Tag: nsa

What CIOs Need to Know About High Security Data Destruction

September 15, 2025 at 8:00 am by Amanda Canale

Chief Information Officers (CIOs) play a critical role in overseeing the full lifecycle of data—from its creation and use to its secure destruction once it reaches end of life. While the vast majority of organizations invest heavily in data storage, cybersecurity, and backup protocols, many overlook the importance of a robust and compliant data destruction strategy.

For C-suite leaders, particularly CIOs responsible for enterprise information security, understanding high security data destruction is not just a matter of best practice, but a mission-critical priority tied to regulatory compliance, operational integrity, and reputational protection.

Critical Shreds

  • Secure data disposal must be integrated into the organization’s core data security strategy to prevent post-use breaches and reputational harm.
  • Compliance frameworks like GDPR and HIPAA require detailed records of how and when data is destroyed, including who performed the task.
  • Digital wiping is simply not enough. Hard drives, SSDs, and other media must be physically destroyed using NSA-approved methods to ensure it is irrecoverable.
  • Destruction technologies should evolve with storage trends while aligning with sustainability and environmental responsibility goals.

The Strategic Imperative of Data Destruction

High security data destruction is far more than simply erasing files or decommissioning hardware. It is a comprehensive, policy-driven approach to ensuring that sensitive data—whether digital or physical—is rendered completely unrecoverable. With increasing regulatory oversight, evolving cyber threats, and growing volumes of data stored across physical devices, cloud environments, and hybrid networks, it is crucial that CIOs treat end-of-life data destruction as an integral part of their organization’s data security strategy.

More than ever, data destruction must be viewed through a strategic lens. CIOs are charged not only with protecting data while it is in use but also ensuring that data cannot be compromised after it has served its purpose. This includes everything from shredded paper records to degaussed, classified hard drives to end-of-life SSDs that require physical destruction with NSA-evaluated equipment. Failing to address this last phase of the data lifecycle leaves organizations vulnerable to data breaches, fines, and long-term brand damage.

Chief Information Security Officer presenting data

Understanding Compliance in the Age of Data Regulation

High-security data destruction is inseparable from regulatory compliance. Laws such as the GDPR and HIPAA—as well as guidelines from NIST, the Department of Defense (DoD), and the NSA—require strict oversight of how data is disposed.

To remain compliant, organizations must go beyond simply destroying data; they must maintain verifiable records detailing how, when, and by whom the destruction occurred. This is especially critical in regulated sectors like healthcare, finance, and defense, where thorough documentation and a clear chain of custody are essential.

It’s up to CIOs to ensure that destruction methods align with their organization’s risk profile, data classification, and regulatory exposure. Even more important to note is that in-house solutions are preferable, offering greater control and traceability while supporting long-term compliance when it comes to audits.

The Physical Dimension of Digital Security

While cloud security and firewalls dominate the cybersecurity conversation, CIOs cannot afford to neglect the physical destruction of data-bearing devices. Data stored on hard drives, SSDs, optical media, and even flash-based storage is often far more persistent than assumed. Standard wipe techniques may leave residual data intact—particularly on SSDs—posing a serious threat if those devices are lost, sold, or recycled without proper destruction.

High security destruction methods, such as NSA-listed degaussers, disintegrators, crushers, and shredders, are specifically engineered to irreversibly destroy media to a point where data recovery is impossible. For organizations handling classified, proprietary, or regulated data, these solutions are not optional, but rather they are essential components of a secure IT infrastructure.

CIOs must lead the charge in implementing enterprise-wide policies that mandate secure media destruction. This includes not only establishing chain-of-custody procedures, but also securing access to destruction equipment, and maintaining logs and certifications for all destroyed assets. By institutionalizing these protocols, CIOs help reduce the risk of attacks and close the gap between cybersecurity and data lifecycle management.

blue and purple data center with running binary code

Managing Risk with Proactive Governance

Data destruction is not a one-time event; it’s a discipline that must be embedded into the organization’s risk management framework. CIOs must collaborate with Chief Information Security Officers (CISOs), legal counsel, and even compliance officers to develop and enforce governance frameworks that account for the secure disposition of all data assets. This includes cloud and hybrid environments where data may be dispersed across multiple geographies and vendors.

