= Sanitization verification
\b[Sanitization verification] checks the outcome of an attempted <data sanitization> operation: whether the technique completed, and whether its result shows errors or anomalies. In the NIST terminology, this is distinct from <sanitization validation>, which decides whether the outcome adequately protects the target data.<Guidelines for Media Sanitization by Ramaswamy Chandramouli and Eric A. Hibbard>[Section4.5.1, printedp.24, outcome inspection and completion evidence]{ref}
The evidence depends on the technique and medium. It may include a tool's completion status, device-health information or inspection of the remnants of a destructive process. A successful status message concerns the operation that was actually attempted; it does not establish that the chosen technique was appropriate.<Guidelines for Media Sanitization by Ramaswamy Chandramouli and Eric A. Hibbard>[Sections4.5.1–4.5.2, verification inputs and subsequent validation]{ref}
For an original accounting example,20 devices enter an assessment. Nineteen report successful completion and one reports an error. The completion fraction is $19/20=95\%$. That figure is not a95-percent probability that every device is sanitized, nor does it show that each of the19 successful outcomes meets the intended protection objective.
A useful record preserves both the attempted operation and its observed outcome. Without that link, an otherwise plausible completion report could refer to the wrong device or a different attempt. Verification supplies evidence for a decision; it is not a substitute for the decision itself.
Back to article page
