IRS Logo
Print - Click this link to Print this page

IRS Publication 1075 Media Sanitation Requirements Explained

Purpose

To provide agencies clarification on the requirements and guidance for implementation of media sanitization (e.g., tapes, hard drives, CD/DVD) techniques (clearing, purging, destroying) for media that contain Federal tax return and return information (FTI) for situations when the media is going to be reused or disposed by the agency.

Introduction

IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities, outlines the requirements and guidelines for external agencies and other authorized recipients of FTI material to establish procedures to ensure the adequate protection of the FTI data they receive. The requirements for sanitization of media containing FTI can be found in the Publication 1075 Section 8.0, Disposing Federal Tax Information.  Additionally, the IRS follows the guidance set forth in NIST SP 800-88, Guidelines for Media Sanitization, for media sanitization and destruction. The guidance provided in this memo is an aggregation of guidance currently provided in the Publication 1075 and the NIST guide.

Once an agency no longer needs the FTI it has received from the IRS, the IRS policy specifically requires agencies to take either of the below two actions to ensure proper disposal of the FTI.

  1. Returning IRS information to the source utilizing a receipt process for appropriate media handling during transport to ensure confidentiality if the FTI.
  2. Destroying IRS information via the following methods: burning, mulching, pulping, shredding, or disintegrating if the FTI material is to leave the agency’s control.

There are several process points that serve as determining factors for actions, i.e., whether or not the media is to be reused by the agency, whether or not the media will be leaving agency control.  These process points are defined below.

Reuse of Media

If media are not intended for reuse either within or outside an agency due to damage or other reason, the simplest and most cost-effective method of control may be destruction in accordance with the techniques outline below.

Control of Media

Media is considered to be under agency control in the following two scenarios:   1) media being turned over for maintenance are still considered under agency control if contractual agreements are in place with the agency and the maintenance provider specifically provides for the confidentiality of the information, 2) maintenance being performed on an agency’s site, under the agency’s supervision, by a maintenance provider.

Media is considered not under agency control if it is being exchanged for warranty, cost rebate, or other purposes and where the specific media will not be returned to the agency. In these circumstances any FTI on the media must be cleared by completely overwriting all data tracks a minimum of three times using maximum current that will not damage or impair the recording equipment; or purged by running a magnetic strip, of sufficient length to reach all areas of the disk over and under each surface a minimum of three times.

Sanitization Techniques

The IRS policy provides specific guidance on techniques that should be used for sanitizing FTI by clearing, purging and destroying the FTI based on the type of media housing the FTI.  There are two types of media primarily used by agencies to store or process FTI.

  1. Hard Copy - physical representations of FTI. Examples include paper printouts, printer, and facsimile ribbons, drums, and platens. Hard copy media is often the most difficult to control, and is vulnerable to ‘dumpster dive’ attacks, and accidental disclosure of paper FTI.
  2. Electronic – digital representations of FTI. Examples include disk drives, USB drives, CDs, DVDs, reel tape.

Hard Copy Media

FTI contained in hard copy printed material:

Burning: The material is to be burned in either an incinerator that produces enough heat to burn the entire bundle or the bundle should be separated to ensure that all pages are consumed. The IRS is currently evaluating alternatives to incineration for agencies restricted by environmental protection regulations that do not allow incineration.

Shredding: To make reconstruction more difficult, the paper should be inserted so that lines of print are perpendicular to the cutting line and not maintain small amounts of shredded paper. The paper should be shredded using a cross-cut shredder to effect 5/16 inch wide or smaller strips; microfilm and microfiche should be shredded to effect a 1/35- inch by 3/8- inch strips. If shredding is part of the overall destruction of FTI, strips can in effect be set at the industry standard (currently ½"). However, when deviating from IRS’ 5/16" requirement, FTI as long as it is in this condition (i.e., strips larger than 5/16"), must be safeguarded until it reaches the stage where it is rendered unreadable. Pulping of data should be accomplished only after material has been shredded.

Electronic Media

Magnetic Disks:
Sanitization of magnetic disks such as floppies, ATA hard drives, USB removable media (pen drives, thumb drives, flash drives, memory sticks) with hard drives and zip disks should follow the guidelines detailed below based on the type of magnetic disk media type.

Magnetic Disk Sanitization Requirements
 Magnetic Disk Type  Clear  Purge  Destroy
 Floppy Disks  Overwrite  Degauss Incinerate
Shred
 ATA Hard Drives Overwrite    Degauss Incinerate
Shred
Pulverize
Disintegrate
 USB Removable Drives Overwrite    Degauss Incinerate
Shred
Pulverize
Disintegrate
 Zip Drives  Overwrite   Degauss Incinerate
Shred
 SCSI Drives  Overwrite   Degauss  Incinerate
Shred
Pulverize
Disintegrate

Magnetic Tape:
Sanitization of magnetic tape media such as reel and cassette tapes should follow the guidelines detailed below.

Magnetic Tape Sanitization Requirements
Magnetic Disk Type  Clear Purge Destroy
 Reel and Cassette Overwrite Degauss Incinerate
Shred 

Optical Disk:
Sanitization of optical disks such as CDs and DVDs should follow the guidelines detailed below.

Optical Disk Sanitization Requirements
Magnetic Disk Type  Clear Purge Destroy
CDs/DVDs N/A N/A Incinerate
Shred
Grind

Verification

Verifying the selected information sanitization and disposal process is an essential step in maintaining confidentiality. A representative sampling of media should be tested for proper sanitization to assure the agency that proper protection is maintained.

Generally, destruction should be witnessed by an agency employee. The Department of Justice, State tax agencies, and the Social Security Administration may be exempted from the requirement of having agency personnel present during destruction by a contractor, if the contract includes the safeguard provisions required by the Code of Treasury Regulations (CTR) 301.6103(n)-1. The required safeguard language is contained in Exhibit 7, Contract Language for General Services. If this method is used, it is recommended that periodically the agency observe the process to ensure compliance. Destruction of FTI should be certified by the  contractor when agency participation is not present.

Documentation

It is critical that an agency maintain a record of its sanitization to document what media were sanitized, when, how they were sanitized, and the final disposition of the media.

References and Related Topics

Page Last Reviewed or Updated: 01-Apr-2014