Secure Sanitisation Level (SSL) Impact Levels (IL0-6)

The main factors for any organisation to consider is the type of information held, the type of storage device the data is held on, the confidentiality (security level) of the data.

First and foremost is to identify the potential risk of data confidentiality, what would happen if it fell into the wrong hands, could it cause short term embarrassment - or have a permanent damaging effect on the organisation, could it cause financial loss, or impact on individuals within the organisation.

Secondly decide on the process required - should the sanitisation process be applied in-house or externally sourced, will any of the media be considered for re-use, or physical destruction - also consider environmental issues, time scales and above all costs.

Clear: - the process of overwriting, with a series 0's then repeating the process using a series of 1's and finally randomly writing a series of 0's and 1's. This process is suitable for:

• Hard Drives

• Network Hard Drives

• Printer Hard Drives

• Flash Hard Drive

• Zip, Jaz, Floppy, LS120 &

• USB and other Flash Media

Purge: - the process of degaussing - degaussing involves passing magnetic media under a strong magnetic field, disrupting data patterns, degaussing also destroys the firmware of Hard Drives so should not be considered if re-use is an option.  This process is suitable for:

• Hard Drives

• Data Tapes - DAT, DLT, CCTV, Audio, Video, cassettes

Destroy: - the process of destruction, physical destruction involves disintegration, incineration or shredding. this is the ultimate media sanitisation method. the media is totally destroyed to particle sizes, 15mm to 6mm.  This process is suitable for all the above media forms, Plus:

• Optical media - CD's, DVD's, Blu-ray, HD DVD, mini discs

• DVD-RAM Discs

• Documents - Paper based

• Documents - Microfiche

• Plus many more

The standards below define a Secure Sanitisation Level at three different levels, SSL1, SSL2 and SSL3. Each SSL is related to the (IL) Impact Level  of compromise of confidentiality and is defined below.

Impact Levels: - Impact Levels relate directly to standard protective markings:

Each SSL has three Options:

1. Clear
2. Purge
3. Destroy

This will enable organisations to make their own decisions, by taking into account security, cost and environmental concerns, as to whether the items are to be re-used  or physical destruction is the only option available to them.

Once the media that is to be re-used has been through the Sanitisation process, inline  with the standards above - using the appropriate SSL, then the media may be handled as shown in the table below.

1. SSL1 - this level is used for the Sanitisation of all storage media types that are storing data from IL0 - IL2

2. SSL2 - this level is used for the Sanitisation of all storage media types that are storing data from IL3 - IL4

3. SSL3 - this level is used for the Sanitisation of all storage media types that are storing data from IL5 - IL6

if you require more information or clarification on any of the BUSINESS IMPACT LEVEL TABLES above then click here to view the HMG Infosec Standards as defined by www.cesg.gov.uk