“Verify” versus “Validate”

Q.   Do “Validate” and “Verify” mean the same thing in R2v3?

In R2v3, these terms each pertain to different actions and R2 requirements.

VALIDATE   —  Core Requirement 7-Data Security, requires validation of a facility’s data sanitization processes:

Core 7 (c)(3)  Internal data security and sanitization audits shall be performed at minimum annually by a competent and independent auditor to validate the data sanitization processes are effective and conforming to the R2 Standard, legal requirements, and the data sanitization plan.

This validation requirement focuses on the process itself.  For example, does the facility’s data sanitization process conform to R2 requirements?   Does the process conform to applicable legal requirements?  Does the process conform to the facility’s own Data Sanitization Plan?  Was the process designed to address all the related requirements and was it performed as planned, in accordance with the defined procedures?

VERIFY  —  In addition to validating the process, facilities must also verify the outcomes and effectiveness of the data sanitization process(es):

Core 7 (c)(2)(B)   Physically destroy the data storage media in accordance with an applicable method defined in Appendix A of the NIST Guidelines for Media Sanitization: Special Publication 800-88 (rev.1), and verify destruction in accordance with a defined process to demonstrate 100% effectiveness of the destruction process,

Appendix B (1)(b)  Documented quality controls to assess and verify the effectiveness of the data sanitization processes on an ongoing basis

These verification requirements focus on effective outcomes.  For example, was the process successful and was all data removed from devices as intended?  Did the process result in the intended outcome?

Both of these steps – validation and verification – work together to ensure that data is successfully sanitized, or where sanitization cannot be confirmed, that the data storage devices are physically destroyed.