Data Sanitization

NAID-certBelow is the process PCs for People uses to sanitize or physically destroy all hard drives that have been requested to receive the NAID certified data sanitization process.

PCs for People Access Employees

At all times during the data sanitization process, a customer's hard drives are under the supervision of an Access Employee. An Access Employee has undergone a criminal background check, drug screening, employment history verification, and an I-9 verification. In addition, they have signed a confidentiality agreement verifying they will protect the confidentiality of all information taken into custody by PCs for People.

Collection and Transport

When PCs for People staff arrive to collect computer equipment at a customer's facility, the customer and PCs for People staff will complete the transfer of ownership form. Once the paperwork has been completed and the customer has indicated the hard drives must be sanitized using the NAID certified process, the computer equipment is loaded into a vehicle for transportation to PCs for People's secure wiping warehouse. All equipment is secured within the vehicle to prevent loss from theft, wind, tipping/spillage, or other atmospheric conditions.

Staging and Hard Drive Removal

Upon arrival at PCs for People's warehouse, computer equipment is unloaded from the vehicle into a secure staging area. Once unloaded, the hard drives are physically removed from the computer cases and placed in a container labeled with the customer's information. When all hard drives have been removed, the container(s) are moved by Access Employees to the secure sanitization area.

Secure Sanitization and Storage Area

All hard drives that enter the secure storage area are physically destroyed or erased by an Access Employee. Only PCs for People Access Employees are allowed to work in this area. The PCs for People facility is monitored at all times by a closed circuit television system capable of recording over 90 consecutive days of video. The facility is also monitored by an alarm system and motion sensors when the building is unoccupied.

Hard Drive Sanitization

During the sanitization process, each hard drive serial number is scanned with a bar code reader and recorded in a spreadsheet. If a hard drive is successfully sanitized, it is labeled indicating 1) all data has been wiped 2) the name of the technician sanitizing the data. If a hard drive fails the sanitization process, it is labeled as defective indicating it will need to be physically destroyed (see Hard Drive Destruction). All hard drives are sanitized by using computer software programs to write 0's across all sectors of the disk.

Quality Control

PCs for People Access Employees ensure drives are being fully sanitized by following a strict quality control process. One device is sampled for quality control per fifty devices and at least one device needs to be sampled for each customer lot number. When a drive is randomly selected for the quality control inspection, it is inspected by a different technician than the one who performed the data wipe.

If data is recovered from the drive, all media from that customer's lot is re-sanitized. After the sanitization process, two devices are sampled for every fifty devices in the customer's lot. If the second sampling reveals another device with retrievable data, PCs for People will re-inspect all the hardware and software used in the data sanitization process. Once all hardware and software are determined to be fully operational, the drives will be wiped and verified for a third time. If data is recovered after the third verification, all drives are destroyed.

After sanitization and quality control, all hard drives are moved from the secure area to the warehouse to be used in PCs for People's computer refurbishing business.

Hard Drive Destruction

dive-destructionIf a hard drive fails to be sanitized by our software process, it is labeled for physical destruction. All media that has failed the sanitization process is physically destroyed within the secure area immediately after it fails the process. All media that is physically destroyed is crushed using a twelve-ton shop press with a metal-spiked ram. Once the media is destroyed, it is removed from the secure area and placed in the recycling.

Receipts

Within ten business days the customer will receive a single PDF file that contains the signed transfer of ownership, certificate of destruction, and data sanitization log. The data sanitization log lists all the hard drive serial numbers and verifies the drives have been sanitized or destroyed.

Affiliations

  • 1
  • 2