 15GB, in its entirety, with an arbitrary pattern followed by a read back for verification three times b. overwriting the media, if post-2001 or over 15GB, in its entirety, with an arbitrary pattern followed by a read back for verification one time; or c. using a degausser with sufficient field strength for the coercivity of the media (NOTE: Degaussing may render some modern media unusable) MS 13. Non-volatile EPROM media is sanitised by erasing as per the manufacturer’s specification, increasing the specified ultraviolet erasure time by a factor of three, then overwriting the media once in its entirety with a pseudo random pattern. Sanitization of media with rating C3 & above SHOULD be documented. MS 14. Flash memory media is sanitized by overwriting the media twice in its entirety with a pseudo random pattern, followed by a read back for verification. 8.4. Policy & Baseline Controls - Media Repairing and Maintenance In order to comply with this policy, Agencies MUST ensure: MS 15. *Appropriately vetted and briefed personnel carry out repairs and maintenance for hardware containing classified information. MS 16. Repairs on systems containing classified information rated C3 or above are carried out under supervision.. 8.5. Policy & Baseline Controls - Media Destruction & Disposal In order to comply with this policy, Agencies MUST ensure: MS 17. They document procedures for the destruction and disposal of media. MS 18. *Media is destroyed by: a. Deguassing non-volatile magnetic media b. breaking up the media c. heating the media until it has either burnt to ash or melted. MS 19. *Staff members supervise the destruction of media: a. handling the media to the point of destruction b. ensuring that the destruction is completed successfully. c. C3 & above media destruction must be documented. MS 20. Media, including faulty media, containing classified information is sanitised to the extent possible prior to disposal. MS 21. *The disposal of media and media waste does not attract undue attention. 9. Access Control Security [AM] 9.1. Policy Objective The objective of this policy is to establish the use and deployment of a variety of access control solutions to ensure the confidentiality, integrity, and availability of the Agency’s information assets. This policy defines the rules necessary to achieve this protection, and to ensure secure and reliable operation of the Agency’s information systems. 9.2. Policy & Baseline Controls - General In order to comply with this policy, Agencies MUST ensure: NATIONAL INFORMATION ASSURANCE MANUAL 40