Data Sanitisation
What is Data Sanitisation?
The process of deliberately, permanently, and irreversibly removing or destroying data stored on a memory device. Data sanitisation ensures that residual data cannot be recovered even with advanced forensic tools.
Frameworks that govern data sanitisation
What the standards actually require on data sanitisation
Requirements naming data sanitisation across 6 standards, quoted from the control text.
Discloses the availability of security guidance for the device's operators and administrators and for the manufacturer's sales and service: whether security documentation for the owner or operator is included, whether as a dedicated document or within the user...
mds2-medical-device::SGUD · SGUD Security guidance: disclose owner and operator security documentation, data sanitisation, account documentation and recommended compensating controls →Management establishes code repository policies that specify which repositories are used and where their data reside, prohibit public forums and personal accounts for entity business, establish source code ownership, require business accounts and prohibit enti...
ffiec-it-examination-handbook::DAM-VII.B.2(c) · VII.B.2(c) Code Repository Controls (Development, Acquisition, and Maintenance) →ISMAP Data Protection establishes comprehensive data lifecycle controls. (1) Data Classification: customer government data must be classified per Japanese government data classification scheme + including (a) General + (b) Sensitive + (c) Confidential + (d) St...
ISMAP-DataProtection-Classification-Encryption-DataResidencyJapan-Backup-SecureDeletion-Cryptography-FIPS · ISMAP Data Protection - Data Classification + AES-256 Encryption At Rest + TLS 1.3 In Transit + Data Residency Japan + Backup + Secure Deletion + Cryptography per FIPS 140-3 + CRYPTREC + KMS HSM →Production data: no Level 1 requirement. Level 2 (a to d): controls stop production data being extracted or copied to test or other lower environments, systems or media without equivalent controls;
mtcs-singapore::12.12 · Production data →Implement Section 7.1 incident response for servers per NIST SP 800-61 covering preparation + detection + analysis + containment + eradication + recovery + post-incident review + coordination with CSIRT + US-CERT + CISA + Cyber Threat Intelligence (CTI) sharin...
NISTSP123-7 · Incident Response and Server Decommissioning →Operate OT supply chain + asset lifecycle + physical security per NIST SP 800-82 Rev 3 Chapter 6 + Chapter 7. OT Supply Chain Security must (a) qualify OT vendors and suppliers per NIST SP 800-161 Supply Chain Risk Management tailored to OT (vendor cybersecuri...
NISTSP82-8 · OT Supply Chain Security, Asset Lifecycle, and Physical Security →Questions people ask about data sanitisation
What is Data Sanitisation?
Why is Data Sanitisation important for compliance?
Which compliance frameworks address Data Sanitisation?
Where can I learn more about Data Sanitisation?
See how Data Sanitisation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.