Media Protection

Sanitize or destroy information system media before disposal or release for reuse as per APM 30.16 Section D-8.

1. Any media must be sanitized prior to reuse or destroyed prior to disposal using an approved method.

   适用于:低/中/高风险数据.

   1. Hard Drives
      1. 如果设备不能重复使用, the device must be destroyed via OIT drive crusher.
      2. Overwrite the data on the drive with a minimum of one pass of all zeros or per NIST 800-88.
      3. 如果支持，请使用ATA消毒设备特性集命令之一.
      4. 如果支持，使用ATA安全特性集的“SECURE ERASE UNIT”命令
   2. 固态硬盘(ssd)
      1. 如果设备不能重复使用, 这个装置必须通过Shred销毁, Disintegrate, Pulverize or Incinerate by burning the device in a licensed incinerator as per NIST SP 800-88.
      2. 如果支持，使用ATA安全特性集的“Security ERASE UNIT”命令.
      3. Use the ATA Sanitize command, if supported (block erase, cryptographic erase).
         1. 高风险和受监管数据必须使用FIPS 140验证的加密模块.
      4. 对于NVMe ssd，如果支持，请使用NVM Express Format命令.
      5. ActiveKill软件已被批准用于磁盘擦除.
      6. Cryptographic Erase by issuing commands as necessary to cause all MEKs to be changed.
   3. Removable Media
      1. 如果设备不能重复使用, 这个装置必须通过Shred销毁, Disintegrate, Pulverize or Incinerate by burning the device in a licensed incinerator as per NIST SP 800-88.
      2. 用两次遍历覆盖驱动器上的数据. (仅限非固态介质)
         1. The first pass should use a fixed value, and it's complemented for the second pass.
      3. Cryptographic Erase by issuing commands as necessary to cause all MEKs to be changed.
         1. 高风险和受监管数据必须使用FIPS 140验证的加密模块.
   4. Optical Media
      1. 设备必须用碎纸机粉碎, 或通过NIST SP 800-88批准的销毁服务.
   5. Mobile devices
      1. 如果设备不能重复使用, 不支持加密或没有出厂擦除/擦除功能, 这个装置必须通过Shred销毁, Disintegrate, Pulverize or Incinerate by burning the device in a licensed incinerator as per NIST SP 800-88.
      2. Manufacturer method of media sanitization such as but not limited to factory reset or erase data function.
         1. 设备在消毒前必须加密.
      3. For unmanaged personal devices Microsoft app protection is considered sufficient.
         1. 如果在个人设备上使用非托管应用程序处理U / I数据, 根据APM 20，数据或设备可能会被大学擦除.13.

1. An appropriate attestation of either disposal or sanitization must be provided and updated within the IT asset management system.

   适用于:低/中/高风险数据.

2. Certificate of destruction from an authorized application or vendor such as but not limited to the Activekill Erase certificate or Iron Mountain certificate of destruction.
3. Verification from OIT personnel of successful destruction via the drive crusher within a ticket associated with asset.
4. Verification from OIT personnel of successful completion for mobile device sanitization.

To ensure data is protected while stored on systems the following standards must be met:

1. Workstations and laptops will be encrypted by default using Bitlocker for Windows and Filevault on MacOS.
   1. Workstations and laptops explicitly categorized for only low-risk data may be exempted without a formal risk exception.
   2. Encryption will be AES-256 or stronger unless otherwise approved by OIT Security.
2. University data on mobile devices must use apps that are encrypted via the OIT Managed Microsoft Application Protection Policy.
3. High-risk applications require that a system is encrypted prior to access, including mobile devices.
4. High-risk data must be encrypted using OIT-managed encryption when stored media including but not limited to:
   1. 系统驱动器，如硬盘和固态驱动器.
   2. 可移动媒体，如usb驱动器或外部驱动器.
5. Systems that are housed within approved university data centers are exempt from this encryption requirement.

To ensure the confidentiality of data across networks the following standards must be met:

1. 需要对中高风险应用数据进行加密.
   1. Authentication Secrets such as passwords, API keys or PSKs, are considered high-risk.
2. 受监管的数据必须满足监管的加密要求.

Personal devices or devices otherwise not managed or approved by OIT must not be used to access, store, 传输或处理高风险数据.

Backups containing moderate- and high-risk data must be protected by current encryption standards or other approved safeguards.

To ensure data is handled appropriately data and assets containing data must be marked appropriately.

1. 受监管的数据，如CUI，也必须按照规定进行标记.

   适用于:中等/高