FI16782
Request
To avoid any misunderstanding, I would like to clarify the distinction I am drawing. I am not questioning the adequacy of your processes or suggesting anything is being done incorrectly. My enquiry relates solely to the type of recorded assurance held by your organisation.
A certificate or record confirming that an erasure process was applied demonstrates that a recognised method was used. What I am seeking to understand is whether your organisation holds any recorded evidence of the outcome, namely evidence that the data on a specific storage device is irrecoverable following erasure, rather than confirmation that the erasure process was executed.
In your response you indicated that the Council holds a certificate of destruction issued by a third party provider for devices processed during disposal.
With that distinction in mind, please confirm:
1. Do the certificates referred to in your response constitute an explicit outcome based warranty or guarantee that the personal data on each specific storage device has been rendered irrecoverable as a final data state, or do they primarily confirm that a certified erasure or destruction process was followed?
2. Beyond reliance on supplier certification, recognised security standards, or confirmation that an erasure or destruction process was completed, does the organisation hold any recorded, device specific documentation evidencing independent verification, testing, or validation that the data on the particular storage media processed has been rendered irrecoverable in practice?
For clarity, this request relates specifically to recorded outcome evidence demonstrating irrecoverability of data on the individual storage device, not documentation confirming that an accredited or certified method was applied.
If no explicit outcome based warranty or device specific outcome evidence is held beyond certification, accreditation, or confirmation of process completion, please confirm accordingly.
I am not seeking technical configuration detail, only clarification of the recorded assurance basis relied upon when concluding irrecoverability of the final data state.
Response
- Service provider has previously stated "Data-bearing hardware is wiped to CESG standards using military-grade software, Blancco. Should the HDD fail the wipe at the first time of asking, it is immediately shred onsite down to 25mm."
- Not previously, devices sent for disposal have been fully encrypted with PIN. Laptops now used have a built in secure erase capability which is NIST 800-88R1 compliant and generates a compliant log file per device. This is currently being looked at as a further in house erasure.