IT UCF: Media Disposal

UCF Toolkits provide solutions to specific compliance requirements. The Media Disposal Toolkit is the first truly practical and functional step-by-step suite for managing the destruction of data and media.

Media Disposal Toolkit

Your data retention policies dictate how long data must be kept in storage. Your media disposal policies, standards, and procedures will dictate how you get rid of data that might still be on media that you are no longer using.

The Media Disposal Toolkit simplifies the management of the destruction of data and media by bundling the essential building blocks you need to establish and maintain disposal requirements for your organization.

Included in the Media Disposal Toolkit are:

The Media Disposal Implementation Guide

A UCF media disposal common controls spreadsheet

A project work breakdown structure (WBS)

A Visio diagram of the Clear, Purge, or Destroy decision tree

Ten policy implementation templates

Media Disposal

A key part of data storage compliance is knowing when to get rid of the data. This also means knowing where the data is, and is not. Many times the length of time that you will need to keep your data will outlast the media that the data is being stored on. If you have data residing on computing or communications devices, and those devices are no longer in your control, you must consider that a loss of confidentiality. Period.

This applies to both types of media – hard copy (paper, ink ribbons, etc.) as well as electronic or soft copy found on various media types (tape, disk, chips, etc.). Because there are so many different types of media, there are multiple methodologies for media sanitization that you could follow prior to disposal. However you want to look at the details of all of these sanitization methods, they really only boil down to one of three major sanitization methods:

1. Clearing - Removal of data from an information system, its storage devices, and other peripheral devices with storage capacity, in such a way that the data may not be reconstructed using common system capabilities (i.e., keyboard strokes); however, the data may be reconstructed using laboratory methods. Cleared media may be reused at the same classification level or at a higher level. Overwriting is one method of clearing.

2. Purging - Rendering stored information unrecoverable. Purging information is a media sanitization process that protects the confidentiality of information against a laboratory attack. A laboratory attack would involve a threat with the resources and knowledge to use nonstandard systems to conduct data recovery attempts on media outside their normal operating environment. This type of attack involves using signal processing equipment and specially trained personnel.

3. Destroying - The removal of an asset from existence; the asset cannot be recovered. Destruction can take the form of disintegration, incineration, pulverization, etc. For hard copy (i.e., paper or printer ribbons), it can take the form of shredding or burning.

The decision for which sanitization method you will choose should be based upon the classification of the information that you are storing on that specific media, as outlined in the diagram below.

[image]

Media sanitization methodology decision tree

The major decisions revolve around whether or not you are going to reuse the media (or allow the media to be reused by someone else), and whether or not the media is going to be out of your organization’s control if it is to be reused. Once you have those two decisions made, you’ll then need to check the information classification for what is being stored on the media in order to make the decision whether to clear, purge, or destroy the media.

Simple as that. However, inculcating the idea that you need to be able to do this the right way into your organization is something a bit trickier. Here’s what you’ll need to think through:

Which records should be on which media types in the first place
How all of this affects the organization’s information privacy program
Who should be responsible for data and media ownership (including the decision to reuse media or how/when to clear, purge, or destroy the media)
How this affects remote office workers
How redeployment is going to work in a step-by-step process (or through outsourcing)

Contents of the toolkit

The Media Disposal Toolkit provides you with the various files you’ll need to get the job done. Other than the Media Disposal Implementation Guide, we provide the following files:

File	What it is for
	This is the guide that puts it all together. We walk you through the key definitions you need to know as well as the entire Work Breakdown Structure for introducing, implementing, and managing media disposal in your organization. .
	This is the main UCF controls spreadsheet that lists all of the harmonized control titles and provides the cross references to the individual authority document citations, as well as hyperlinks to the online Common Control ID pages. This will be your main reference document for researching the individual compliance issues associated with each of the media disposal controls.
	This is a spreadsheet that links all of the disposable assets with their individual Clear, Purge, and Destroy methodologies that are suitable to that asset type.
	This is a graphic representation of the Work Breakdown Structure (WBS) that is provided with the toolkit. The WBS is also provided in a .wbs file format as well as a Microsoft Project format.
	This is a Visio diagram of the Clear, Purge, or Destroy decision tree that you can use in your presentations and documentation.
	We are providing a set of ten policies that must reflect media disposal issues. These include such topics as Systems Preventative Maintenance, Configuration Control, Remote Access and Teleworking, Privacy, and Records Management.
	So what are you waiting for? Click the buy button now and pay only $99.95 for this awesome toolkit! Not only will you get this material immediately, we'll keep you up to date for an entire year!