ISO/IEC 21964-3:2018
(Main)Information technology — Destruction of data carriers — Part 3: Process of destruction of data carriers
Information technology — Destruction of data carriers — Part 3: Process of destruction of data carriers
This standard defines the requirements for the process of destruction of data carriers and is applicable for the responsible authority and for all parties who are involved in the destruction process.
Technologies de l'information — Destruction de véhicules de données — Partie 3: Processus de destruction des supports de données
General Information
Buy Standard
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 21964-3
First edition
2018-08
Information technology — Destruction
of data carriers —
Part 3:
Process of destruction of data carriers
Technologies de l'information — Destruction de véhicules de
données —
Partie 3: Processus de destruction des supports de données
Reference number
©
ISO/IEC 2018
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Processing . 1
3.1 General . 1
3.2 Process definition . 2
3.3 Determination of the risk structure . 2
3.4 Process execution . 3
3.5 Inspection and testing . 3
3.5.1 Requirements to the data controller . 3
3.5.2 Process reliability . 3
3.5.3 Requirements to certificates of service providers . 4
4 Process criteria . 4
4.1 General . 4
4.2 Criteria for all varieties of data carrier destruction . 4
4.3 Criteria for variety 1 . 4
4.4 Criteria for variety 2 . 5
4.5 Criteria for variety 3 . 5
4.6 Criteria for the infrastructure of the service provider for variety 3 . 7
4.7 Take-over record . 8
4.8 Destruction record . 8
© ISO/IEC 2018 – All rights reserved iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of document should be noted (see www .iso .org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by DIN, German Institute for Standardization (as national standard
DIN 66399-3) and drafted in accordance with its editorial rules. It was assigned to Joint Technical
Committee ISO/IEC JTC 1, Information technology, and adopted under the “fast-track procedure”.
A list of all parts in the ISO/IEC 21964 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
iv © ISO/IEC 2018 – All rights reserved
Introduction
Everybody, who processes confidential, personal and/or sensitive data, for themselves or on behalf of
others, is obliged to ensure an adequate and secure disposal and destruction of data carrier.
Secure destruction means in this regard, that the data carriers, on which the information in need of
protection is represented, are destroyed in a way, that the reproduction of the represented information
are either impossible or most widely aggravated (ISO/IEC 21964-1 and ISO/IEC 21964-2).
Not just the secure destruction itself should be noted, but also the whole process from the point of origin
through to the environmentally friendly recycling/disposal in accordance with laws and regulations
currently in force.
© ISO/IEC 2018 – All rights reserved v
INTERNATIONAL STANDARD ISO/IEC 21964-3:2018(E)
Information technology — Destruction of data carriers —
Part 3:
Process of destruction of data carriers
1 Scope
This standard defines the requirements for the process of destruction of data carriers and is applicable
for the responsible authority and for all parties who are involved in the destruction process.
2 Normative references
The following quoted documents are required for the application of this document. For dated references
only the referred version is valid. For undated references, the last issued version is valid (including all
changes).
ISO/IEC 21964-1, Information Technology — Destruction of data carriers — Part 1: Principles and
Definitions
ISO/IEC 21964-2, Information Technology — Destruction of data carriers — Part 2: Requirements for
equipment for destruction of data carriers
3 Processing
3.1 General
The destruction of data carriers has to be understood as a process, in which every single process step
has to be examined and designed to be secure. The responsible authority is responsible for the whole
process (internal and/or external) up to the final destruction of the data carrier. The process of data
carrier destruction ends as soon as the agreed security level is reached.
Usually the process involves different parties from the collection point to the environmentally friendly
destruction. If service providers are involved in the process, the delimitation of responsibilities between
the data controller and the service provider has to be agreed clearly. Due to legal provisions there are
mainly technical and organizational measures to be taken for this process.
The depiction in Figure 1 shows the varieties of the process contained in this standard including the
related process steps.
© ISO/IEC 2018 – All rights reserved 1
Figure 1 — Data carrier destruction
3.2 Process definition
The identified technical and organizational measures, resulting from a risk analysis, shall ensure
the protection requirements by considering the state-of-the-art of restoration technologies. These
protection requirements shall be adequate for the risks that may emerge by the destruction process
itself, and the kind of data to protect.
To protect data from misuse, it requires a security- and control system, which ensures a reliable
quality of the destruction process either on-site at the data controller or off-site at a service provider.