The financial and reputational costs of improper data disposal can also be quite severe. Breaches resulting from discarded or resold devices, inadvertent disclosures of sensitive information, or failure to meet data retention schedules are increasingly common—and costly. In contrast, proactive data destruction policies significantly reduce the risk of exposure, bolster compliance, and demonstrate a strong commitment to data stewardship to regulators, customers, and stakeholders.

Future-Proofing the Enterprise

As storage technologies evolve, so must destruction methods. CIOs need to stay informed about advancements in data storage. Destruction solutions must be able to keep pace with these innovations to ensure future-proof security. Investing in modular or scalable equipment designed to meet NSA and international destruction standards helps enterprises maintain compliance over time and avoid costly retrofits or replacements.

Furthermore, the growing focus on sustainability and environmental responsibility means that data destruction practices must also align with environmental goals. Solutions that offer clean, energy-efficient destruction or support e-waste recycling without compromising security will continue to gain relevance for CIOs tasked with balancing security, compliance, and corporate responsibility.

Conclusion

For the modern CIO, high security data destruction is no longer a technical afterthought—it’s a strategic imperative. As stewards of enterprise data, CIOs must ensure that destruction policies are compliant, auditable, and aligned with organizational risk. By embracing a comprehensive, forward-looking approach to secure data disposal, CIOs can close critical security gaps, support compliance mandates, and help future-proof their organizations in an increasingly complex data environment.

 

Cyber Operational Readiness Assessment (CORA): A Strategic Imperative for Federal Security

July 21, 2025 at 8:00 am by Amanda Canale

In March 2024, the Department of Defense’s cyber operations wing, Joint Force Headquarters–Department of Defense Information Network (JFHQ-DODIN), rolled out the Cyber Operational Readiness Assessment (CORA) program. The new initiative will be responsible for introducing a new era of cyber evaluation and replacing the long-standing Command Cyber Readiness Inspection (CCRI).

Unlike its predecessor, CORA isn’t about checking compliance boxes. Instead, it’s a forward-leaning, mission-driven approach to cybersecurity, fundamentally shifting how the defense ecosystem protects its most critical digital assets.

Critical Shreds

  • The new initiative marks a pivotal shift from compliance‑based cybersecurity to mission‑focused operational readiness.
  • The program emphasizes on MITRE ATT&CK–informed risk indicators, enabling targeted mitigation of cyberattack methods.
  • It is adaptive with assessments updating in real time based on threat intelligence and policy changes.
  • CORA strengthens perimeters and high‑priority systems, aligning limited resources with maximum impact.

A Mission-First Mindset

For over a decade, the CCRI served as the standard for evaluating cybersecurity posture within the DoD. These inspections provided a scorecard of sorts on compliance with security policies and technical controls. However, the approach had clear limitations. It focused heavily on documentation and the consistent enforcement of policies across the board, often without fully addressing the real-world risks posed by evolving cyber threats.

As threat actors continued to grow more sophisticated by using stealthy tactics to exploit misconfigurations and human error, DoD leadership recognized the critical need for a new model. Enter CORA: an agile, intelligence-led framework designed to better reflect real-world risk environments. The program would redefine cybersecurity assurance by focusing on mission assurance, strengthening the DoD’s cybersecurity systems and strategies that matter most when security is on the line.

Air Force Lt. Gen. Robert Skinner, the commander of the JFHQ-DODIN, describes the program’s goal as providing commanders and directors with, “a more precise understanding of high-priority cyber terrain.” In practice, this means key stakeholders can gain a clearer view of critical cyber assets, enabling a more effective and targeted defense strategy that better supports essential operations and empowers improved control and decision-making.

American flag made up of binary code

What Makes CORA Different?

CORA shifts the focus from “Are we compliant?” to “Are we ready?” It’s a readiness assessment, not an audit. This means that evaluations are tailored to the mission of each organization and to the actual threats they face, not just whether they’ve completed policy checklists.

Central to this shift is the use of Key Indicators of Risk (KIORs). These indicators are developed using the MITRE ATT&CK framework, which catalogs common tactics, techniques, and procedures (TTPs) used by threat actors in the wild. By mapping a system’s vulnerabilities and configurations against these known methods, CORA assessments prioritize the risks that could impact operational success the most.

A Continuous and Adaptive Process

One of the most significant benefits CORA brings to the table is adaptability. Unlike the rigid evaluations and cycles of CCRI, CORA is a continuous assessment model that evolves in real time. Its structure allows JFHQ-DODIN to adjust the scope of assessments based on new policy directives, threat intelligence, or known vulnerabilities across the Department of Defense Information Network (DODIN).

