When it comes to eliminating classified magnetic media, a government IT security manager must establish a process that ensures the media is properly destroyed and disposed of. To some, the options may be limited in getting this done. As required by NSA, classified magnetic media must be degaussed using an NSA evaluated degausser and then it is highly recommended to physically destroy the device. Most agencies will choose to eliminate their classified magnetic media in one of two ways, in-house or outsource. These options are usually weighed based on cost, volume, and level of security.

Agencies that eliminate their magnetic media in-house will purchase the necessary equipment and create a program to perform the destruction on-site. In most cases, security managers prefer in-house destruction because the media is never transported outside classified areas, where it is at risk to be lost or breached. Although these programs require agencies to purchase equipment up-front for their program, it eliminates the cost of having to coordinate high security transportation of the media, including cleared escorts and secure transportation. They can also take advantage of the high recyclable value of various magnetic storage drives.

While agencies can choose to outsource their magnetic media destruction, often by sending it to the NSA or another classified agency with in-house capabilities, it is both risky and more costly. Why? Outsourcing requires a scheduled secure shipment and cleared escorts every time the media leaves the classified area for transport. This process can be expensive and time consuming. Since it can be difficult at times for an IT security department to secure up-front funds for their own equipment, agencies find it easier to spend less money for each shipment and stay within their monthly operating budget. However, many agencies justify creating their own in-house program by weighing the long term costs vs. buying their own equipment. Outsourcing can also add unnecessary security risks by transporting the media outside of classified areas.

To get a more in depth understanding of finding the best data decommissioning policy, read SEM’s whitepaper on the topic here.