R2v3 Formal Interpretation #1, Data Sanitization was developed, approved, and released by the R2 TAC (Technical Advisory Committee) in November 2022. The Formal Interpretation maintains the rigor in R2v3 of overwriting data with software wherever possible, while recognizing the limitation that some subset of devices only has a factory reset option provided by the manufacturer. Note, the factory reset is only allowed where no sanitization software currently exists for the device type. To maintain the quality controls of R2 Certification for Logical Sanitization, this interpretation would allow R2 Facilities to build manufacturers’ factory reset instructions into software and track records of the successful output of the factory reset within the software.

The following Navigation Tool is meant to provide guidance for how R2 stakeholders can think about applying this formal interpretation in a practical sense. The Formal Interpretation is intended to provide a broader definition of “software” to allow for a wider range of solutions under Appendix B, Logical Sanitization.

Questions to ask when considering applying Formal Interpretation #1:

1. Does your facility receive any data devices for which no data sanitization software is currently available? If not, Formal Interpretation #1 does not apply to your situation.
2. Is your facility Certified to Appendix B? If not, then utilize qualified downstream partners to process the devices properly.
3. If your facility is Certified to Appendix B, consider the following paths to fulfilling the requirements for Logical Sanitization:

a.  Can your existing logical sanitization software support this solution?

b.  Can you utilize or customize ERP software?

c.  Do you have the internal capabilities to create a custom software solution in-house?

d.  Is there other existing industry software that meets the requirements?  Click Here for Sanitization Software Examples

The following flow-chart is a visual representation of this logic.