Media Protection Policy template for the FIPS 199 Moderate categorization
The same one-page policy for organizations that apply the Moderate confidentiality impact level: general business, professional services, manufacturing without CUI, and education without health or financial records. Purge is acceptable at Moderate, and the policy says so, then explains what a defensible purge costs in per-device records and when destruction is the cheaper choice.
Version 1.0, reviewed 2026-09-22. Free under CC BY 4.0. Not legal or assessment advice.
Who it is for
Organizations whose loss of confidentiality would have a serious adverse effect but not a severe or catastrophic one. Anyone holding PHI, financial account data, criminal justice information, or CUI should use the High edition instead, and the Moderate policy says so in its first paragraph.
What is inside
- Purpose, scope, and categorization: who the Moderate election is for, and the rule that a system later found to hold High-impact data moves to the High edition
- Tracking: the same serial, two-person, marking, reconciliation, and 30-day staging rules as High
- The decision flow at Moderate: Clear accepted for internal reuse (Purge preferred), Purge at minimum for media leaving control, Destroy always acceptable
- A paragraph on choosing between Purge and Destroy, with the cost of per-device purge records laid out
- A technique table showing the Purge and Destroy options side by side for each media type
- Records, retention, holds, vendors (including a purge-records test for resale vendors), and roles
Purge or Destroy? The paragraph the policy includes
Purge is acceptable at Moderate and preserves resale value, but its cost is in the paperwork: each device needs the right IEEE 2883 technique for its media, a tool run with the version recorded, a verification, a validation decision, and a record of every drive that failed, lacked the command, or was dead and had to be destroyed anyway. That work scales one device at a time. Destruction is a batch process: the act produces the evidence and one certificate covers the job. For more than a few dozen devices, for mixed or aging media, or where an auditor will ask for records, destruction is usually the more cost-effective choice; resale value rarely covers the labor of a defensible purge. The policy permits either and requires the named owner to choose per job and record the reason.
How to adapt it
Fill the header and replace every [Title] with a real role.
Set the retention period.
Decide who chooses purge versus destroy per job (the policy assigns it to information security) and where the reason is recorded.
If you will purge for reuse, list the approved tools and who keeps their versions current.
Name your vendor and, if it resells whole devices, validate a sample of its purge records before signing.
What it rests on
- NIST SP 800-88 Rev. 2Section 3.1.1 (single-pass Clear, no multi-pass), 3.1.2 (degaussing as Purge), 3.2 (cryptographic erase), 4.5 and 4.6.
- IEEE 2883-2022The media-specific purge techniques Rev. 2 defers to.
- FIPS 199The definition of the Moderate confidentiality impact level.
- FTC Safeguards Rule and state data-disposal lawsWhere they apply to the organization.
Primary sources are linked on the Standards page.
Questions
If Purge is acceptable, why does the policy push toward destruction?
It does not require destruction; it requires an informed choice. A purge is only defensible if every device has a complete record, and that record is expensive to produce at scale. The policy tells the reader where the cost is so the choice is made on numbers rather than habit.
Does a single overwrite pass satisfy Clear?
Yes. NIST SP 800-88 Rev. 2 section 3.1.1 states that multi-pass overwriting is not needed; a single pass or the device's sanitize command satisfies Clear. The three-pass and seven-pass patterns come from retired DoD language.
What if we handle a little CUI or PHI on the side?
Then the Moderate election is wrong for that system. Move it to the High edition; the two policies are designed to be run side by side for different systems.
More answers on the FAQ.