I heard from an outside source that there was going to be a requirement on how small the shredding of documents will have to be. Does anyone have any information on this topic. I am not comfortable with the size of the shredding at my bank. I am doing an information security and IT audit and noticed how easily a shredded document could be put together. And, is there a requirement on how the shredding should be disposed of?
Thanks for any help on this.

Post deleted by gigi2

The are no requirements at a Federal level of which I am aware - nor any proposals.

Thanks

We use an outside company who comes to our branches and shreds everything on-site. They are NAID certified and guarantee the size of the cross-cut shred to be no larger than 3/4 inch wide x 2.5 inches long.

"3/4 inch wide x 2.5 inches long"

While there are no regulations, IMHO, that is a huge shred size. It would easily give names and account numbers or both from a print-out.

Does someone from your bank accompany the shredding company the entire time that they remove the paper from the building and put into the shredding truck?

I am not familiar with specific requirements on shred size - I think most guidance is more general and uses the phrase "ensure the media is rendered unreadable and unlikely to be reconstructed."

Regarding third-part disposal firms - one thing to consider in the contract is does the vendor have adequate employee background checks, controls, and experience.

... and adequately bonded!

good addition - thanks!

No, we do not accompany the shred people. The truck is parked in plain sight of our operations center as well as our banking facilities, therefore the shred employees can be watched without it being so obvious. Additionally, the shred employees go through a background check and drug testing.

What I said was that they guarantee the shred TO BE NO LARGER than 3/4 x 2-1/2 (as required for NAID certification). Though I haven't taken a ruler and measured the size, it is in fact much smaller than their guarantee.

Our policy is that an employee will watch the shred process. I understand that the shred company can also provide us with a video of the visit.