How to Comply with NESA Wiping Requirements24 Aug 2020 | Michael Waksman
Is your organization based in the United Arab Emirates? If yes, then you need to start complying with new regulations introduced by the National Electronic Security Authority (NESA). Here we’ll summarize what NESA says about data wiping requirements and share 3 steps on how to implement a successful NESA
NESA in a Nutshell
The NESA regulations are already in effect.
The legislation is made up of several regulations – the most relevant being the Information Assurance Standards (IAS). The IAS consists of 188 security controls that all relevant companies and organizations must comply. Objectives of the IAS:
- Strengthen security of UAE cyber assets
- Reduce corresponding risk levels
- Protect critical data infrastructure
- Improve threat awareness
NESA compliance is mandatory for:
- Government organizations
- Semi-government organizations
- Organizations that are part of the UAE critical infrastructure
What Does NESA Say about Data Wiping?
In short, the regulations state that organizations must securely erase or overwrite sensitive data when it is no longer needed. NESA also recommends that organizations select reliable third-party companies that can help them dispose of data effectively.
- M4.4.2: Return of Assets
“In cases where an employee, contractor, or third-party user purchases the entity’s equipment or uses their own personal equipment, procedures should be followed to ensure that all relevant information is transferred to the entity and securely erased from the equipment.”
- T1.4.1: Management of Removable Media
“If no longer required, the contents of any re-usable media that are to be removed from the entity should be made unrecoverable; data wiping software could be used for instance.”
- T1.4.2: Disposal of Media
“The entity shall establish procedures for secure disposal of media containing confidential information based on the sensitivity of that information.”
“Media containing confidential information should be stored and disposed of securely and safely, e.g. by incineration or shredding, or erasing data for use by another application within the entity.”
“Many entities offer collection and disposal services for media; care should be taken in selecting a suitable external party with adequate controls and experience.”
- T2.3.6: Secure Disposal or Reuse of Equipment
“The entity shall ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal.”
Prepare for NESA Compliance
By following these 3 steps, you can ensure that your organization is able to comply with NESA wiping requirements.
1. Understand where your data resides
No matter where your data is saved, it’s your responsibility to know where it is. Keep track of your data flow and build a clear picture of where your information is located, how it’s being accessed, and how it’s being shared. Knowing where your data resides will help you get working faster when you must locate files you need to erase.
2. Classify and get organized
Once you know where your data resides, it’s crucial to get organized. Begin by building an inventory – arrange your data by importance and level of risk. You should also put someone formally in charge of data protection. This communicates to your customers, and compliance officers, that you are serious about protecting sensitive information.
3. Use the right tools
What kind of data do you need to erase? Answering this question will help you understand what type of software to use. If you have sensitive data on a computer that’s no longer needed, then you should use software that’s able to wipe your entire hard drive. On the other hand, if you only have an individual file or folder that you must remove, then you could use a tool that allows you to wipe selected data from an active computer.
How Data Wiping Works
The most secure and efficient way to dispose of sensitive information is to securely erase or overwrite it by using data wiping software. Deleting files by normal means is not enough – information saved to a hard drive will leave behind residual data. In order to prevent data from being discovered by file recovery software and accessible to attackers, you can choose to wipe your data and permanently erase your information.
Michael Waksman has been serving as CEO of Jetico since 2011, more than doubling the size of the company during his tenure. He brings more than 20 years of communications, technology and leadership experience.
At Jetico, Waksman has lead creation of the corporate identity, raising global brand awareness, building a more commercially-driven team and initiating enterprise customer relations. Jetico has maintained a wide user base throughout the U.S. Defense community, in the global compliance market and for personal privacy.
Waksman served as vice-chairman of the Cyber Group for the Association of Finnish Defense and Aerospace Industries. Recognized as a security and privacy advocate, he is a frequent speaker at international events, occasionally on behalf of the Finnish cyber security industry. In 2012, Waksman was honored with The Security Network's Chairman's Award for fostering collaboration between the United States and Finland. As dual citizen, he is a native New Yorker and has been living in the Helsinki region for over 15 years.
Thank you for contacting Jetico! We will respond to you as soon as possible.
Send us a message - we'll reply within 24 business hours.
Need help now? Call Us
US: 202 742 2901