Data destruction to NIST 800-88, on site or in a secured facility

Data destruction is independent of the final destination of the hardware.

Storage media are first processed according to the agreed method. Only after processing is complete and the required documentation is available is equipment released for further processing, reuse or sale.

This keeps the burden of proof independent of the final transaction.

NIST 800-88 describes various methods for securely erasing data.

Depending on the type of storage medium and the security requirements, you can choose between:

Clear – data is overwritten and no longer accessible to regular users.

Purge – additional techniques make recovery practically impossible, even with specialized tools.

Physical Destruction – the storage medium is physically destroyed and permanently rendered unusable.

The chosen method is recorded as part of the project file.

Not every organization has the same requirements for data processing.

For projects with heightened security requirements, data destruction can take place within your own environment, for example in a server room or datacenter.

Where transport is permitted, storage media are processed within a secured processing facility as part of a controlled process.

For every processed storage medium, documentation is recorded.

Depending on the method applied, this can consist of erasure certificates, destruction certificates and additional audit information. This documentation is linked to the relevant storage medium and made available centrally within the project file.

This keeps it demonstrable which method was applied and when processing took place.

Not every storage medium calls for the same approach.

Traditional hard drives, SSDs, mobile devices and server storage have different technical properties and sometimes require a different method of processing.

The sensitivity of the data also plays a role in the choice between erasing, sanitizing or physical destruction.

Some storage media are defective, damaged or no longer accessible.

In those situations, software-based processing cannot be carried out. Physical destruction then forms the final step of the process, so that these storage media are also demonstrably and permanently taken out of use.

This processing is likewise recorded within the audit trail and project documentation.

Data destruction is only valuable when it has been demonstrably carried out.

That is why the method applied, certificates, serial numbers and project data are recorded within one verifiable file. This gives organizations the documentation they need for audits, compliance obligations and internal controls.