Doc. AQ-SM-04 · Sanitization methodology

How the method is chosen, applied and proven.

The controlled procedure every asset follows between retirement and disposition. Method selection follows the media controller, never the fleet default, in line with NIST SP 800-88r1.

Media classification

Each asset is classified by controller and interface before a method is assigned. Classification is read from the device where possible and confirmed by the operator at the sanitization bay.

Magnetic HDDPurgeMulti-pass overwrite with post-write read verification of sampled LBAs.

SATA SSDPurgeATA Sanitize block erase; falls back to cryptographic erase where unsupported.

NVMe SSDPurgeNVMe Format NVM with secure erase setting, user data or crypto erase.

Self-encryptingPurgeVerified key destruction, followed by a readback sample for ciphertext.

Embedded eMMCDestroySanitize where the controller exposes it, otherwise physical destruction.

Optical / tapeDestroyShredding to documented particle size with weight reconciliation.

Method selection rules

Redeployment inside the same trust boundary may use Clear; anything leaving the estate requires Purge or Destroy.
Media holding regulated data categories is escalated one level above the baseline.
Where the controller does not expose a verifiable sanitize command, the asset routes to Destroy rather than an unverified overwrite.
Customer policy can raise, never lower, the selected method.

Verification

Every job is verified before closure. Overwrite jobs are verified by sampled readback against expected patterns; block and cryptographic erase are verified by command completion status plus a readback sample. Verification output is stored with the job record and hashed into the certificate. A job that cannot be verified is never recorded as successful.

Exception handling

Failed or partial sanitization raises an exception with the failure code, operator and timestamp. Exceptions route the asset to physical destruction at a documented particle size, and the resulting destruction record is attached to the original asset so the audit trail is continuous rather than restarted.

Chain of custody

Each physical hop — user to depot, depot to bay, bay to hauler, hauler to processor — is signed by an identified custodian with device time, location and photographic condition capture. Missed scans surface as open intervals; they are never back-filled silently.

Evidence and retention

The evidence bundle for each asset contains the classification record, method, tool and version, verification output, custody chain, operator identity, and the certificate with its SHA-256 digest. Bundles are retained for the customer-configured period, defaulting to seven years.

Operator competence

Sanitization is performed by trained operators working to this document. Operator identity is recorded per job, and the methodology revision in force at the time is stamped onto the certificate so an auditor can reconstruct exactly which procedure applied.

AQ-SM-04 describes AUTONOMIQ's documented procedure. Mapping tables to specific control frameworks are issued with the vendor assessment pack on request.