Cybersecurity Project

Media Sanitization and Destruction Policy Sample (Required Written Policy)

1.0 Purpose The purpose of this policy is to outline the proper disposal/sanitization/destruction of media (physical or electronic) at [agency name]. These rules are in place to protect sensitive and classified information, employees and [agency name]. Inappropriate disposal of [agency name] and Criminal Justice Information (CJI) and media may put employees, [agency name] and LEIN/NCIC at risk. 2.0 Scope This policy applies to all [agency name] employees, contractors, temporary staff, and other workers at [agency name], with access to LEIN/NCIC CJIS systems and/or data, sensitive and classified data, and media. This policy applies to all equipment that processes, stores, and/or transmits LEIN/NCIC CJI and classified and sensitive data that is owned or leased by [agency name]. 3.0 Policy When no longer usable, hard drives, diskettes, tape cartridges, CDs, ribbons, hard copies, print-outs, and other similar items used to process, store and/or transmit CJI and classified and sensitive data shall be properly disposed of in accordance with measures established by [agency name]. Physical media (print-outs and other physical media) shall be disposed of by one of the following methods:

1) shredded using [agency name] issued cross-cut shredders 2) placed in locked shredding bins for [private contractor name] to come on-site and cross-cut

shred, witnessed by [agency name] personnel throughout the entire process

3) incineration using [agency name] incinerators or witnessed by [agency name] personnel onsite at agency or at contractor incineration site, if conducted by non-authorized personnel

Electronic media (hard-drives, tape cartridge, CDs, printer ribbons, flash drives, printer and copier hard-drives, etc.) shall be disposed of by one of the [agency name] methods:

1) Overwriting (at least 3 times) - an effective method of clearing data from magnetic media. As the name implies, overwriting uses a program to write (1s, 0s, or a combination of both) onto the location of the media where the file to be sanitized is located.

2) Degaussing - a method to magnetically erase data from magnetic media. Two types of

degaussing exist: strong magnets and electric degausses. Note that common magnets (e.g., those used to hang a picture on a wall) are fairly weak and cannot effectively degauss magnetic media.

3) Destruction – a method of destroying magnetic media. As the name implies, destruction of

magnetic media is to physically dismantle by methods of crushing, disassembling, etc., ensuring that the platters have been physically destroyed so that no data can be pulled.

IT systems that have been used to process, store, or transmit FBI CJI and/or sensitive and classified information shall not be released from [agency name]‘s control until the equipment has been sanitized and all stored information has been cleared using one of the above methods.

1

4.0 Penalties Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination.

2