The protective purpose is the prevention of data abuse. Taking into account economical and adequacy
considerations, the data carriers intended to be destroyed, should be separated into protection classes
(see ISO/IEC 21964-1, Protection classes 1 to 3).
If there are data carriers which require different security levels, it is recommended to separate them
according to the different security levels at the collection point for economic and ecological reasons.
3.3 Determination of the risk structure
Data has to be categorized to its sensitivity according to ISO/IEC 21964-1.
In principle an impairment of the basic functionality of data carrier should take place in the early
process steps of the destruction process.
For electronic and magnetic data carriers, it is recommended to erase or overwrite them prior to the
destruction. This reduces the attraction of stealing and it originates a basic security for the subsequent
process steps. Considering the protection requirement a lower security level can then be chosen. If an
2 © ISO/IEC 2018 – All rights reserved
impairment of the basic functionality resp. erasing/overwriting is not possible, the necessary security
level of the chosen protection class shall apply.
When using one of the process varieties, it needs to be verified in advance, whether the technical and
organizational requirements of the corresponding protection class and security levels are met.
The data controller defines the protection requirements and the protection class. Therefore the
following questions shall be answered:
— Which information is worth being protected and categorized in which protec- What?
tion class
— Destruction according to which security level How?
— Destruction by the data controller directly or by an external service provider Who?
— Destruction on-site or off-site by an external Where
— service provider
— Technical and organizational measures at the collection point, How?
during transport and at the service provider
The result determines the operational processing (security concept).
3.4 Process execution
A prerequisite for the proper execution of the process is a detailed organization in which the process is
documented, the responsibilities defined, the legal and operational framework conditions specified and
the requirements for the personnel employed in the process defined.
The process shall be designed in such a way that, after the decision of the data controller to destroy
the data carrier, no unauthorized persons obtain knowledge of the data, taking into account the
protection requirement. According to the local terms and conditions and the protection requirements,
the conditions for the collection, storage, transportation and destruction of data carriers shall be
determined.
If data carriers are transported, they have to be protected against unauthorized access. Beyond the
usage of secured containers and vehicles, particular measures during transfer and storage are to be
considered according to the protection requirements (see Clause 4).
3.5 Inspection and testing
3.5.1 Requirements to the data controller
The data controller shall design and verify the whole destruction process under consideration of legal
and operational requirements to
...
INTERNATIONAL ISO/IEC
STANDARD 21964-3
First edition
2018-08
Information technology — Destruction
of data carriers —
Part 3:
Process of destruction of data carriers
Technologies de l'information — Destruction de véhicules de
données —
Partie 3: Processus de destruction des supports de données
Reference number
©
ISO/IEC 2018
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Processing . 1
3.1 General . 1
3.2 Process definition . 2
3.3 Determination of the risk structure . 2
3.4 Process execution . 3
3.5 Inspection and testing . 3
3.5.1 Requirements to the data controller . 3
3.5.2 Process reliability . 3
3.5.3 Requirements to certificates of service providers . 4
4 Process criteria . 4
4.1 General . 4
4.2 Criteria for all varieties of data carrier destruction . 4
4.3 Criteria for variety 1 . 4
4.4 Criteria for variety 2 . 5
4.5 Criteria for variety 3 . 5
4.6 Criteria for the infrastructure of the service provider for variety 3 . 7
4.7 Take-over record . 8
4.8 Destruction record . 8
© ISO/IEC 2018 – All rights reserved iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of document should be noted (see www .iso .org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by DIN, German Institute for Standardization (as national standard
DIN 66399-3) and drafted in accordance with its editorial rules. It was assigned to Joint Technical
Committee ISO/IEC JTC 1, Information technology, and adopted under the “fast-track procedure”.
A list of all parts in the ISO/IEC 21964 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
iv © ISO/IEC 2018 – All rights reserved
Introduction
Everybody, who processes confidential, personal and/or sensitive data, for themselves or on behalf of
others, is obliged to ensure an adequate and secure disposal and destruction of data carrier.
Secure destruction means in this regard, that the data carriers, on which the information in need of
protection is represented, are destroyed in a way, that the reproduction of the represented information
are either impossible or most widely aggravated (ISO/IEC 21964-1 and ISO/IEC 21964-2).
