Disposal: sanitization, destruction, certification, retention

3.6 Asset management

📘CompTIA Security+ (SY0-701)

---

Disposal is the final step in managing IT assets. Once a device, storage media, or system is no longer needed, you can’t just throw it away. Sensitive information might still be on it, so proper disposal is critical to protect data and comply with laws or policies.

Disposal has four main parts:

1. Sanitization

• What it is: Making sure all data on a device is completely erased so it can’t be recovered.
• How it’s done in IT:
  • Software wiping: Using specialized programs to overwrite all data on hard drives or SSDs.
  • Cryptographic erasure: If the data was encrypted, destroying the encryption keys effectively makes the data unreadable.
• Why it matters: Even if you delete files normally, they can often be recovered. Sanitization ensures your sensitive company or client data is safe.

2. Destruction

• What it is: Physically destroying a device or storage media so it can’t be used again.
• How it’s done in IT:
  • Shredding hard drives or CDs: Breaking the storage into pieces.
  • Degaussing: Using strong magnets to erase magnetic storage media.
  • Incineration: Burning media that contains sensitive data.
• Why it matters: Some devices may contain highly sensitive information. Physical destruction is a last-resort method when data is extremely critical.

3. Certification

• What it is: Proof that data was properly disposed of.
• How it’s done in IT:
  • Companies may provide a certificate of destruction when they handle disposal.
  • Internal teams might log when and how devices were sanitized or destroyed.
• Why it matters: This is important for compliance with regulations (like GDPR, HIPAA, etc.) and proves that your organization followed proper security procedures.

4. Retention

• What it is: Keeping data or devices for a required period before disposal.
• How it’s done in IT:
  • Certain records may need to be retained for legal, financial, or operational reasons.
  • After the retention period, proper disposal (sanitization or destruction) is done.
• Why it matters: Ensures your organization follows laws and policies without risking premature disposal.

---

Key Exam Points to Remember

1. Sanitization = wiping data safely.
2. Destruction = physically destroying devices.
3. Certification = proof of proper disposal.
4. Retention = keeping data/devices for a required time before disposal.

💡 Tip for remembering: Think “SDCR” – Sanitize, Destroy, Certify, Retain. This acronym often appears in exam questions.

---

IT Example Scenario

• A company retires old servers:
  1. They sanitize the drives with wiping software.
  2. Any highly sensitive drives are destroyed using shredders or degaussing.
  3. They get a certificate from the disposal vendor.
  4. They ensure retention rules are followed for financial records before destruction.

This shows how all four steps work together in a real IT environment.

---