MP-6 Media Sanitization (L) (M) (H)

NIST 800-53 (r4) Control:

The organization:

a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [FedRAMP Assignment: (H) techniques and procedures IAW NIST SP 800-88 and Section 5.9: Reuse and Disposal of Storage Media and Hardware] in accordance with applicable federal and organizational standards and policies; and

b. Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

NIST 800-53 (r4) Supplemental Guidance:

This control applies to all information system media, both digital and non-digital, subject to disposal or reuse, whether or not the media is considered removable. Examples include media found in scanners, copiers, printers, notebook computers, workstations, network components, and mobile devices. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media containing information deemed to be in the public domain or publicly releasable, or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes, for example, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections/words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media containing classified information. Related controls: MA-2, MA-4, RA-3, SC-4.

References: FIPS Publication 199; NIST Special Publications 800-60, 800-88; Web: http://www.nsa.gov/ia/mitigation_guidance/media_destruction_guidance/index.shtml.

NIST 800-53 (r5) Discussion:

Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.

38North Guidance:

Meets Minimum Requirement:

• The organization maintains a list of specific system media that must be sanitized prior to disposal, release out of organizational control, or release for reuse

• There are procedures to sanitize the system media prior to:

  1. 1. disposal,

     2. release out of organizational control, and

     3. release for reuse

• Procedures are consistently followed and artifacts showing successful sanitization is maintained

Best Practice:

• TBD

Unofficial FedRAMP Guidance: For a high system, the organization must follow NIST SP 800-88 and Section 5.9: Reuse and Disposal of Storage Media and Hardware

Assessment Evidence:

• List of system media that has been disposed and accompanying sanitization records/receipts

• List of system media that has been released out of organizational control and accompanying sanitization records/receipts

• List of system media that has been released for reuse and accompanying sanitization records/receipts

• List of system media/devices that have been returned by personnel and accompanying sanitization records/receipts

• If external services are used, contract between the CSP and the external service

CSP Implementation Tips:

• Amazon Web Services (AWS): Fully Inherited

• Microsoft Azure: Fully Inherited

• Google Cloud Platform: Fully Inherited