VA Media Sanitization

The VA National Media Sanitization program has been in existence since 2005 and services all three VA administrations including Veterans Health Administration (VHA), Veterans Benefit Administration (VBA) and the National Cemetery Administration (NCA).  The users of this program are primarily VA Information Security Officers and VA Information Technology (IT) personnel with responsibility for media sanitization, but can include any VA employee with media requiring sanitization. Since its inception, the number of sanitization program users has grown.  The number of users serviced by the Media Sanitization program has grown and is expected to continue to grow to 1000 or more.

 The Media Sanitization Program services all types of VA environments and all types of data.   VA follows NIST Special Publication 800-88 Rev. 1 “Guidelines for Media Sanitization” December 2014, and VA Handbook 6500 “VA Cybersecurity Program” 2019. The media types include hard drives, tape media, floppy disks, optical disks, data and audio cassettes, microfiche, printer ribbon, x-rays, removable USB/memory, and hand-held devices, such as cellular phones (including smartphones), iPads, Tablets, and digital cameras.  In 2024, TDG destroyed over 300,000 devices totaling over 100,000 pounds of media.

 TDG provides all shipping materials required for the VA user to ship the VA sensitive media to our facility for sanitization. Shipping materials include: secure plastic shipping containers; strapping material and sequential locks; barcoded shipping and storage bags; Radio Frequency Identification (RFID) tags in sequential order for labeling thumb drives, smartphones and other devices without visible serial numbers. All VA facilities within the continental United States have this service.

 TDG provides the VA media sanitization and destruction service that is consistent with the methods and standards outlined in the NIST Special Publication 800-88 Rev. 1 “Guidelines for Media Sanitization” (December, 2014).  We receive, sanitize, and destroy all media within 15 days at our sanitization facility.  As part of this process , we maintain a web portal that tracks each shipment through the entire process.  We sanitize each hard drive, compact disc, tape and thumb drive, or other media type using equipment listed in the most recent NSA approved Product Listing and then destroy the media by shredding or burning in an EPA approved incinerator.  We provide a Certificate of Destruction that certifies the destruction or sanitization of each media item has occurred. The certifications are witnessed by our team and signed to attest to the authenticity of the sanitization, including destruction activity.

 We have developed Risk Mitigation Plan that addresses the risks associated with sanitizing and destroying sensitive electronic media including, loss or theft, and the mitigation of these risks.