Sacombank Streamlines PCI DSS Compliance
Across Drives, Data Centers and ATMs
Highlights
Sacombank implemented Blancco
secure erasure solutions to:• Unify secure erasure processes
across PCs, mobile devices,servers, storage devices
and virtual machines• Securely bulk-erase large numbersof loose hard drives from ATMs
• Comply with State Bankof Vietnam regulations toprotect customer data
• Provide reporting andcertification of completed secure
erasure for audit purposes

Regulatory compliance is always front-of-mind
for IT organizations within financial institutions.
Protecting sensitive data across its lifecycle, including
verifiable, secure erasure at the time of data disposal,
is a critical part of fulfilling this obligation.
Sacombank, a large bank in Vietnam, implemented abroad range of Blancco data erasure solutions to meet thedemands of strict data protection requirements, including
directives from Vietnamese national banking authorities.
Challenge
The banking, financial services and insurance (BFSI) segment includes
some of the most highly regulated industries in the world. Processing vast
amounts of highly sensitive personal and corporate financial data means data
breaches carry an exceptionally high risk of harm to these organizations andtheir customers. Consequently, regulatory non-compliance can mean stiff
financial penalties and other consequences.
In Vietnam, both the global Payment Card Industry Data Security Standard(PCI DSS) and State Bank of Vietnam Circular 18, 2018, mandate secure
erasure of data storage assets and end-of-life data (such as no-longerneeded card holder information). This guards against the unauthorizedaccess of corporate and personal financial and credit information. Data
destruction must be certified with digitally signed reports to support audit
requirements and provide assurance of complete data protection.
To meet its data protection obligations, Sacombank relied for years on
physically destroying decommissioned drives and other storage media. Whileeffective, the process was costly, time-consuming and lacked a centralized
view of sanitization activity. Also, Sacombank needed an end-of-life solution
for both IT assets and data. Because data often needs to be eliminated at adifferent time than the physical media it dwells on, physical destruction often
doesn’t apply.
For strict yet cost-effective regulatory compliance, the bank also neededa streamlined, centralized way to perform and track data erasure across arange of devices, from laptops to virtual machines to ATMs.

Solution
Sacombank is one of the first commercial banks established in Ho Chi Minh
City and is among the leading joint stock banks in Vietnam. Sacombank
leadership wanted to streamline its sanitization processes, reduce costs
and help its staff continue to meet or exceed its regulatory and audit
requirements.
Erasing End-of-Life Data Throughout a Financial Services Institution
Like all large financial institutions, Sacombank processes and stores data
across a wide variety of hardware, including mobile devices, PCs and laptops,
data center equipment and loose drives from the bank’s fleet of ATMs. Thisdata could be stored in active environments or on to-be-decommissioned IT
assets. It could also live in physical, logical or virtual network storage. To meeterasure requirements in a consistent way, Sacombank turned to Blancco data
erasure solutions.
Blancco’s enterprise-level products work together to provide verified data
sanitization according to globally recognized standards. They also provide
efficient workflows and centrally stored, tamper-proof audit reports.
To ensure regulatory compliance when disposing of its end-of-life financial
services data, Sacombank used:
••
•
•
••

•

Blancco Drive Eraser for solid-state drives (SSDs) and hard disk drives(HDDs) installed in computing devices
Blancco File Eraser for individual files and folders within a file system
Blancco Removable Media Eraser for media such as USB drives, SDcards and flash drives
Blancco LUN Eraser for Logical Unit Numbers (LUNs) in enterprisestorage

Blancco Virtual Machine Eraser for virtual machines and hypervisors
Blancco Network Device Eraser for network switches and routers

Blancco Management Console to access, monitor and oversee licenses,
erasures and certificates

Blancco provides a full-suite solution for all data
erasure needs of the bank and helps us be fullycompliant with requirements from PCI DSS and Circular
18 of the State Bank on data erasure.”– Sacombank IT Manager© Blancco Technology Group. 2021. All rights reserved. rev 2021.04

A Special Case: Erasing ATM DataIn addition, for its ATMs, Sacombank required an efficient way of securely
erasing large numbers of loose magnetic drives at once. After being
physically uninstalled, the drives are transported securely by armored truck
to the bank’s data center, where an IT technician loads them into a Blancco
8-Bay Drive Eraser, an industrial grade server solution built to support abroad range of hard drives, including NVMe, SAS, SATA, M.2 and U.2 SSDs, x4
PCIe, Fiber Channel and SCSI. After the appliance erases the drives according
to a Sacombank-selected sanitization standard, the system generates andstores a digitally signed report to certify successful data erasure.
Data Sanitization Reporting and Auditability
Blancco enterprise solutions and the Blancco 8-Bay Drive Eraser integrate
directly with Blancco Management Console. This centralized point of control
includes automation capabilities that optimize efficiency. With the additional
benefit of providing an “auditor view” of erasure certificates, Sacombank’s
on-prem installation of Blancco Management Console centralizes reportingand erasure management and complies with Circular 18 requirements forreporting and auditability.

Results
Blancco solutions provide secure erasure across Sacombank operations,including endpoint computing and mobile devices, data center equipment
and loose ATM drives. This comprehensive, strategic approach makes it easy
for Sacombank to use recognized data erasure standards that help themcomply with PCI DSS and State Bank of Vietnam Circular 18 requirements.
Blancco’s centrally stored tamper-proof reports also allow the bank todemonstrate full compliance with regulatory requirements for secure erasure
when bank examiners conduct an audit.
“Blancco helps us in securely erasing all IT equipment in a secure andauditable way,” said Sacombank’s IT manager. “By securely erasing data atend-of-life, we can assure our end clients that we take care of their data withhigh priority till the very end of the data lifecycle and that we are compliant
with all regulations.”

For a free trial of Blancco enterprise solutions for your BFSI
organization, visit blancco.com/demo/free-trial-requestenterprise/.

© Blancco Technology Group. 2021. All rights reserved. rev 2021.04

About Sacombank
Formally named “Saigon Thuong Tin Commercial Joint Stock Bank,”
Sacombank is a retail bank headquartered in Ho Chi Minh City, Vietnam, thatoperates 570 branches in Vietnam, Cambodia and Laos. In 1991, Sacombank
became the first commercial joint stock bank to be established in Ho Chi Minh
City, and two years later, it opened the first branch in Hanoi. Sacombank wasalso the first Commercial Joint Stock Bank of Vietnam to be listed on Ho Chi
Minh City Stock Exchange, in 2006; it has the stock code “STB.”
During its three-decade history, Sacombank has developed its presence inrural areas, bringing the first access to financial funds for these communities.
The bank has also worked to diversify its financial services and products tobe more comprehensive, meeting the changing needs of customers.

About Blancco
Blancco is the industry standard in data erasure and mobile device
diagnostics software. Our data erasure software provides thousands oforganizations the tools they need to enable sustainable data sanitization
processes across the widest array of IT assets. By focusing on erasing andreusing assets instead of physically destroying them, organizations canimprove their security posture and address corporate social responsibility
requirements, while also ensuring compliance with local and global data
privacy requirements.
Blancco data erasure solutions have been tested, certified, approved andrecommended by 15+ governing bodies and leading organizations aroundthe world. No other data erasure software can boast this level of compliancewith the rigorous requirements set by government agencies, legal authorities
and independent testing laboratories. All Blancco erasures are verified andcertified, resulting in a tamper-proof audit trail.
For more information on what Blancco can do for your enterprise,contact us today.

© Blancco Technology Group. 2021. All rights reserved. rev 2021.04