NSA CSS Policy Manual.pdf

UNCLASSIFIED

NSA/CSS POLICY MANUAL 9-12

STORAGE DEVICE SANITIZATION

AND DESTRUCTION MANUAL

PUBLICATION INFORMATION

DATE: 4 December 2020 (See Document History.)

OFFICE OF PRIMARY

INTEREST:

Center for Storage Device Sanitization Research

(301) 688-1053, 977-7113 (secure)

RELEASABILITY: NSA/CSS Policy Manual 9-12 is approved for public release. The official document is available on the Office of Policy (P12) website (“go policy”).

AUTHORITY: Anne Neuberger, Director, Cybersecurity

ISSUED: 4 December 2020

PURPOSE AND SCOPE

1. This policy manual provides routine guidance for sanitization of information system

(IS) storage devices for disposal or recycling in accordance with Department of Defense (DoD)

Manual 5200.01, Volume 3, “DoD Information Security Program: Protection of Classified

Information” (Reference a), Intelligence Community Standard 500-34, “Electronic Waste (E-

Waste) Management and Disposal” (Reference b), and NSA/CSS Policy 9-12, “Storage Device

Sanitization and Destruction” (Reference c). Information stored on these devices may range from

UNCLASSIFIED to TOP SECRET and may include compartmented, sensitive, or limited-distribution material. Furthermore, this manual provides information about how to obtain current listings of evaluated sanitization equipment that meets NSA/CSS specifications.

2. This manual applies to all NSA/CSS elements, contractors, and personnel, and pertains to all IS storage devices that they use.

https://urn.nsa.ic.gov/policy https://urn.nsa.ic.gov/policy

Policy Manual 9-12 4 December 2020

UNCLASSIFIED

TABLE OF CONTENTS

Publication Information

Purpose and Scope

Procedures

Hard-Copy IS Storage Devices

Paper

Punched Tape

Cathode Ray Tube and Plasma Monitors

Magnetic IS Storage Devices

Magnetic Tapes:

Hard Disk Drives

Hybrid IS Storage Devices

Magnetic Hard Disk Drives

Optical IS Storage Devices

Solid-State IS Storage Devices

Responsibilities

Center for Storage Device Sanitization Research (CSDSR)

NSA/CSS Elements, Contractors, and Personnel

References

Glossary

Document History

LIST OF TABLES

Table 1: Paper Sanitization

Table 2: Punched Tape Sanitization

Table 3: Cathode Ray Tube & Plasma Monitor Sanitization

Table 4: Magnetic Tape Sanitization

Table 5: Hybrid Drive Sanitization

Table 6: Magnetic Hard Drive Sanitization

Table 7: CD Sanitization

Table 8: CD, DVD, Blu-ray Sanitization

Table 9: Solid-State IS Device Sanitization

UNCLASSIFIED

PROCEDURES

3. Guidance for sanitizing and releasing IS storage devices that is not covered by this document may be obtained by submitting all pertinent information to NSA/CSS (Attention:

Center for Storage Device Sanitization Research, 301-688-1053, csdsr@nsa.gov).

4. The overall process, internal to NSA/CSS, for routine sanitization of any IS storage device will consist of the following:

a. Sanitization—sanitize IS storage devices using the approved procedures in the device-specific sections below;

b. Administrative Declassification—administratively declassify IS storage devices only after completing approved verification and review procedures in accordance with NSA/CSS Policy 6-22, “Handling of NSA/CSS Information Storage Media”

(Reference d); and

c. Release—unless otherwise specified by the appropriate IS security officer (or equivalent), administratively declassified IS storage devices may be released for disposal or recycling only after sanitization procedures and an administrative declassification review have been completed in accordance with NSA/CSS Policy 6-22 (Reference d).

5. Individuals outside of NSA/CSS should contact their local security office for appropriate administrative declassification procedures.

Hard-Copy IS Storage Devices

6. Hard-copy IS storage devices include paper, punched tape, and cathode ray tube and plasma monitors exhibiting burn-in.

Paper

7. Sanitize paper by using one of the following procedures (summarized in table 1):

a. Chopping, pulverizing, wet pulping—material residue must be reduced to pieces that are 5 millimeters or smaller on edge.

b. Disintegration—disintegrate paper using an NSA/CSS-evaluated paper disintegrator, per the NSA/CSS Evaluated Products List for Paper Disintegrators

(Reference e).

c. Incineration—incinerate at a temperature greater than 233ºC.

d. Shredding—shred paper using a paper shredder included on the NSA/CSS

Evaluated Products List for Paper Shredders (Reference f).

