What it means
Secure erase and cryptographic erasure make stored information infeasible to recover by applying media-appropriate clearing, purging, destruction, or controlled destruction of encryption keys.
Why it matters
Deletion and formatting usually remove references rather than data; sanitization must match the storage technology and the consequence of future recovery.
Practical focus
- Define the media types, data sensitivity, reuse plans, and assurance level for sanitization and the security outcome it must support
- Apply approved sanitization methods, chain of custody, key destruction, and verification records through documented, reviewable configuration
- Verify device capabilities, method completion, exceptions, and disposal evidence after changes and on a scheduled basis
- Plan for a failed device, remapped storage area, or retained key leaving data recoverable, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a failed device, remapped storage area, or retained key leaving data recoverable as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: