PAM 25-2-8 — Cybersecurity: Sanitization Of Media
PAM 25-2-8 governs the disposition and sanitization of IT equipment containing electronic storage media before reuse or removal.
- Publication number: PAM 25-2-8
- Title: CYBERSECURITY: SANITIZATION OF MEDIA
- Date: 04/10/2019
- Proponent: G-6
- Status: ACTIVE
View PAM 25-2-8 on armypubs.army.mil
Related publications
It covers sanitization decisions, storage media procedures, self-encrypting drives, leased and loaned equipment, degaussing, physical destruction, and final disposition. It requires complete sanitization, documented certification, training for personnel, and site- and system-specific procedures.
Topics covered
- Media sanitization
- Sanitization decision process
- Self-encrypting drives
- Leased and loaned equipment
- Degaussing
- Physical destruction
- Certification of sanitization
- Site- and system-specific procedures
Questions and answers
When must Army media be sanitized?
The procedures in this chapter establish the requirement to sanitize all media prior to disposal, release out of organizational control, or release for reuse in accordance with Department of Defense Manual (DODM) 5200.01 Vol. 1 4 using techniques and procedures in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800 88 (the full citation for this publication is in appendix A of this DA Pam. (paragraph 4)
Does partial wiping or clearing meet Army security standards?
Partial wiping or clearing of media does not meet Army or DOD security standards. (paragraph 4)
What must Army personnel do before eliminating data?
Army personnel must ensure compliance with Army records-retention policies before data is eliminated, since purging data without authority is a violation of U.S. law and Army policy. (paragraph 1)
How must solid state memory components be handled before disposal or release?
Solid state memory components will be sanitized before disposal or release. (paragraph 1)
What documentation is required for sanitization procedures?
Army Components must maintain documentation of all sanitization procedures, using DA Form 7770 (Certificate of Sanitization). (paragraph 1)