C-2510 Internal Revenue Service (IRS) Federal Tax Information (FTI) Sanitization

Revision 24-3; Effective Sept. 1, 2024

All Programs

The sanitization process removes FTI from media to ensure the information cannot be retrieved or reconstructed. Examples include, but are not limited to, digital media found in scanners, copiers, printers, computers, network components, mobile devices, and non-digital media such as paper and microfilm. Staff must use agency-approved software and methods for sanitizing FTI. The following are acceptable sanitization methods:

Clearing protects the confidentiality of information against a robust keyboard attack. Simple deletion of items is not sufficient. Clearing must not allow information to be retrieved by data, disk or file recovery utilities. It must be resistant to keystroke recovery attempts. Overwriting is an example of an acceptable clearing method.

Purging protects the confidentiality of information against a laboratory attack. This type of attack involves using signal processing equipment and specially trained personnel. Examples of acceptable purging methods are executing the firmware Secure Erase command for ATA drives and degaussing by destabilizing a device’s magnetic field.

HHSC must maintain sanitization records which include the:

control number, file name and contents, or both for each record;

total number of records;

date and method of sanitation; and

date of sanitization verification.