Direct answer
Inventory the storage media and data sensitivity, choose a sanitization method appropriate to that media and disposition, and document verification before release or disposal.
Identify all storage
Record the device owner, asset identifier, media type and intended destination. Include removable cards, secondary drives and replacement components. Confirm retention obligations and preserve approved backups before any destructive operation.
Select the method
NIST's current media sanitization guidance addresses techniques and controls based on media and information sensitivity. Consult current device-specific procedures and the organization's approved policy; a simple file deletion or factory reset is not automatically a verified sanitization method.
Reference: NIST SP 800-88 Rev. 2: Media sanitization.
Verify and document
Assign an authorized operator, record the method, result, verification and disposition, and maintain custody through handoff. If a drive cannot be sanitized or verified, follow the approved exception and destruction process. Do not release the equipment merely because a reset was initiated.
Example: a failed laptop drive
If a drive cannot boot or complete the approved sanitization process, retain custody and record the asset identifier and failed verification. The owner must decide whether an approved specialist or physical destruction is appropriate for the media and data sensitivity. Do not release the failed drive to a recycler merely because the laptop itself was reset.
Assessment limits
Appropriate sanitization depends on media technology, encryption, device design and data sensitivity. A generic procedure cannot guarantee data removal on every drive.
Frequently asked questions
Does deleting files sanitize a drive?
Not necessarily. Select and verify an approved method appropriate to the media.
Should data be preserved first?
Confirm retention and backup requirements with the owner before any irreversible sanitization.
What if verification fails?
Keep the media controlled and follow the organization's exception or destruction procedure.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.