Question

A financial services firm is decommissioning several on-premises servers containing customer personal data on solid-state drives (SSDs). The IT team proposes running a multi-pass overwrite utility, the same procedure historically used on the firm's magnetic hard drives, to sanitize the SSDs before the servers are sold to a refurbisher. As the privacy solutions engineer reviewing the disposal plan, what is your MOST important concern?

Accepted Answer

Multi-pass overwriting is unreliable on SSDs because wear-leveling and over-provisioning can leave recoverable data in cells the utility cannot address, so a media-appropriate sanitization method should be used

Answer

A single overwrite pass would be sufficient, so the multi-pass approach wastes time and delays the sale to the refurbisher

Answer

The servers should be retained internally rather than sold, since any reuse of the hardware creates unacceptable privacy risk

Answer

The disposal plan should focus on encrypting the drives before sale rather than sanitizing them