1. Why media disposal is an audit hotspot in Indian banking
Almost every bank has a written information security policy. Far fewer can produce evidence that the media disposal part of it actually operates. The gap matters because:
- RBI's information security and IT governance expectations require disposal of customer data media to be controlled and auditable.
- A breach originating from retired media is a reportable incident with a regulatory timeline, and "the drive was in a warehouse" is a difficult narrative.
- Third-party processors, cloud providers and ITAD vendors are all in scope for the same obligation — and the bank remains accountable for what they do with its media.
2. The media in a bank's estate
| Media | Where it is | Risk | Recommended method |
|---|---|---|---|
| Branch and ATM server drives | Branch back rooms | Unattended, unlogged, often on shared power | Degauss + crush; wand and PDS-75 at branch level |
| Core banking / CBS drives | Data centre | Highest sensitivity; refresh events create volume | T-4 or T-5 + PDS-100; run under change control |
| Laptop and desktop drives | Returned to store, or buy-back vendor | Full disk encryption often off; second-owner exposure | Degauss before any release; shred flash before disposal |
| Backup tapes | Data centre and off-site vault | Complete historical copy; nobody reviews the rack | Degauss + crush per retention decision |
| Failed drives | The bin | Cannot be wiped; often defeats a shredder | Degauss — the only reliable answer |
| Cards, SIMs, POS devices | Branch operations, high volume | Cardholder data and keys | PDS-88 shredder |
| ATMs and card personalisation machines | Branch and back office | Keys and card data inside | Documented wipe or destruction per device |
3. Process RBI expects
| Stage | Control | Evidence an auditor accepts |
|---|---|---|
| Policy | A written media disposal policy naming methods per media type | The document, with version history and approval |
| Classification | Data classification determines sanitisation level | Classification recorded against the asset |
| Authorisation | Named, trained operators only | Training records and an authorised-operator list |
| Sanitisation | Degauss magnetic media to purge level with verification | Per-cycle field reading in the register |
| Flash | Shred SSDs, phones, cards, SIMs | Register entry naming the shredder |
| Destruction | Crush sanitised media | Register entry |
| Chain of custody | Controlled storage and transport | Location, access list, transit record |
| Scrap | Authorised e-waste recycler | Recycler authorisation, weighment or receipt |
| Review | Periodic independent review | Internal or external audit report |
4. Destroying under audit observation
Some bank audits ask to witness a destruction run. This is straightforward if the process is real, and impossible to fake if it is not. A good witnessed run looks like this:
- The auditor selects three or four assets at random from the asset register.
- You pull those exact drives, in front of them, and record their serial numbers.
- Each is degaussed, and the LCD field reading is shown and recorded.
- Each is then crushed, and the crusher action is recorded.
- The register rows are signed by the operator and the custodian in the room.
- A drive that does not spin is included deliberately — demonstrating that failed media is handled identically.
5. Recommended Proton equipment by bank size
| Institution | Primary | Physical destruction | Flash | Branch kit |
|---|---|---|---|---|
| Small finance / NBFC | T-1.5 | PDS-75 | PDS-30 with SSD kit | 1100 wand + PDS-75 |
| Mid-size bank, city offices | T-1.5 | PDS-75 | PDS-88 | 1100 wand + PDS-75 |
| Large bank / data centre | T-5 or T-4 | PDS-100 with rear output slide | PDS-88 | 1100 wand + PDS-75 |
| Government / PSU servicing bank | T-4 or T-5 (NSA) | PDS-100 (NSA/CSS) | PDS-88 | 1100 wand + PDS-75 |
The T-5 is chosen where throughput dominates; the T-4 where secure-room installation without mains, or the NSA listing, is the deciding factor. Both are NSA/CSS Evaluated Products List listed.