Not just the secure destruction itself should be noted, but also the whole process from the point of origin
through to the environmentally friendly recycling/disposal in accordance with laws and regulations
currently in force.
© ISO/IEC 2018 – All rights reserved v
INTERNATIONAL STANDARD ISO/IEC 21964-3:2018(E)
Information technology — Destruction of data carriers —
Part 3:
Process of destruction of data carriers
1 Scope
This standard defines the requirements for the process of destruction of data carriers and is applicable
for the responsible authority and for all parties who are involved in the destruction process.
2 Normative references
The following quoted documents are required for the application of this document. For dated references
only the referred version is valid. For undated references, the last issued version is valid (including all
changes).
ISO/IEC 21964-1, Information Technology — Destruction of data carriers — Part 1: Principles and
Definitions
ISO/IEC 21964-2, Information Technology — Destruction of data carriers — Part 2: Requirements for
equipment for destruction of data carriers
3 Processing
3.1 General
The destruction of data carriers has to be understood as a process, in which every single process step
has to be examined and designed to be secure. The responsible authority is responsible for the whole
process (internal and/or external) up to the final destruction of the data carrier. The process of data
carrier destruction ends as soon as the agreed security level is reached.
Usually the process involves different parties from the collection point to the environmentally friendly
destruction. If service providers are involved in the process, the delimitation of responsibilities between
the data controller and the service provider has to be agreed clearly. Due to legal provisions there are
mainly technical and organizational measures to be taken for this process.
The depiction in Figure 1 shows the varieties of the process contained in this standard including the
related process steps.
© ISO/IEC 2018 – All rights reserved 1
Figure 1 — Data carrier destruction
3.2 Process definition
The identified technical and organizational measures, resulting from a risk analysis, shall ensure
the protection requirements by considering the state-of-the-art of restoration technologies. These
protection requirements shall be adequate for the risks that may emerge by the destruction process
itself, and the kind of data to protect.
To protect data from misuse, it requires a security- and control system, which ensures a reliable
quality of the destruction process either on-site at the data controller or off-site at a service provider.
The protective purpose is the prevention of data abuse. Taking into account economical and adequacy
considerations, the data carriers intended to be destroyed, should be separated into protection classes
(see ISO/IEC 21964-1, Protection classes 1 to 3).
If there are data carriers which require different security levels, it is recommended to separate them
according to the different security levels at the collection point for economic and ecological reasons.
3.3 Determination of the risk structure
Data has to be categorized to its sensitivity according to ISO/IEC 21964-1.
In principle an impairment of the basic functionality of data carrier should take place in the early
process steps of the destruction process.
For electronic and magnetic data carriers, it is recommended to erase or overwrite them prior to the
destruction. This reduces the attraction of stealing and it originates a basic security for the subsequent
process steps. Considering the protection requirement a lower security level can then be chosen. If an
2 © ISO/IEC 2018 – All rights reserved
impairment of the basic functionality resp. erasing/overwriting is not possible, the necessary security
level of the chosen protection class shall apply.
When using one of the process varieties, it needs to be verified in advance, whether the technical and
organizational requirements of the corresponding protection class and security levels are met.
The data controller defines the protection requirements and the protection class. Therefore the
following questions shall be answered:
— Which information is worth being protected and categorized in which protec- What?
tion class
— Destruction according to which security level How?
— Destruction by the data controller directly or by an external service provider Who?
— Destruction on-site or off-site by an external Where
— service provider
— Technical and organizational measures at the collection point, How?
during transport and at the service provider
The result determines the operational processing (security concept).
3.4 Process execution
A prerequisite for the proper execution of the process is a detailed organization in which the process is
documented, the responsibilities defined, the legal and operational framework conditions specified and
the requirements for the personnel employed in the process defined.
The process shall be designed in such a way that, after the decision of the data controller to destroy
the data carrier, no unauthorized persons obtain knowledge of the data, taking into account the
protection requirement. According to the local terms and conditions and the protection requirements,
the conditions for the collection, storage, transportation and destruction of data carriers shall be
determined.
If data carriers are transported, they have to be protected against unauthorized access. Beyond the
usage of secured containers and vehicles, particular measures during transfer and storage are to be
considered according to the protection requirements (see Clause 4).
3.5 Inspection and testing
3.5.1 Requirements to the data controller
The data controller shall design and verify the whole destruction process under consideration of legal
and operational requirements to
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.