Clause 4 · Title coverage

Symbols and abbreviated terms

The clause lists the abbreviations the draft uses. The DIS adds solid state disk and write once read many storage to the earlier list, which is a small but useful signal that removable and optical media are no longer the only carriers in view.

Citation: ISO/IEC DIS 27555, Clause 4. Held: Title and contents only.

What the draft asks of an organisation

The public contents lists clause 4 as the place where the draft's abbreviations are set out. The earlier edition lists compact disc, digital versatile disc, information technology, personally identifiable information, portable document format, secure digital, universal serial bus, with the DIS sample adding solid state disk and write once read many. The clause carries no obligation of its own. Its practical value is in the storage vocabulary: a deletion procedure that only names discs and drives will miss solid state media and write once media, and those two behave differently when a team tries to erase them.

What the public sample holds

The heading is held from the DIS contents. The abbreviation list is not in the DIS public sample; the earlier edition's list is held from its public sample, and the two new items appear in the DIS sample front matter as reported by the publisher's sample page. The full clause 4 text is not held, so this page does not state it.

What this clause covers, in our reading

Clause 4 looks trivial and is not. Every deletion procedure ends in a storage medium, and the medium decides what a defensible deletion looks like. A write once medium cannot be overwritten in place, so the procedure has to destroy it, retire it or rely on encryption with key destruction. A solid state device does not behave like a magnetic disk when a block is rewritten, because wear levelling can leave copies behind. The draft's own scope keeps mechanisms out, so clause 4 is not the place to solve that. It is the place where the shared words are fixed so that the later clauses can talk about media without ambiguity. For a reader comparing editions, the addition of the two storage terms is one of the visible signs that the revision has been touched up for current infrastructure. It does not by itself change an obligation, but it changes the checklist a team should use when it inventories where records live. A deletion framework that still lists only discs, tapes and drives is likely to have a blind spot in the laptop and data centre estate.

What to prepare

1. Inventory every storage medium in the estate, including solid state devices, write once media, removable cards and backup tapes.
2. Check the deletion procedure for a line on each medium and mark the ones it does not cover.
3. Add the new storage terms to the glossary so the procedure and the inventory use the same words.
4. Ask the infrastructure owner which media are encrypted and where the keys are held.

The evidence an auditor or regulator asks for

Tests to run

• Pick a solid state device and ask how a file on it is made unrecoverable.
• Pick a write once medium and confirm the procedure does not assume overwriting.
• Confirm the inventory and the deletion procedure use the same medium names.

What the public text does not settle

• The full clause 4 wording is not in the public sample, so the page does not state it.
• The draft keeps deletion mechanisms out of scope, so no medium-specific method is specified.

Next

• Add the two new media to the inventory and the procedure.
• Route any mechanism question to the infrastructure standard, not to this draft.

Other clauses

• Clause 1: Scope
• Clause 2: Normative references
• Clause 3: Terms and definitions