8. Proceed to the administrative declassification step.

mailto:csdsr@nsa.gov

UNCLASSIFIED

Table 1: Paper Sanitization

Sanitize Administratively Declassify Destroy

Use one of the following methods:

a. Chopping, pulverizing, or wet pulping

b. Disintegration

c. Incineration

d. Shredding

Refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Punched Tape

9. Sanitize punched tape by using one of the following procedures (summarized in table 2):

a. Incineration—incinerate at a temperature greater than 233ºC.

b. Disintegration—disintegrate punched tape using a punched tape disintegrator included on the NSA/CSS Evaluated Products List for Punched Tape Disintegrators

(Reference g).

10. Proceed to the administrative declassification step.

Table 2: Punched Tape Sanitization

Sanitize Administratively Declassify Destroy

Use one of the following methods:

a. Incineration

b. Disintegration

Refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Cathode Ray Tube and Plasma Monitors

11. Sanitize cathode ray tube and plasma monitors exhibiting burn-in by using one of the following procedures (summarized in table 3) after removing all labels or markings that indicate previous use or classification:

a. Disintegration—disintegrate the surface of the monitor into pieces no larger than 5 centimeters on edge.

b. Cleaning—sanitize cathode ray tubes by cleaning the inside of the tube, removing any burn-in.

UNCLASSIFIED

12. Proceed to the administrative declassification step.

Table 3: Cathode Ray Tube & Plasma Monitor Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Disintegration

b. Cleaning

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Magnetic IS Storage Devices

13. Magnetic IS storage devices include tapes and hard disk drives.

Magnetic Tapes:

14. Sanitize magnetic tapes using one of the following procedures (summarized in table 4) after removing all labels or markings that indicate previous use or classification:

a. Degaussing—degauss using one of the magnetic degaussers included on the

NSA/CSS Evaluated Products List for Magnetic Degaussers (Reference h).

b. Disintegration—disintegrate into particles that are nominally 2 millimeters in size; disintegrating magnetic tapes in bulk lots with other storage devices is highly recommended.

c. Incineration—incinerate at temperature greater than 650ºC.

15. Proceed to the declassification step.

Table 4: Magnetic Tape Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Degaussing

b. Disintegration

c. Incineration

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

UNCLASSIFIED

Hard Disk Drives

16. A hard disk drive may be a hybrid IS storage device that contains both magnetic and solid-state storage device components; the magnetic storage device is within the case and solid-state storage devices are on the external circuit board. A solid-state storage device appears to be identical to a magnetic hard disk drive; hybrid hard disk drives, however, can be identified by manufacturer and model number. Laptop hard disk drives manufactured in 2006 and later and

Enterprise hard disk drives manufactured in 2013 and later are potentially hybrid disk drives.

Hybrid drives require additional procedures beyond those outlined for typical magnetic hard disk drives.

Hybrid IS Storage Devices

17. Sanitize hybrid hard disk drives by using one of the following procedures

(summarized in table 5) after removing all labels or markings that indicate previous use or classification:

a. Incineration—incinerate at temperature greater than 670ºC.

b. Disintegration—disintegrate into particles that are nominally 2 millimeters in size on edge. It is highly recommended to disintegrate hybrid IS storage devices in bulk lots with other storage devices.

c. Separate the hard disk drive case and the external circuit board. Follow sanitization procedures for the hard disk drive case in accordance with magnetic hard disk drives instructions (beginning at paragraph 19) and follow sanitization procedures for the hard disk drive external circuit board in accordance with solid-state IS storage devices (beginning at paragraph 24).

18. Proceed to the administrative declassification step.

UNCLASSIFIED

Table 5: Hybrid Drive Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Incineration

b. Disintegrate

c. Separate circuit board from hard drive, then:

1. Follow magnetic hard disk drive procedures to sanitize hard drive

(paragraph 19).

2. Follow solid-state IS storage device procedures to sanitize circuit board

(paragraph 24).

