Media disposal process and procedures
Before media, or its waste, can be released into the public domain it needs to be sanitised, destroyed or declassified. As the compromise of official information still presents a security risk, albeit minor, an appropriate authority needs to formally authorise its release into the public domain.
In addition, removing labels and markings indicating the classification, codewords, caveats, owner, system or network details will ensure media does not display indications of its prior use and draw undue attention following its disposal.
Security Control: 0374; Revision: 2; Updated: Aug-19; Applicability: O, P, S, TS
A media disposal process, and supporting media disposal procedures, is developed and implemented.
Security Control: 0375; Revision: 3; Updated: Sep-18; Applicability: O, P, S, TS
Following sanitisation, destruction or declassification, a formal administrative decision is made to handle media, or its waste, as ‘publicly releasable’ before it is released into the public domain.
Security Control: 0378; Revision: 3; Updated: Sep-18; Applicability: O, P, S, TS
Labels and markings indicating the classification, codewords, caveats, owner, system, network, or any other marking that can associate media with its original use, are removed prior to disposal.
Further information on the disposal of ICT equipment can be found in the ICT equipment sanitisation and disposal section of the Guidelines for ICT Equipment.