NEWARK, DE — Media Duplication Systems, a Delaware supplier of data sanitization equipment, has issued new purchasing guidance for government and defense organizations after updated federal standards warned that some existing degaussers may be unable to erase data from newer magnetic storage devices, creating security risks even when the equipment renders drives unusable.
The guidance, published last week, addresses changes outlined in National Institute of Standards and Technology Special Publication 800-88 Revision 2, which identifies limitations in using magnetic degaussing equipment to sanitize higher-coercivity storage media.
The revised NIST guidance distinguishes between rendering a storage device inoperable and successfully sanitizing the information it contains.
That distinction has implications for federal agencies, defense contractors and information technology asset disposition companies responsible for removing sensitive information from retired storage equipment.
According to NIST, advances in magnetic recording technology have increased the difficulty of reliably degaussing certain storage devices. Some existing machines may lack sufficient magnetic force to sanitize newer media.
A degausser can consequently damage a drive enough to prevent normal operation without eliminating the underlying data.
Media Duplication Systems, which has supplied degaussing, drive-erasure and destruction equipment since 1992, is advising buyers to evaluate three separate requirements when selecting equipment: technical compatibility with the storage media, National Security Agency evaluation status and federal procurement eligibility.
The company emphasizes that meeting one requirement does not establish compliance with the others.
Under NIST SP 800-88 Revision 2, properly matched degaussing qualifies as a purge sanitization technique for magnetic media.
The standard does not classify degaussing as an approved destroy sanitization technique, making physical destruction a separate consideration when applicable requirements call for storage media to be destroyed.
NIST also directs organizations to IEEE 2883 and relevant National Security Agency and Central Security Service requirements for additional technical guidance.
The distinction affects organizations managing different categories of retired information technology assets, particularly when some devices must be destroyed while others are intended for resale or redeployment.
“Government and ITAD customers can be dealing with several different outcomes in the same project,” Michelle Boyce, vice president of marketing at Media Duplication Systems, stated.
“They may need a degausser for magnetic media, a shredder for drives that have to be destroyed and a wiping system for assets they plan to resell or redeploy.”
The NSA/CSS maintains an Evaluated Products List identifying magnetic degaussers that have satisfied its requirements for specified storage media.
However, evaluated status applies to individual equipment models rather than entire manufacturers or product lines.
A degausser appearing on the list is not necessarily suitable for every magnetic storage device. Its evaluated capabilities and operating requirements must correspond to the media being processed.
For classified hard disk drives subject to applicable NSA/CSS requirements, the agency’s sanitization guidance provides for degaussing with evaluated equipment and highly recommends physically deforming the platters afterward.
Federal purchasing requirements introduce another distinction.
Equipment purchased through acquisitions subject to the Trade Agreements Act must satisfy applicable procurement provisions, including requirements governing eligible U.S.-made or designated-country end products.
Federal Acquisition Regulation 52.225-5 establishes relevant trade agreement requirements for covered purchases, subject to applicable terms and exceptions.
A degausser may meet technical sanitization requirements while failing to qualify for a particular federal acquisition because of its procurement eligibility.
Conversely, equipment that satisfies Trade Agreements Act requirements does not automatically qualify as NSA/CSS-evaluated or demonstrate sufficient magnetic force for the intended storage media.
The company’s guidance treats those determinations independently, requiring buyers to examine the equipment’s technical specifications, evaluated status and procurement eligibility.
The issue is particularly relevant when organizations continue using older degaussers on storage devices developed after the equipment was originally purchased.
A drive that fails to power on after degaussing cannot be presumed to have undergone successful data sanitization solely because it is no longer operational.
For agencies and contractors handling sensitive information, the updated standards place greater importance on matching sanitization equipment to the specific storage technology and applicable security requirements.
Media Duplication Systems is based in Newark, Delaware, and supplies degaussing, drive-erasure and physical destruction equipment to organizations managing data-bearing assets.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.