Classifying data
The first step to data destruction is knowing what type of data we are dealing with, before deciding the appropriate sanitization method.
Organizations with limited internal guidelines on data classification can take guidance from a series of publications by the National Institute of Standards and Technology (NIST), a non-regulatory US federal agency within the Department of Commerce. Links to NIST's Computer Security Resource Center:
- FIPS PUB 199: Standards for Security Categorization of Federal Information and Information Systems
- NIST SP 800-60 Volume I Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories
- NIST SP 800-60 Volume II Revision 1: Appendices to the guide above
- NIST SP 800-83 Revision 1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops
For larger IT departments, the full list of guidelines is at csrc.nist.gov/publications/sp800.
Impact levels (extract from NIST SP 800-60 Vol 1, page 10)
Low
Loss of confidentiality, integrity or availability could have a limited adverse effect: a noticeable reduction in effectiveness, minor damage to assets, minor financial loss, or minor harm to individuals.
Moderate
Loss could have a serious adverse effect: significant reduction in effectiveness, significant damage to assets, significant financial loss, or significant harm to individuals not involving loss of life or serious life-threatening injury.
High
Loss could have a severe or catastrophic adverse effect: the organization cannot perform one or more primary functions, major damage to assets, major financial loss, or severe or catastrophic harm to individuals, including loss of life.
Summarized from NIST SP 800-60 Vol 1 Rev 1. Read the full definitions in the publication. Once you know the impact level, see Clear, Purge, Destroy for the matching sanitization method.