PAM 25-2-3 — Reuse Of Army Computer Hard Disk Drives
PAM 25-2-3 governs Army procedures for purging, clearing, sanitizing, reusing, degaussing, and disposing of hard disk drives.
- Publication number: PAM 25-2-3
- Title: REUSE OF ARMY COMPUTER HARD DISK DRIVES
- Date: 04/08/2019
- Proponent: G-6
- Status: ACTIVE
View PAM 25-2-3 on armypubs.army.mil
Related publications
PAM 25-2-3 covers HDD sanitization decisions, overwriting, degaussing, physical destruction, loaned equipment, certification, disposition, and training. It requires documentation, verification, approved methods, and trained personnel for applicable sanitization and destruction procedures.
Applies to: The scope of this guidance includes (1) HDDs owned by Army organizations (to include media used in tactical systems). (2) HDDs on loan to the Army for test or evaluation purposes.
Topics covered
- Hard disk drive sanitization
- Purging and clearing
- Self-encrypting drives
- Degaussing
- Physical destruction
- Loaned equipment
- Sanitization certification
- Purging checklist
Questions and answers
What must be determined before an HDD is sanitized for reuse?
The first action is to determine the access sensitivity or security category of the data on the HDD to determine whether the device can be sanitized for reuse and, if the device can be sanitized for reuse, what method is required to perform the procedure correctly (see fig 2 1). (paragraph 1)
Is clearing an authorized sanitization method for an HDD?
Clearing is not an authorized method of sanitization for an HDD, but it may be acceptable for reuse in the same environment when the sensitivity level and classification level is the same (for example, when reusing HDDs in a tactical system for a new mission at the same classification level). (paragraph 2-7)
What are the acceptable methods to sanitize and reuse HDDs in the Army?
There are two acceptable methods to sanitize and reuse HDD in the Army: (1) Purging (overwriting). (2) Degaussing (see chap 3). (paragraph 1)
When must an HDD be physically destroyed?
HDDs will be destroyed when they are defective, cannot be economically repaired or purged for reuse, or have outlived their usefulness. (paragraph 3-3)
What is required for self-encrypting drives using cryptographic erase?
Army organizations desiring to use cryptographic erase must meet all the conditions outlined in NIST SP 800 88, Revision 1 and must perform a risk analysis that is approved by the AO of the systems involved before employing it. (paragraph 4-4)