CCI-002578

Defines system media to sanitize prior to disposal, release out of organizational control, or release for reuse using organization-defined sanitization techniques and procedures.

Implementation Guidance

Determine if: - [MP-06_ODP[01]; system media to be sanitized prior to disposal is defined] is sanitized using [MP-06_ODP[04]; sanitization techniques and procedures to be used for sanitization prior to disposal are defined] prior to disposal. - [MP-06_ODP[02]; system media to be sanitized prior to release from organizational control is defined] is sanitized using [MP-06_ODP[05]; sanitization techniques and procedures to be used for sanitization prior to release from organizational control are defined] prior to release from organizational control. - [MP-06_ODP[03]; system media to be sanitized prior to release for reuse is defined] is sanitized using [MP-06_ODP[06]; sanitization techniques and procedures to be used for sanitization prior to release for reuse are defined] prior to release for reuse.

Validation Procedures

Examine: [SELECT FROM: System media protection policy; procedures addressing media sanitization and disposal; applicable federal standards and policies addressing media sanitization policy; media sanitization records; system audit records; system design documentation; records retention and disposition policy; records retention and disposition procedures; system configuration settings and associated documentation; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with media sanitization responsibilities; organizational personnel with records retention and disposition responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for media sanitization; mechanisms supporting and/or implementing media sanitization].

The controls below (if any) were marked by NIST as being related to CCI-002578.