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Magnetic Hard Disk Drives

19. Sanitize hard disk drives using one of the following procedures (summarized in table 6) after removing all labels or markings that indicate previous use or classification:

a. Manual/automatic degausser—degauss using one of the magnetic degaussers included on the NSA/CSS Evaluated Products List for Magnetic Degausser

(Reference h). It is also required that the hard disk drive be physically damaged by deforming the internal platters by any means before release or by using one of the hard disk drive destruction devices included on the NSA/CSS Evaluated Products List for

Hard Disk Drive Destruction Devices (Reference i).

b. Degaussing wand—sanitize hard disk drives by disassembling the device and erasing all surfaces of the enclosed platters using one of the hand-held magnetic degaussing wands included on the NSA/CSS Evaluated Products List for Magnetic

Degaussers (Reference h). It is also required that the hard disk drive be physically damaged by deforming the internal platters by any means before release or by using one of the hard disk drive destruction devices included on the NSA/CSS Evaluated Products

List for Hard Disk Drive Destruction Devices (Reference i).

c. Disintegration—disintegrate into particles that are nominally 2 millimeters in size on edge. It is highly recommended to disintegrate hard disk drives in bulk lots with other storage devices.

UNCLASSIFIED

d. Incineration—incinerate at a temperature greater than 670ºC.

20. Proceed to the administrative declassification step.

Table 6: Magnetic Hard Drive Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Manual/automatic degaussing

b. Degaussing wand

c. Disintegration

d. Incineration

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Optical IS Storage Devices

21. Optical IS storage devices include compact discs (CDs), digital versatile discs

(DVDs), and Blu-ray discs (BDs).

22. Sanitize optical IS storage devices using one of the following procedures after removing all labels or markings that indicate previous use or classification:

a. Sanitize CDs using one of the following procedures (summarized in table 7):

1) Disintegration—disintegrate using one of the paper or solid-state disintegrators included on the NSA/CSS Evaluated Products List for Paper

Disintegrators (Reference e), the NSA/CSS Evaluated Products List for Solid

State Disintegrators (Reference j), or the NSA/CSS Evaluated Products List for

Optical Destruction Devices (Reference k) that is approved for CDs, DVDs, or

BDs.

2) Embossing/knurling—use one of the embossers/knurlers included on the NSA/CSS Evaluated Products List for Optical Destruction Devices

(Reference k).

3) Grinding—use one of the grinders included on the NSA/CSS Evaluated

Products List for Optical Destruction Devices (Reference k).

4) Proceed to the administrative declassification step.

UNCLASSIFIED

Table 7: CD Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Disintegration

b. Embossing/knurling

c. Grinding

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

b. Sanitize CDs, DVDs, and BDs using one of the following procedures

(summarized in table 8) after removing all labels or markings that indicate previous use or classification:

1) Disintegration—disintegrate using one of the solid-state disintegrators that is included on the NSA/CSS Evaluated Products List for Solid State

Disintegrators (Reference j) and approved for CDs, DVDs, or BDs.

2) Incineration—incinerate at a temperature greater than 600ºC.

3) Proceed to the administrative declassification step.

Table 8: CD, DVD, Blu-ray Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. NSA/CSS-evaluated solid-state disintegrator

b. Incineration

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

Solid-State IS Storage Devices

23. Solid-state IS storage devices include RAM (random-access memory), ROM (read-only memory), FPGA (field programmable gate array), and flash memory.

24. Sanitize solid-state IS storage devices using one of the following procedures

(summarized in table 9) after removing all labels or markings that indicate previous use or classification:

UNCLASSIFIED

a. Disintegration—disintegrate using one of the solid-state disintegrators included on the NSA/CSS Evaluated Products List for Solid State Disintegrators (Reference j). It is highly recommended that solid-state IS storage devices be disintegrated in bulk lots with other storage devices.

b. Incineration—incinerate at temperature greater than 500ºC.

c. Power removal—sanitize only DRAM (dynamic random-access memory), SRAM (static random-access memory), and volatile FPGA by removing the power, including backup batteries. After power is removed, sanitization occurs within 60 minutes.

d. Proceed to the administrative declassification step.

Table 9: Solid-State IS Device Sanitization

Sanitize Administratively

Declassify

Destroy

Remove all labels or markings, then use one of the following methods:

a. Disintegration

b. Incineration

c. Power removal only for

DRAM, SRAM, and volatile

FPGA

Please refer to paragraph 4.b for administrative declassification procedures.