For example, if a new threat actor is observed targeting edge devices like routers or firewalls, CORA assessments can pivot quickly to evaluate exposure in those areas. This makes the program not just a snapshot in time, but a living strategy that mirrors the dynamic nature of cyber warfare.

Enhanced Boundary Control

Another hallmark of CORA is its emphasis on boundary defense. Boundary systems—such as firewalls, VPN concentrators, and routers—serve as the entry points into a network, forming the barrier between internal DoD systems and the public internet. They are often the first line of defense and, unfortunately, a frequent target for attacks.

The CORA framework places elevated priority on these devices because of their role in protecting mission-critical environments. Misconfigured boundary systems can be exploited for initial access, lateral movement, or data theft. To mitigate these malicious attempts, CORA encourages rigorous, up-to-date configuration management and auditing of these access points.

Military personnel in data center

Real-World Application

CORA’s debut reflects a much broader move towards aligning cyber defense with military command intent. As noted earlier by Lt. Gen. Robert Skinner, the program was designed to give commanders and directors better control over their most critical terrain in cyberspace. Instead of treating all systems equally, CORA distinguishes between those that are peripheral and those that are vital to a mission’s success.

A key element of the rollout is collaboration. CORA assessments involve not only cyber specialists but also leadership across the operational chain, ensuring that recommendations align with the specific needs and realities of the mission at hand.

What This Means for the Broader Security Community

For federal agencies, defense contractors, and companies working with classified data or within the Defense Industrial Base (DIB), CORA signals a cultural shift in cybersecurity expectations. While not every entity will undergo a CORA directly, its principles are likely to filter down through requirements, standards, and best practices, especially for organizations managing Controlled Unclassified Information (CUI).

What commanders and directors can expect is more of an emphasis on active risk identification, real-world threat modeling, boundary hardening, and evidence-based security configurations. Compliance will always remain important, but it will no longer be enough on its own.

Conclusion

The launch of CORA is not just about replacing a program; it’s about reshaping how the defense community understands and practices cybersecurity. In an environment defined by constantly evolving threats, the static, audit-centric model of CCRI simply couldn’t keep up.

CORA represents the future: continuous, adaptive, and mission-focused. It recognizes that true security isn’t about passing inspections, but rather about staying ready when it matters most.

For those in the security industry, from government to private sector, CORA offers a powerful new lens for understanding what it means to be cyber-ready. And as cyber becomes increasingly embedded in every aspect of national defense, readiness is no longer optional; it’s operational.

SEM Introduces New 2mm Optical Media Shredder

June 18, 2024 at 8:00 am by Amanda Canale

Security Engineered Machinery Co., Inc. (SEM), global leader in classified and high security data destruction, is pleased to announce that its new Model OMD2X2 Optical Shredder has been evaluated by NSA/CSS and meets the requirements of NSA/CSS Specifications for Optical Destruction Devices following the NSA/CSS 9-12 Device Declassification Policy Manual. 

This cutting-edge device was specially designed and evaluated for the destruction of classified compact discs (CDs), digital versatile discs (DVDs), and Blu-ray discs (BDs). This cutting-edge device is now listed on the NSA/CSS EPL for Optical Destruction Devices and was specially designed for the destruction of classified compact discs (CDs), digital versatile discs (DVDs), and Blu-ray discs (BDs).

The Model OMD2X2 was designed for maximum efficiency and ease of use while destroying CDs, DVDs, and BDs alike down to a consistent 2mm x 2mm final particle size, regardless of the disk type, ensuring SEM would be able to provide an optical solution for the federal government. The device can shred at high volumes of hundreds of discs per hour.

“The creation of the Model OMD2X2 is a testament to SEM’s long-term commitment to innovation and security when it comes to data destruction solutions,” says Andrew Kelleher, SEM President. “With the ability to shred optical media to a final particle that meets the NSA requirements for optical destruction, we are providing our customers with the peace of mind that their data is secure beyond the latest mandate.” 

The Model OMD2X2 is an ideal solution for government agencies and entities and any organization requiring high security data destruction. Equipped with an auto-oiler and a large internal waste collection bin, the device prevents users from needing to routinely oil the machine manually, and allows for more shredding before changing bags, making the Model OMD2X2 a low maintenance destruction option. 

