AC-4(25) Data Sanitization
Control enhancement of AC-4 Information Flow Enforcement
Control
When transferring information between different security domains, sanitize data to minimize [Assignment: Selection (one-or-more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data | spillage of sensitive information] in accordance with [Assignment: policy].
Discussion
Data sanitization is the process of irreversibly removing or destroying data stored on a memory device (e.g., hard drives, flash memory/solid state drives, mobile devices, CDs, and DVDs) or in hard copy form.
Related controls
Need AC-4(25) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.