The IT director has charged the company helpdesk with sanitizing fixed and removable media. The helpdesk manager has written a new procedure to be followed by the helpdesk staff. This procedure…

During asset disposal, storage media must be sanitized before devices leave organizational control to prevent unauthorized recovery of residual data by external parties.

Reviewing a risk assessment is an administrative governance activity that does not involve handling physical storage media and does not trigger a sanitization requirement.

New assets arrive without organizational user data already on them, so sanitization before initial deployment is unnecessary.

Before repurposing an asset for a different user or purpose, media must be sanitized to ensure the new user cannot access data belonging to the previous user - this is a fundamental data protection control.

Sanitization must occur before disposal, not after - once media has already been disposed of, the opportunity to protect data on it has passed.

Data classification is a labeling and governance process that does not involve transferring or erasing data from physical media.

Installing new printers involves setting up factory-fresh equipment with no residual user data, and does not require media sanitization.

Failed or unusable media can still retain recoverable data accessible through forensic techniques; sanitization or physical destruction must be performed before the media is discarded, returned under warranty, or sent for recycling.