proc9000-1391-SOP.doc

PRIVATE

SBA Procedural Notice

TO:

All SBA Employees and Contractors CONTROL NO.: 9000-1391 SUBJECT: Storage Media Handling and Disposal EFFECTIVE: 11/26/2002

This is a reminder to all employees and contractors that when storage media are disposed of, it is important to ensure that information is not improperly disclosed. This applies both to media that are external to a computer system (such as a diskette or backup tape) and to media inside a computer system, such as a hard disk. The process of removing information is called sanitation.

The Office of the Chief Information Officer recommends using the three most commonly used techniques for sanitizing storage media:

1. Overwriting – as the name implies, overwriting uses a program to write meaningless information on the media. Common practice is to overwrite the media three times. Overwriting should not be confused with merely deleting a pointer to a file (which typically happens when a delete command is used). Overwriting requires that the media be in working order. SBA has a license for a program called “Kill Disk” that will overwrite diskettes and hard-drives. IRMs and OCIO personnel have access to the “Kill Disk” software and can overwrite diskettes and hard-drives.

2. Degaussing - is a method to magnetically erase data from magnetic media. Two types of degaussing exist: strong permanent magnets and electric degaussing. SBA is currently looking into the purchase of a Degausser to erase data on non-working media.

3. Destruction – the media may be destroyed by shredding, burning or crushing. The preferred method for destruction of backup tapes is to cut the tape into pieces.

If you require additional information, please contact Lewis Baskerville at (202) 401-1980 or Joyce Lewis at (202) 205-6318.

Lawrence E. Barrett

Chief Information Officer

EXPIRES: 11/1/2003

SBA Form 1353.3 (12-93) PerForm Version; previous editions obsolete

Must be accompanied by SBA Form 58