|
R2:2013 Preview: Data Destruction Changes
To prepare for the coming transition to R2:2013, we are covering new requirements under consideration. The R2:2013 Standard is currently a DRAFT. Public comments have been received and the R2 TAC is finalizing the R2:2013 Standard.
One of the many changes proposed in the draft R2:2013 standard is a strengthening of the data destruction requirements in Provision 8. Data destruction continues to leverage existing standards specific to data destruction. However, the updated Provision 8 also explicitly pulls out common requirements embedded in standards such as NIST SP 800-88, ADISA, and NAID.
First, 8(e) will require quality controls to ensure effectiveness of data sanitization, purging, or destruction techniques. Verification is important to ensure that the data destruction technique works within the organization. Second, 8(f) requires that an R2 certified recycler implement security controls to protect devices containing data prior to sanitization or destruction. The level of security is relative to the level of classification of data handled by the R2-certified organization.
Also proposed to be included in 8(g) is a specific requirement for maintaining records of data destruction. This was previously covered within the referenced data destruction standards like NIST 800-88. This new provision 8(g) clarifies any misconception about the need to maintain records to prove data destruction of media.
Finally, often all or parts of the data destruction processes are outsourced to other vendors. For example, cell phones may be sent to a cell phone refurbisher who maintains the expertise and equipment to adequately sanitize phones of data. Devices or drives which cannot be accessed or fall below minimum technical thresholds may be sent for shredding or smelting by a downstream vendor. These situations are common to the recycling chain and must consider the data that may still be resident on these media when sent to another vendor.
In order to strengthen and clarify the data destruction requirements in outsourcing, Provision 8(d) is proposed as part of the draft R2:2013 Standard. This requirement assigns responsibility to the R2 recycler to ensure data destruction by a third-party downstream vendor adheres to the requirements of R2:2013. Furthermore, it requires tracking and security controls of the media containing data during transportation to these vendors.
These changes to the R2 Standard in Provision 8 are not entirely new. If implemented correctly, these should have been implemented through current requirements in NIST 800-88 or other generally-accepted data security standards incorporated by provision 8(a). These are primary best practices of any organization handling media containing user data. The recommended changes seek to strengthen and clarify data destruction requirements to ensure consistency and conformity by all R2-certified organizations.
| 
