Written By Namrata Sengupta
Updated on Mar 11, 2022
Min Reading 3 Min
Jan 17, 2022
This article cites the importance of the certificate of data destruction and lists its key components to help you understand the benefits of this document for meeting compliance with global data protection laws and regulations.
A Certificate of Destruction (CoD) is an audit document affirming that all confidential data stored on hard drives, tapes, SSDs, or other storage media was successfully destroyed. It ensures that the organization or the service provider destroying data is following a reliable data destruction process in compliance with global regulatory laws. CoD guarantees that data was destroyed with due diligence and the data cannot be recovered from the erased / destructed devices even after using an advanced forensic technique.
A Certificate of Data Destruction acts as a pivotal document in lawsuits of data breaches to showcase that data was destroyed using a reliable tool or device from an authorized vendor that provided the CoD. Here are some of the benefits of Certificate of Destruction that are meaningful to an organization:
Ensures 100% Data Protection
A certificate validates that the data stored in the storage devices were effectively destroyed. As a result, there is a zero possibility of data leakage, even in the most critical circumstances.
Helps Maintain Compliance with Legal Requirements
Every industry today is governed by legal requirements for how long data must be in use and maintained, but once the time limit of maintaining data is reached, the data must be securely destroyed. There are different methods of destroying data as explained in our knowledge series. But, as an organization, whether you follow any method of destruction, maintaining a CoD is critical to stay compliant with global data protection laws like EU-GDPR. CoD provides auditable proof of sanitization and promotes trust towards the third-party vendor performing media sanitization on behalf of your organization.
Proof of Destruction
The certificate of destruction serves as the audit trail of the complete data disposal process. The CoD is complete proof that your data has been safely and securely destroyed using the appropriate data destruction technique. CoD helps an organization showcase that it securely destroyed the data in question during any event of a compliance audit or any lawsuit of a data breach.
Peace of Mind
It is not only a document to meet compliance with data privacy laws and other industry regulations, but also gives an organization and their stakeholder's peace of mind, that their data disposal strategy is sound and fail-safe. A certificate of destruction ensures that no data breach incident or lapse has happened as the document ensures complete, secure, and permanent destruction of data.
NIST Mandates Certificate of Destruction in its Guidelines
A certificate of destruction is defined as an auditable document in NIST guidelines for data destruction and assists organizations or IT asset Disposition companies in implementing a secure media sanitization program consistent with the data protection laws. Appendix G of the guidelines mandates organizations to keep the record of destruction and have it readily available on demand for any media destructed.
Sample Certificate of Destruction As Per NIST AppendixG
As per NIST, there are a few things that should exist on a certificate of destruction in some form to verify their authenticity and integrity. Let us look at the key components of a certificate.
The following elements are critical for an auditable certificate:
It is important to ensure that the tool or device that you use to eradicate data provides a certificate of media sanitization with accurate information. We recommend using BitRaser data erasure software as it is tested and approved by NIST and provides all details as required for the CoD.
Certificate of Data Destruction Template
It is extremely critical to select a data destruction solution or service that goes a step beyond. Organizations may alternatively use customized media sanitization reports with their logo and other company details that may also reflect in the certificate. BitRaser cloud console offers advanced search capabilities to retrieve old certificates as and when required.
Being a documented proof of erasure, a CoD ensures that an organization collecting, handling, or processing data acts responsibly by destroying data that is no more required to ensure data privacy and data protection as mandated by global regulatory norms. Hence, organizations must hire service providers or use tools that offer a Certificate of Destruction as proof to permanently destroy the data that is not required further. It is a resilient approach to ensure that devices are no longer exposed to bad actors, thereby mitigating liability risks.
A Certificate of Data Destruction must contain:
BitRaser is NIST Certified
|US Department of Defense, DoD 5220.22-M (3 passes)|
|US Department of Defense, DoD 5200.22-M (ECE) (7 passes)|
|US Department of Defense, DoD 5200.28-STD (7 passes)|
|Russian Standard – GOST-R-50739-95 (2 passes)|
|B.Schneier’s algorithm (7 passes)|
|German Standard VSITR (7 passes)|
|Peter Gutmann (35 passes)|
|US Army AR 380-19 (3 passes)|
|North Atlantic Treaty Organization-NATO Standard (7 passes)|
|US Air Force AFSSI 5020 (3 passes)|
|Pfitzner algorithm (33 passes)|
|Canadian RCMP TSSIT OPS-II (4 passes)|
|British HMG IS5 (3 passes)|
|Pseudo-random & Zeroes (2 passes)|
|Random Random Zero (6 passes)|
|British HMG IS5 Baseline standard|
|NAVSO P-5239-26 (3 passes)|
|NCSG-TG-025 (3 passes)|
|5 Customized Algorithms & more|