Comment: Apply the rules! (Score 1) 209
Hi
You don't specify which government, but let's assume it's one with an comprehensive information assurance policy.
First things first. Find out who the technical authority for information assurance is in your country.
Then find out what the official policy on erasing and destroying information assets are. This information may not be published, and you may need to be registered with the technical authority to access it.
Then cross reference against the terms of the contract.
Then do.
To help you a little, most best practice policies describe a range of methods. The selection of which method depends on
* the device used to hold the data - HDD, flash memory (multiple technologies), DRAM, etc
* the classification / protective marking of the data (SECRET, TOP SECRET etc)
* whether the device is being re-used (for new data) within the same secure facility where it was held originally, or is it being removed from that facility (for destruction)
Removal methods vary from using certified data erasure products, to complete physical destruction via a specified and approved method. In any case, there will be a detailed procedure to follow, possibly also independent witnessing and certification of the destruction.
In any case, there will be an explicit process to follow, as well as copious paperwork.
Note the use of the phrase 'certified...products'. While tools such as DBAN may be effective, they are not approved and certified by your national technical authority for information assurance. Using a non-certified product is equivalent to using nothing, and there may be penalties if you claim to have followed the set process, but used such non approved tools.
Your organisation should have an information security officer (or similar executive) who is responsible for this. Normally it is a pre-requisite to have such a professional as a pre-requisite to handling classified / protectively marked material in most countries.
What you've discovered should really have been caught pre-contract signing, by your legal and/or commercial people. You need to talk to your bosses about this. Oversights such as this can destroy a business, both in terms of money and reputation.
HTH
g