Provision 8: Data Destruction

Question 1

Provision 8

Data Destruction

Answer 1

An R2:2013 electronics recycler shall be responsible for data destruction of all media it handles using generally-accepted data destruction procedures.

Question 2

Requirements:
(Section a)
An R2:2013 electronics recycler shall sanitize, purge, or destroy data on hard drives and other data storage devices per (the National Institute of Standards and Technology’s (NIST’s) Guidelines for Media Sanitization – Special Publication 800-8812 lists categories of devices which need sanitization consideration), unless otherwise requested in writing by the customer.

Answer 2

The R2:2013 electronics recycler shall adhere to the data sanitization, purging, or destruction practices
described in the NIST Guidelines for Media Sanitization: Special Publication 800-88 (rev. 1) or another current generally-accepted standard, or be certified by a generally-accepted certification program.

Question 3

(Section b)
An R2:2013 electronics recycler shall document its data destruction procedures and include this
documentation as part of its EHSMS.

Answer 3

(Section c)
Employees involved in data destruction shall receive appropriate training on a regular basis and
be evaluated for competency in data destruction processing.

Question 4

(Section d)
Data destruction processes shall be reviewed and validated by an independent party on a periodic
basis as defined in the documentation called for in Section (b).

Answer 4

(Section e)
Quality controls shall be documented, implemented, and monitored internally to ensure effectiveness of data sanitization, purging, and destruction techniques.

Question 5

(Section f)
Security controls that are appropriate to the most sensitive classification of media accepted at the
facility shall be documented, implemented and maintained. Security controls shall consider
physical security, monitoring, chain-of-custody, and personnel qualifications.

Answer 5

(Section g)
Adequate records of data destruction shall be maintained by the R2:2013 electronics recycler and
each downstream vendor conducting data destruction.

Question 6

(Section h)

If data destruction is handled by a downstream vendor:

Answer 6

(Subsection 1)
The R2:2013 electronics recycler shall maintain responsibility for data destruction and ensure
appropriate security, controls, and processing techniques continue to conform to Provision 8
through audits or other similarly effective means.

Question 7

(Subsection 2)

Media or devices containing media with data must be tracked and secured during transportation, storage, and processing.

Answer 7

(Subsection 3)

Each downstream vendor must adhere to the requirements of Provision 8.