Drilling a hard drive is not media sanitization

Ask a small shop what happens to a dead drive and you'll hear a version of the same story. Somebody put a drill through it, or it went in a box under the bench, or "we threw it out." Only the first of those sounds like a control, and it is the one that fails.

Media sanitization is 03.08.03 in ITSP.10.171, and it is 1 of the 13 CPCSC Level 1 requirements. So this is not a Level 2 problem you can defer. It is on the self-assessment you attest to at contract award.

Why the drill fails

Drilling on its own is not a recognized sanitization method under the Cyber Centre's ITSP.40.006 or under NIST SP 800-88, the American guidance. Platters still hold data around the hole. A photo of a drilled drive proves you made a hole. It doesn't prove the data is gone.

What the guidance expects depends on the media.

Spinning disks get degaussed or shredded.

Solid state gets a cryptographic erase and then the shredder. Crypto erase destroys the key that makes the stored data readable, which is quick and verifiable, and the shred is the second step for anything leaving your control or dying in place.

In both cases the destruction gets logged. If a vendor does the work, get the certificate of destruction and file it.

The log is the control

The audit conversation is never about the method in the abstract. It is about 1 drive. A drive that held Specified Information was transferred to a replacement, fine, so where is the old one now? "We threw it out" is not an answer.

The log I use is plain, and the template is in the appendix of my CPCSC book. One row per device, with the date, the asset and serial, the media type, the data class, the method, who verified it, and the evidence, such as a photo or a certificate number. A 3.5-inch drive from a file server gets "degauss plus shred" and a certificate. A USB stick gets "crypto erase" and the tool's own log. That is the whole system, and a spreadsheet is enough.

The part that catches people is completeness. The auditor samples, and the sample will find the drive you forgot. Showing that the process ran for the 1 drive you remembered proves nothing. Showing it ran for every drive, including the dead ones from the box under the bench, is the control.

That box is the first thing I look for. Pick an owner, set a rule that nothing leaves the building without a log row, and clear the box.

Warranty swaps leak data

One item gets past even careful shops. When a drive fails under warranty, the standard replacement process ships the failed drive back to the manufacturer, with your data on it. You have transferred Specified Information to a third party and you cannot say what happens next.

Ask the vendor for media retention, and get it in writing. With retention, the dead drive never leaves the building, and you destroy it and log it like any other. This is a purchasing decision, so it has to be made before the first failure, not during it.

Encrypt what moves

Sanitization is the end of the drive's life, and the other end matters too. I recommend encrypted drives such as IronKey for anything that moves, BitLocker with the TPM on anything that can be lost, and a preference for moving files through the server instead of on a stick.