[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fmp-6":3},{"item":4,"lessons":18,"controls":60,"related":88},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","mp-6","MP-6","Media Sanitization",10,"US National Institute of Standards and Technology (NIST)","**What it asks for.** System media must be sanitised before disposal, release from organisational control or reuse, using techniques and procedures appropriate to the information's security category.\n\n**In practice.** Doing this well means a sanitisation standard aligned with NIST SP 800-88, using secure erase, cryptographic erase or physical destruction depending on media type and sensitivity, and certified disposal providers. Auditors expect the standard, sanitisation or destruction certificates and asset records showing each device's disposal. Cloud and virtual storage depend on provider assurances and cryptographic erase, which should be documented.\n\n**Common gaps.** Devices returned at end of lease or sent for repair are often not sanitised. Disposal certificates are frequently not matched against the asset inventory, so missing devices go unnoticed. Multifunction printers and network devices with internal storage are often forgotten.","a. Sanitize [Assignment: organization-defined organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined organization-defined sanitization techniques and procedures] ; and\n  b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.\nDiscussion: Media sanitization applies to all digital and non-digital system media subject to disposal or reuse, whether or not the media is considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm). The sanitization process removes information from system media such that the information cannot be retrieved or reconstructed. Sanitization techniques—including clearing, purging, cryptographic erase, de-identification of personally identifiable information, and destruction—prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media that contains information deemed to be in the public domain or publicly releasable or information deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media that contains classified information. NARA policies control the sanitization process for controlled unclassified information.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56],{"slug":21,"title":22,"published_at":23},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",{"slug":25,"title":26,"published_at":27},"cjeu-rules-annotation-is-not-erasure-gdpr-applies-to-baptismal-registers","CJEU Rules Annotation Is Not Erasure: GDPR Applies to Baptismal Registers","2026-10-06T16:20:54.673+00:00",{"slug":29,"title":30,"published_at":31},"social-engineering-attack-on-revolut-leads-to-147gb-data-breach-and-3m-ransom-demand","Social Engineering Attack on Revolut Leads to 147GB Data Breach and $3M Ransom Demand","2026-09-17T14:20:22.635+00:00",{"slug":33,"title":34,"published_at":35},"broad-government-subpoena-of-retail-purchase-data-raises-mass-surveillance-concerns","Broad Government Subpoena of Retail Purchase Data Raises Mass Surveillance Concerns","2026-09-04T12:21:17.692+00:00",{"slug":37,"title":38,"published_at":39},"hse-fined-645k-after-physical-breaches-expose-psychiatric-medical-records","HSE Fined €645K After Physical Breaches Expose Psychiatric Medical Records","2026-09-03T10:21:11.155+00:00",{"slug":41,"title":42,"published_at":43},"5320-gdpr-fine-for-unsecured-discarded-employee-documents-in-slovenia","€5,320 GDPR Fine for Unsecured Discarded Employee Documents in Slovenia","2026-09-01T14:20:41.516+00:00",{"slug":45,"title":46,"published_at":47},"shinyhunters-leaks-129m-carhartt-records-after-ransom-refusal","ShinyHunters Leaks 12.9M Carhartt Records After Ransom Refusal","2026-08-27T12:21:03.346+00:00",{"slug":49,"title":50,"published_at":51},"piaggio-fined-460k-for-unlawful-employee-email-monitoring-and-delayed-account-deactivation","Piaggio Fined €460K for Unlawful Employee Email Monitoring and Delayed Account Deactivation","2026-08-06T10:20:40.321+00:00",{"slug":53,"title":54,"published_at":55},"ios-notification-logging-flaw-exposed-deleted-signal-messages-to-forensic-recovery","iOS Notification Logging Flaw Exposed Deleted Signal Messages to Forensic Recovery","2026-04-23T11:09:41.142+00:00",{"slug":57,"title":58,"published_at":59},"defunct-gaming-forum-exposes-105m-user-records-in-data-breach","Defunct Gaming Forum Exposes 10.5M User Records in Data Breach","2026-03-31T20:07:59.44+00:00",[61,66,71,75,80,84],{"slug":62,"name":63,"problem":64,"stories":65},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",5,{"slug":67,"name":68,"problem":69,"stories":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":72,"name":73,"problem":74,"stories":70},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":76,"name":77,"problem":78,"stories":79},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":81,"name":82,"problem":83,"stories":79},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":85,"name":86,"problem":87,"stories":79},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[89,94,100,104,109,114,118,122],{"family":90,"item":91,"code":92,"title":93,"together":9},"cis","3","Control 3","Data Protection",{"family":95,"item":96,"code":97,"title":98,"together":99},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",8,{"family":95,"item":101,"code":102,"title":103,"together":65},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":95,"item":105,"code":106,"title":107,"together":108},"32","Article 32","Security of processing",4,{"family":110,"item":111,"code":112,"title":112,"together":113},"itil","overview","ITIL",3,{"family":95,"item":115,"code":116,"title":117,"together":113},"17","Article 17","Right to erasure ('right to be forgotten')",{"family":95,"item":119,"code":120,"title":121,"together":113},"25","Article 25","Data protection by design and by default",{"family":5,"item":123,"code":124,"title":125,"together":113},"ac-2","AC-2","Account Management"]