Retiring CDs and DVDs begins with permission to dispose of the information, followed by a method suited to the medium and its sensitivity. A household disc and an organization’s regulated records may need different assurance. Choose the requirement first, then the equipment or service, and keep the media controlled until the result has been accepted.
Match the method to optical media
NIST SP 800-88 Revision 2, published in September 2025 frames sanitization around the information, media, intended disposition and assurance needed. It distinguishes clear, purge and destroy methods. Technology-specific techniques and the organization’s requirements determine which method is suitable; a shredder’s throughput alone says little about the confidentiality outcome.
Pressed and write-once CDs and DVDs cannot be treated like a rewritable magnetic drive. Deleting a directory entry or making a disc unreadable in your own player does not demonstrate that its recorded content has been sanitized. A rewritable disc also needs an approved media-specific process; an “erase” button by itself is not a validation record.
| Question | Evidence to request | Why it matters |
|---|---|---|
| Does the equipment accept this medium? | Exact-model instructions for CDs/DVDs and operating limits. | Paper capacity is not an optical-media rating. |
| What output meets our requirement? | Applicable policy or standard and documented equipment/process capability. | A generic “secure” label or old particle size claim is insufficient. |
| Who controls the media before destruction? | Collection, transport, storage and access arrangements. | A good final method cannot undo an earlier custody gap. |
| How are exceptions and outcomes recorded? | Batch references, failed items, verification and acceptance records. | A collection receipt alone does not establish successful sanitization. |
Choose equipment or a service deliberately
For occasional household discs, compare an exact model’s optical-media support and instructions or use an appropriate destruction service. For organizational material, have the responsible security and records owners approve the method and assurance requirements. Higher-sensitivity or contract-controlled media may require a particular process or provider capability.
Follow the manufacturer’s feed limits, duty cycle, waste handling and safety instructions. Keep hands away from the feed mechanism and use the intended guarded process. Do not burn, microwave or improvise cutting discs. Check the service’s rules before sending media; ordinary recycling collection should not be assumed to provide confidential destruction.
If a vendor promises compliance, ask which requirement, revision, media category and process it means. Identify subcontracting and transport arrangements. The decision should cover the whole journey from your inventory to the accepted result, including what happens if equipment fails.
Record the result and decide whether it is sufficient
NIST separates verification of the operation’s outcome from validation of whether the sanitization was effective for the data and its sensitivity. Its revision 2 example notes that a shredder can operate successfully while producing pieces larger than the organization accepts. An operator’s “completed” entry and the owner’s acceptance decision are different records.
Record the authorized batch, dates, operator or provider, method, equipment or process reference, verification result, exceptions and acceptance decision. Retain the relevant service certificate with those records. Treat the downloadable checklist as an internal aid; it does not certify compliance. Arrange recycling or waste disposal for the resulting material through an appropriate service after sanitization is accepted.