Media sanitization
Media sanitization is a process intended to make access to specified data on storage media infeasible for a defined level of recovery effort.
A device leaving the office is a custody event. Whether its data can still be recovered is a separate question. A recycling receipt cannot answer both.
NIST SP 800-88 Revision 2 distinguishes clear, purge, and destroy methods. The appropriate choice depends on the media, the information’s sensitivity, and what will happen to the device. Sanitization does not always mean physically destroying it, and ordinary file deletion should not be treated as proof of a sufficient outcome.
Check the operation and accept the result
NIST separates verification, which checks the sanitization operation’s outcome, from validation, which decides whether the result is adequate. Records should connect the method and outcome to the media involved. A generic statement that a supplier “handles secure recycling” leaves that connection missing.
The SEC’s 2022 Morgan Stanley Smith Barney settlement described equipment sold with customer information still present after disposal failures. The firm settled without admitting or denying the findings. Our retired-device article explains how to keep the pickup approval and sanitization evidence distinct.
If a device instead arrives unexpectedly, the USB-delivery article covers the receiving decision. Do not connect unknown media to a work computer to determine whether it looks empty or safe.