“Our advanced shredder ensures that sensitive information stored on optical media is irretrievably destroyed, providing the highest level of data security available,” says Todd Busic, SEM Vice President of Sales. “By introducing this new product, SEM continues to lead the industry in providing state-of-the-art data destruction solutions.”

For more information on the Model OMD2X2, visit https://www.semshred.com/explore-model-omd2x2/

 

NSA vs NAID – What’s the Difference?

November 29, 2018 at 3:41 pm by SEM

There are many different types of paper shredders in the marketplace today. Paper shredders are designed and manufactured to produce a variety of security end-results, known as the shred type or “size”. When shopping around, types such as strip shredders, straight-cut models, or cross cut shredders will stop to pop up. Straight-cut models abs cross cut shredders, though still available, are rarely used in the for high end security destruction due to their lack of data security protection from too much bulk waste generated from strip shredding. When it comes to security, the smaller the particle size the better, which is why when protecting classified or confidential information cross-cut shredders rule the shredding world.

Most organizations oversee some responsibility of security destruction, such as the National Association for Information Destruction (NAID), which requires that materials be destroyed to a particle or cross-cut end result. Almost every data regulation in the U.S. includes a requirement that organizations have written data protection policies and put procedures in place to protect their information. These organizations require that data protection processes are identified; however, there are no regulations in place that dictate any specific particle size that they must meet.

The National Security Agency (NSA) has the highest standard and requirements for destroying classified materials. The NSA evaluates tests and compiles a listing of approved shredders that meet their security standards for destruction. Some government agencies and shredder companies refer to this as a level 6 shredder but the NSA does not. The NSA/CSS Evaluated Products Listing for Paper Shredders is the ultimate guide of which the entire DoD community is governed for the destruction of one’s classified paperwork. This is the highest level of security shredding, where the shred sizes must not exceed 0.8 x 4mm. The NSA /CSS EPL are updated on an annual basis where shredders are added and ratings modified based on evaluations of retesting. Older shredder models are not removed from NSA EPL.

When dealing with the destruction of any classified material you are mandated by your own security destruction regulations to follow the NSA guidelines in purchasing an approved shredder from the NSA/Evaluated Products List. Not using an approved shredder could result in a failed security inspection.

With NAID standards you are required to use a particle or crosscut shredder and to follow the same specific guidelines should you elect to contract with a commercial destruction service that is NAID certified and will adhere to those same standards.

Bottom line: Know what your data security destruction requirements are and follow in accordance to what is governing your information destruction program.

The Missing Link in Cloud Security

November 16, 2018 at 4:16 pm by Heidi White

cloud-securityDefinition of Cloud Security from the Cloud Security Alliance (CSA):
Cloud security refers to a broad set of policies, technologies, and controls deployed to protect data, applications, and the associated infrastructure of cloud computing. It is a sub-domain of computer security, network security, and, more broadly, information security.

Recently, there has been a hyper focus on cloud security — and with good reason. According to a report by McAfee titled “Building Trust in a Cloudy Sky: The State of Cloud Adoption and Security,”cloud services are now a regular component of IT operations, utilized by more than 90% of organizations globally. In fact, 80% of all IT budgets are committed to cloud apps and solutions. Service companies have the highest adoption of public cloud platforms with engineering and government having the highest adoption of private clouds. Amazingly enough, this surge in cloud adoption is not equally met with security and trust with only 23% of organizations today trusting public clouds to keep their data secure. And yet, 62% of organizations reported storing personal customer information in public clouds.

cloud-data-securityThese statistics indicate that cloud security is lagging far behind cloud storage and adoption — similar to cell phone batteries. Cell phone technology continues to advance at an exponential rate while cell phone battery technology advancements are sluggish at best. As a result, cell phone battery life continues to be a major consumer issue regardless of the technological advancements made by cell phone manufacturers. What good is a beautiful, high resolution screen with lightning fast processor if the phone can’t handle the battery load? Likewise, cloud security threats have escalated alongside cloud data expansion due in large part to the sheer number of records now being stored. For example, the number of data breaches from 2014 to 2015 actually decreased, while the number of compromised records containing sensitive information more than doubled from 67 million to 159 million in the same time period. The decreased number of data breaches is indicative of the consolidation of cloud data storage providers, and yet the large increase in compromised records show that one data breach affects far more records today than it did just five years ago.

