Infosec Standard 5


HMG Infosec Standard 5, or IS5, is a data destruction standard used by the British government.

Context

IS5 is part of a larger family of IT security standards published by CESG; it is referred to by the more general Infosec Standard No.1. IS5 is similar to DOD 5220.22-M.

Requirements

IS5 sets a wide range of requirements—not just the technical detail of overwriting data, but also the policies and processes that organisations should have in place, to ensure that media are disposed of securely. IS5 also touches on risk management accreditation, because secure reuse and disposal of media is an important control for organisations handling high-impact data. It's not sufficient just to sanitise media; the sanitisation should also be auditable, and records must be kept.
IS5 defines two different levels of overwriting:
Regardless of which level is used, verification is needed to ensure that overwriting was successful.
Apart from overwriting, other methods could be used, such as degaussing, or physical destruction of the media. With some inexpensive media, destruction and replacement may be cheaper than sanitisation followed by reuse. ATA Secure Erase is not approved. Different methods apply to different media, ranging from paper to CDs to mobile phones.
The choice of method affects reusability. Four different outcomes are considered:
Stricter requirements apply to data with a stronger protective marking or IL. In some cases, media at or above IL4 / CONFIDENTIAL may have to be handled at a secure site, such as a List X site.