UNCLASSIFIED
7.6
Secure Equipment Disposal & Re-Use
Organisations must have in place measures to manage the security risks
associated with the disposal and re-use of computer storage media holding
sensitive information. The measures must cover the sanitisation and disposal of
storage assets into secure and less secure environments for repair, exchange
and recycling. Timely and cost-effective secure equipment disposal and re-use
procedures can help achieve the following mandated security outcomes.
PH5 – All organisations must adopt formal procedures to enable the secure
disposal and re-use of storage media. To minimise the risk of unauthorised
retrieval or reconstruction of erased data, organisations must, as a minimum
requirement: (a) define secure disposal criteria; (b) define secure sanitisation
levels commensurate with information sensitivity; (c) group storage media that
requires the same treatment; (d) define criteria to guide repair, re-use,
exchange or physical destruction decisions; (e) validate the success of
sanitisation exercises; and, (f) log decommissioning activities.
To achieve the security outcomes mandated above, organisations must:
Ensure that all media used to store and process sensitive information such
as networking devices; magnetic disks and tapes; office equipment; solid
state devices (SSDs); and optical disks is sanitised and disposed of in
accordance with organisational policies and procedures;
Have in place policies and processes that define secure sanitisation levels to
help all relevant stakeholders understand the degree of wiping required to
provide reasonable assurance that data from a decommissioned asset would
not be retrieved or reconstructed;
Adopt a process to guide sanitisation activities including asset classification
verification; sanitisation and post-sanitisation activities; validation of the
success of the sanitisation activities and final sign-off; and
Ensure that where it is not possible to destroy assets handling sensitive data
securely, procedures are in place to enable their secure storage and/or
return to its owner.
51