Complaince or trust certifications to acknowledge this behaviour

Question

From documentations it is being claimed that as part of Data Policy, when customers delete data or leave Azure, 1) Microsoft follows strict standards for overwriting storage resources before their reuse 2) As well as the physical destruction of decommissioned hardware.

Are there any compliance/trust certificates that can justify/acknowledge the above two behaviors? I can only find NIST SP 800-88 justifying point #2 but NOT any similar references for point #1.

Answer 1

@AzureUser-9588 ,

The NIST SP 800-88 guideline for Media sanitization acknowledges the first point "Microsoft follows strict standards for overwriting storage resources before their reuse" as well . The Page 43 of the document talks about Flash Memory-Based Storage Device Sanitization which details all kinds of HDD and SDD which are used in Azure. It talks about Clear , purge and destroy options to prevent unauthorized access to confidential data in the event of deletion or end of use of service.

• Clear
  • Overwrite media by using organizationally approved and tested overwriting technologies/methods/tools. The Clear procedure should consist of at least one pass
    of writes with a fixed data value, such as all zeros. Multiple passes or more complex values may alternatively be used.
    • Note: It is important to note that overwrite on flash-based media may significantly reduce the effective lifetime of the media and it may not sanitize the data in unmapped physical media (i.e., the old data may still remain on the media).
  • Use the ATA Security feature set’s SECURITY ERASE UNIT command, if supported.
• Purge
  • Three options are available:
    • Apply the ATA sanitize command, if supported. One or both of the following options may be available:
      • The block erase command.
        • Optionally: After the block erase command is successfully applied to a device, write binary 1s across the user addressable area of the storage media and then perform a second block erase.
      • If the device supports encryption, the Cryptographic Erase (also known as sanitize crypto scramble) command.
        • Optionally: After Cryptographic Erase is successfully applied to a device, use the block erase command (if supported) to block erase the media. If the block erase command is not supported, Secure Erase or the Clear procedure could alternatively be applied.
    • Cryptographic Erase through the TCG Opal SSC or Enterprise SSC interface by issuing commands as necessary to cause all MEKs to be changed. Refer to the TCG and vendors shipping TCG Opal or Enterprise storage devices for more information.
      • Optionally: After Cryptographic Erase is successfully applied to a device, use the block erase command (if supported) to block erase the media. If the block erase command is not supported, Secure Erase or the Clear procedure could alternatively be applied.
• Destroy
  • Shred, Disintegrate, Pulverize, or Incinerate by burning the device in a licensed incinerator.

The section provides detailed information about other types of drives like the ones used in datacenters like SCSI , NVMe etc. and acknowledges the data sanitization behaviors supported on Azure . Hope this information is helpful . Should you have any further query , feel free to let us know.

----------------------------------------------------------------------------------------------------------------------------------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators