1-Attachment 1 - Certificate of Destruction ContractorsVendors.pdf

Office of the Attorney General of Texas Certificate of Destruction for Contractors or Vendors

OAG Certificate of Destruction for Contractors or Vendors Attachment # 1 SoP Revised: 07-25-2025

Hard copy and electronic media must be sanitized prior to disposal or release for reuse. The OAG tracks, documents, and verifies media sanitization and disposal actions. The media must be protected and controlled by authorized personnel during transport outside of controlled areas. Approved methods for media sanitization are listed in the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Contact Name Title Company Name and Address Phone

You may attach an inventory of the media if needed for bulk media disposition or destruction.

Media Type Media Title / Document Name

Hard Copy Electronic Media Description

(Paper, Microfilm, Computer Media, Tapes, etc.)

Dates of Records Document / Record Tracking Number OAG Item Number Make / Model Serial Number

Item Sanitization CLEAR Who Completed? Who Verified?

PURGE Phone Phone DESTROY DATE Completed

Sanitization Method and/or Product Used

Final Disposition of Media Reused Internally Destruction / Disposal Reused Externally Returned to Manufacturer Other:

Comments:

If any OAG Data is retained, indicate the type of storage media, physical locations(s), and any planned destruction date.

Description of OAG Data Retained and Retention Requirements:

Proposed method of destruction for OAG approval: Type of storage media?

Physical location?

Planned destruction date?

Within five (5) calendar days of destruction or purging, provide the OAG with a signed statement containing the date of clearing, purging or destruction, description of OAG data cleared, purged or destroyed and the method(s) used.

Authorized approval has been received for the destruction of media identified above and has met all OAG Records Retention Schedule requirements including state, federal and/or internal audit requirements and is not pending any open records requests.

Records Destroyed by: Records Destruction Verified by:

Signature Date Signature Date

Be sure to enter name and contact info for who completed the data destruction and who verified data destruction in the fields above.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

Office of the Attorney General of Texas Certificate of Destruction for Contractors or Vendors

OAG Certificate of Destruction for Contractors or Vendors Attachment # 1 SoP Revised: 07-25-2025

INSTRUCTIONS FOR CERTIFICATE OF DESTRUCTION

Hard copy and electronic media must be sanitized prior to disposal or release for reuse. The OAG tracks, documents, and verifies media sanitization and disposal actions. The media must be protected and controlled by authorized personnel during transport outside of controlled areas. Approved methods for media sanitization are listed in the NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

The Office of the Attorney General (OAG) is dedicated to protecting all sensitive data, including Criminal Justice Information (CJI), Federal Tax Information (FTI), Personally Identifiable Information (PII), and Protected Health Information (PHI). To meet requirements from the FBI CJIS Security Policy and IRS Publication 1075, OAG follows strict rules for handling, sanitizing, and disposing of media containing sensitive information. According to CJIS Section 5.8 and IRS 1075 Section 8.3, all such media must be sanitized or destroyed using approved methods from NIST Special Publication 800-88 Revision 1, such as clearing, purging, or destroying, depending on the media type and data sensitivity, as listed in Appendix A..

There are two primary types of media in common use:

• Hard Copy. Hard copy media is physical representations of information. Paper printouts, printer and facsimile ribbons, drums, and platens are all examples of hard copy media.

• Electronic (or soft copy). Electronic media are the bits and bytes contained in hard drives, random access memory (RAM), read-only memory (ROM), disks, memory devices, phones, mobile computing devices, networking equipment, and many other types listed in NIST SP 800-88 Revision 1, Appendix A.

1. For media being reused within your organization, use the CLEAR procedure for the appropriate type of media. Then validate the media is cleared and document the media status and disposition.

2. For media to be reused outside your organization or if leaving your organization for any reason, use the PURGE procedure for the appropriate type of media. Then validate the media is purged and document the media status and disposition. Note that some PURGE techniques such as degaussing will typically render the media (such as a hard drive) permanently unusable.

3. For media that will not be reused, use the DESTRUCTION procedure for the appropriate type of media. Then validate the media is destroyed and document the media status and disposition.

4. For media that has been damaged (i.e. crashed drive) and can not be reused, use the DESTRUCTION procedure for the appropriate type of media. Then validate the media is destroyed and document the media status and disposition.

5. If immediate purging of all data storage components is not possible, data remaining in any storage component will be protected to prevent unauthorized disclosures. Within twenty (20) business days of contract expiration or termination, provide OAG with a signed statement detailing the nature of OAG data retained type of storage media, physical location, planned destruction date, and the proposed methods of destruction for OAG approval.

6. Send the signed Certificate of Destruction to:

Office of the Attorney General Enterprise Information Security PO Box 12017 Austin, TX 78711-2017

FAX to: 512-460-6027 or send as an email attachment to:

grc@oag.texas.gov

Final Distribution of Certificate

Original to: Celerino Torres, Chief Information Security Officer 832-693-0888

Copy to: 1. Your Company Records Management Liaison - or - Information Security Officer

2. CSD Contract Manager http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf mailto:grc@oag.texas.gov