Process residual product as unclassified for disposal or recycling.

RESPONSIBILITIES

Center for Storage Device Sanitization Research (CSDSR)

25. The CSDSR shall:

a. Provide technical guidance for sanitizing and destroying IS storage devices;

and

b. Establish and maintain a compilation of guidance and procedures for sanitizing, administratively declassifying, and releasing classified or sensitive information on IS storage devices.

NSA/CSS Elements, Contractors, and Personnel

26. NSA/CSS elements, contractors, and personnel using this manual shall follow the procedures in NSA/CSS Policy 6-22 (Reference d) for requesting, conducting, and documenting the sanitization and administrative declassification of IS storage devices.

UNCLASSIFIED

REFERENCES

Please note: The latest versions of all NSA/CSS Evaluated Products Lists can be found on the

Internet at https://www.nsa.gov/resources/everyone/media-destruction/.

a. DoD Manual 5200.01, Volume 3, “DoD Information Security Program: Protection of

Classified Information,” dated 24 February 2012, incorporating change 2, 19 March 2013

b. Intelligence Community Standard 500-34, “Electronic Waste (E-Waste) Management and

Disposal,” dated 24 September 2015

c. NSA/CSS Policy 9-12, “Storage Device Sanitization and Destruction,” dated

4 December 2020

d. NSA/CSS Policy 6-22, “Handling of NSA/CSS Information Storage Media,” dated 21 November 2019

e. NSA/CSS Evaluated Products List for Paper Disintegrators

f. NSA/CSS Evaluated Products List for Paper Shredders

g. NSA/CSS Evaluated Products List for Punched Tape Disintegrators

h. NSA/CSS Evaluated Products List for Magnetic Degaussers

i. NSA/CSS Evaluated Products List for Hard Disk Drive Destruction Devices

j. NSA/CSS Evaluated Products List for Solid State Disintegrators

k. NSA/CSS Evaluated Products List for Optical Destruction Devices

GLOSSARY

administrative declassification—an administrative decision/action based on a consideration of risk by the owner, resulting in the classification of a properly sanitized storage device being downgraded to UNCLASSIFIED

(NOTE: This term is unrelated to the term “declassification” as defined in Executive

Order 13526, “Classified National Security Information.”) burn-in—The term “burn-in” means the tendency for an image that is shown on a display over a long period of time to become permanently fixed on the display. This is sometimes seen in such emissive displays as cathode ray tube and plasma, because chemical changes can occur in the phosphors when exposed repeatedly to the same electrical signals.

degausser—an electrical device or permanent magnet assembly that generates a coercive magnetic force in order to degauss (or demagnetize) magnetic storage devices or other magnetic material https://policy.sp.web.nsa.ic.gov/PolicyDepot/DoDM%205200.01%20V3%2020130319.pdf https://policy.sp.web.nsa.ic.gov/PolicyDepot/ICS%20500-34%2020150924.pdf https://urn.nsa.ic.gov/policy9-12 https://urn.nsa.ic.gov/policy6-22 https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr https://urn.nsa.ic.gov/csdsr degaussing (or demagnetizing)—process for reducing the magnetization of a storage device to zero by applying a reverse (coercive) magnetizing force, rendering any previously stored data unreadable and unintelligible and ensuring that it cannot be recovered by any technology known to exist incineration—destruction of an information system storage device by burning, rendering the device sanitized information system (IS) storage devices—physical storage devices used by an IS upon which data is recorded recycling—end state for information system storage devices processed in such a way as to make them ready for reuse, to adapt them to a new use, or to reclaim constituent materials of value routine sanitization—regular course or procedure for sanitization of storage devices sanitization—Sanitization is the removal of information from the storage device so that data recovery using any known technique or analysis is prevented. Sanitization includes the removal of data from the storage device, as well as the removal of all labels, markings, and activity logs.

The method of sanitization varies depending upon the storage device in question and may include degaussing, incineration, shredding, grinding, or embossing.

(Source: NSA/CSS Policy Glossary)

DOCUMENT HISTORY

Date Approved by Description

4 December 2020 Anne Neuberger, Director, Cybersecurity

Policy reissuance; supersedes NSA/CSS

Policy 9-12, dated 30 October 2020 https://siteworks.web.nsa.ic.gov/p12/s/#Sanitization9-12M