Importance of data sanitization in backups
Once you no longer require backed-up data or its expiration date has passed, you must
either archive or destroy it depending on your organization's data retention policies. If you
store data on site, you might use various data sanitization techniques to fully destroy it,
based on the storage medium. If possible, obtain a certificate of destruction, so that in the
event of an IT organization audit, the auditor can examine and verify evidence of data
destruction activities.
If you store data off site, such as in cloud backup storage, your cloud vendor must destroy
your customer data for you. You must then verify that the data has been properly and fully
destroyed and cannot be recovered. Before engaging with cloud storage or other managed
service provider, research what process it uses for data destruction and understand how
the firm certifies complete destruction of data. An off-site data storage company's failure to
certify data destruction means that data could possibly be recovered, especially if the
storage vendor suffers a cyber-attack that obtains access to customer data.