What is data sanitization?
Data sanitization is the documented removal of data from storage so it cannot be recovered, using a recognized standard, with records that prove it was done for each device.
When a device reaches end of life, deleting files is not enough. Data that has been deleted can often be recovered, and that creates breach, regulatory and reputational risk long after the device has left the building.
Sanitization follows NIST SP 800-88, matching the method to the media: clearing, purging or physically destroying it as the risk requires. Every asset is tracked and documented from start to finish, so you can prove destruction to auditors, regulators and customers.
Who needs it?
- A business retiring laptops, servers or storage
- An organization that must prove data destruction to an auditor, regulator or customer
- A company returning leased equipment or changing data centres
What problems does it address?
- Deleted files that can still be recovered from the drive
- No record of which devices were wiped, how and by whom
- Self-encrypting and solid-state drives that ordinary wiping does not fully clear
- Audit or contract requirements for proof of destruction
Standards
- NIST SP 800-88 Rev. 1 (Clear, Purge, Destroy)
- IEEE 2883-2022
- ISO/IEC 27040 and 27041
- DoD 5220.22-M, where a contract still specifies it
Media
- Hard drives and SSDs, including self-encrypting drives
- NVMe and M.2 drives
- USB drives and removable media
- Mobile devices and tablets
- Servers and enterprise storage arrays
- Network equipment and IoT devices
- Virtual machines and cloud workloads
What you receive
- A certificate of destruction for every asset
- Chain-of-custody documentation
- Asset tagging and inventory reports
- On-site or off-site service
- Records ready for an audit
What happens afterward?
You keep a certificate and a chain-of-custody record for every asset, ready to hand to an auditor, regulator or customer.
How the engagement works
Free consultation
A 45-minute call with a senior consultant about your situation. It is a conversation, not an assessment. You leave with a recommended next step.
Scope and rules
Scope, constraints and price are agreed in writing before any work starts.
The work
Carried out by the senior consultant who scoped it.
Report and walkthrough
Findings ranked by business risk, with a walkthrough for the people who will act on them.