IT-asset-managementAs a result of the serious challenges presented by cloud data security, numerous methodologies have been recommended in an effort to combat the reputation degradation and astronomical cost associated with compromised data. Some of the more frequently utilized processes include user authentication, encryption of data both in transition and at rest, ongoing vulnerability testing, role-based access control (RBAC), intrusion detection and prevention technology, and staff training. In addition, the establishment and enforcement of cloud security policies is critical to the success of any data protection program. In researching cloud security, any number of articles and guides can be found that address the aforementioned strategies. An incredible amount of focus is placed on encryption, end point security, user controls, and conducting security audits. All of these strategies focus on protecting data from digital threats such as hackers and bots, which is of huge importance. However, a critical piece of security control is missing from most data security plans – an end-of-life policy.

circuit-boardCloud security providers who actually define an end-of-life strategy are rare, and a comprehensive program is even rarer still. Many providers erroneously think that erasing or overwriting a disk is sufficient, or more unsound thinking that a failed drive is precisely that – failed, and non-recoverable. Unfortunately, nothing could be further from the truth. Drives that were “erased” have shown up on eBay with sensitive information and overwritten and failed drives invariably contain original data that is fairly easy to recover. Criminals and thieves tend to be one step ahead of security and law enforcement initiatives, and cyber criminals are no exception.

Degaussing followed by crushing is one methodology for sanitizing hard drives that has been approved by the NSA.

Fortunately, many compliance regulations do address data end-of-life, which is why any cloud security provider should adhere to an appropriate regulation. Whether HIPAA, FACTA, FISMA, PCI DSS, or the most stringent NSA requirements, these compliance regulations are put in place to protect sensitive data and personally identifiable information from falling into the wrong hands whether through firewall vulnerabilities or data retrieval at drive end-of-life. In-house data destruction is the ideal way to securely manage drives at end-of-life; however, the method of data destruction varies greatly depending on volume, location, regulatory requirements, and operational procedures. There are many data destruction devices available from high security disintegrators capable of handling up to 500 drives per hour to enterprise specific, portable, and NSA listed solutions. There is simply no one-size-fits-all solution when it comes to data destruction; therefore, organizations looking to incorporate data destruction into their cloud security program should receive a thorough evaluation to determine which solutions best fits their need. One thing is for sure: no cloud security program is complete without addressing end-of-life destruction.

Many third-party providers offer drive end-of-life services, including degaussing and crushing as well as shredding. But while it is possible to outsource data disposal to third parties, it is NOT possible to outsource risk. Therefore, security-minded organizations must evolve towards a risk mitigation approach to data security that includes in-house data end-of-life destruction and disposal. By maintaining a proactive approach to security operations, companies and businesses can reduce the reputation degradation, frantic clean-up, and astronomical cost that typically comes with a reactive approach. Cloud security should not and cannot follow the path of the cell phone battery without disastrous consequences.

Todd Busic Promoted to Vice President of Security and Intelligence Operations at Security Engineered Machinery

June 28, 2018 at 2:29 pm by Heidi White

Growing secure data destruction device manufacturer enhances government relations and client care with key promotion

todd BusicSecurity Engineered Machinery Co., Inc. (SEM), global leader in high security information end-of-life solutions, is pleased to announce that D. Todd Busic has been promoted to Vice President of Security and Intelligence Operations. The announcement was made by Andrew Kelleher, President and CEO of SEM. Mr. Busic has been with SEM for 19 years and has targeted expertise in federal contract negotiation, federal BPAs, and green destruction facilities. He also has extensive experience with security and intelligence operations, global business development, project management, and international and domestic federal sales.

“Todd’s vision for the company, robust experience, and unparalleled integrity make him a perfect fit for a senior leadership position here at SEM,” said Mr. Kelleher. “I am confident that Todd’s business acumen and customer centricity will enable SEM to enhance relations with our extensive government client base while also expanding our commercial division.”

“I am thrilled to receive this promotion,” commented Mr. Busic. “I am very passionate about security and data privacy, which aligns perfectly with SEM’s mission and vision. I take pride in and truly appreciate the expansive government associations I have forged over the last 19 years. Relationships formed with integrity and trust are the cornerstones of building success. I look forward to the new challenge of expanding the business by augmenting product and service offerings as well as enhancing client relations.”

Mr. Busic will also be responsible for interactions with the NSA Center for Storage Device Sanitization. He will be working out of the company’s Virginia office.