CAS-002 · Question #272
Company XYZ plans to donate 1,000 used computers to a local school. The company has a large research and development section and some of the computers were previously used to store proprietary…
The correct answer is B. Delay the donation until all storage media on the computers can be sanitized. When donating computers that may contain proprietary data and no sanitization policy exists, the security administrator must ensure storage media is sanitized before the transfer occurs.
Question
Company XYZ plans to donate 1,000 used computers to a local school. The company has a large research and development section and some of the computers were previously used to store proprietary research. The security administrator is concerned about data remnants on the donated machines, but the company does not have a device sanitization section in the data handling policy. Which of the following is the BEST course of action for the security administrator to take?
Options
- ADelay the donation until a new policy is approved by the Chief Information Officer (CIO),
- BDelay the donation until all storage media on the computers can be sanitized.
- CReload the machines with an open source operating system and then donate the machines.
- DMove forward with the donation, but remove all software license keys from the machines.
How the community answered
(26 responses)- A4% (1)
- B73% (19)
- C15% (4)
- D8% (2)
Why each option
When donating computers that may contain proprietary data and no sanitization policy exists, the security administrator must ensure storage media is sanitized before the transfer occurs.
Waiting for CIO approval of a new policy introduces indefinite delay without actually sanitizing the media, and policy approval alone does not remove data from the drives.
Delaying the donation until all storage media is sanitized directly eliminates the risk of proprietary research reaching unauthorized parties through data remnant recovery. Sanitization methods such as secure overwrite, degaussing, or physical destruction ensure data cannot be forensically recovered regardless of the absence of a formal policy. The lack of a written policy does not remove the legal and ethical obligation to protect confidential research data before hardware disposal.
Reloading an operating system does not overwrite or sanitize the underlying storage media, leaving previous data recoverable with standard forensic tools.
Removing software license keys addresses licensing compliance only and has no effect on sensitive research data stored on the machines.
Concept tested: Data sanitization before hardware disposal or donation
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf
Topics
Community Discussion
No community discussion yet for this question.