CISA and NIST guidance requires complete metadata sanitisation from both the PDF Info dictionary and the XMP stream before sharing documents containing Controlled Unclassified Information (CUI) or PII. The minimum compliant method is exiftool -all= document.pdf followed by XMP verification. For highest-assurance sanitisation, Adobe Acrobat Pro's Sanitize Document function performs a complete file rewrite meeting NSA media sanitisation standards. Printing to PDF and re-saving do not meet federal standards.
In August 2022, CISA published a joint advisory with the FBI and NSA warning that threat actors were actively exploiting document metadata to map organisational structure, identify high-value targets, and fingerprint software infrastructure. The advisory didn't make headlines. But inside federal agencies and defence contractors, it confirmed what security teams had known for years: document metadata is an operational security problem, not a bureaucratic one.
The federal guidance on this topic is distributed across several NIST Special Publications, CISA advisories, and the CMMC framework. No single document says "remove PDF metadata." Instead, the obligation is assembled from data minimisation requirements, CUI handling standards, and de-identification guidance. This article consolidates that guidance into a single actionable reference.
Section 1 — What CISA and NIST say about document metadata
CISA does not publish a standalone PDF metadata removal standard. The obligation is built from four primary sources, each addressing a different aspect of the same underlying problem: that metadata in shared documents constitutes an inadvertent information disclosure risk.
The consistent theme across all four sources is completeness. Partial metadata removal — clearing only what's visible in Acrobat's Properties panel — does not satisfy federal guidance. The XMP stream must be cleared. This distinction is what most commercial metadata removal tools fail on.
Section 2 — Which metadata fields federal guidance considers high risk
Not all metadata fields carry equal risk. Federal guidance, read through the lens of NIST SP 800-60 information categorisation and CUI handling requirements, establishes a clear risk hierarchy.
| Metadata field | Risk under federal standards | Regulatory basis | Both stores? |
|---|---|---|---|
Author | Critical — PII | NIST SP 800-188 §4, Privacy Act 1974, GDPR Art. 4(1) | Yes — Info dict + XMP dc:creator |
Manager | Critical — PII | NIST SP 800-188 §4, Privacy Act 1974 | Yes — Info dict + XMP |
Keywords | High — CUI marker risk | CUI Registry, NIST SP 800-60 Vol. 1 | Yes — Info dict + XMP dc:subject |
Company | High — org disclosure | OPSEC considerations, CISA Secure by Design | Info dict only (typically) |
Creator | Medium — software fingerprint | CISA Secure by Design, CVE exploitation risk | Yes — Info dict + XMP xmp:CreatorTool |
Producer | Medium — processing chain | CISA Secure by Design, forensic traceability | Info dict + XMP pdf:Producer |
ModDate | Medium — timeline disclosure | OPSEC, NIST SP 800-188 §4 | Yes — Info dict + XMP xmp:ModifyDate |
CreationDate | Medium — timezone / location | OPSEC, geolocation risk via UTC offset | Yes — Info dict + XMP xmp:CreateDate |
xmpMM:DocumentID | Medium — document linkage | NIST SP 800-188 §4 (re-identification) | XMP stream only |
Title / Subject | Medium — content disclosure | Context-dependent — CUI if classification present | Yes — Info dict + XMP |
The Creator and Producer fields deserve special attention beyond their medium risk rating. CISA's Secure by Design guidance specifically addresses software version disclosure as a security risk because it enables targeted exploitation. A PDF whose Creator field says "Microsoft Word 2019 (16.0.12026)" is advertising a specific software version. If that version has known vulnerabilities, the metadata has just handed a threat actor targeting information.
The timezone offset embedded in timestamp fields (format: D:20261005144822+05:45) is a less-discussed but significant risk. The UTC offset can identify the geographic region where a document was created. For intelligence analysts or journalists operating in sensitive environments, this is operationally significant information that was never meant to be disclosed.
Section 3 — Removal methods that meet CISA standards
Federal guidance does not endorse specific commercial tools. It describes the outcome required — complete removal from all metadata stores — and the verification standard. The following methods are evaluated against that outcome.
ExifTool by Phil Harvey is the only free tool that reliably strips both the Info dictionary and the XMP stream in a single operation. It is used by digital forensics professionals, CISA-aligned security teams, and law enforcement agencies as a verification tool — which means it is also the most reliable removal tool, since it addresses all the fields it can detect.
The -all= flag removes all writable metadata fields from both stores. The -overwrite_original flag eliminates the backup file. The -XMP:all= flag specifically targets the XMP stream for verification that it was cleared.
Acrobat Pro's Sanitize Document function (Tools → Redact → Sanitize Document) performs a complete PDF rewrite — the most thorough sanitisation available through a GUI tool. Unlike "Remove Hidden Information," Sanitize Document rebuilds the PDF structure from scratch, which eliminates incremental update history, removes all embedded objects, strips both metadata stores, and produces a structurally clean file.
This is the closest GUI equivalent to the NSA's sanitisation standard. Always verify with ExifTool after, as version-specific behaviour can leave residual XMP fields in some Acrobat releases.
For maximum sanitisation, combine QPDF's structural rewrite with ExifTool's metadata stripping. QPDF linearises the PDF, eliminating incremental update history and normalising the cross-reference structure. ExifTool then strips all remaining metadata fields from both stores. This two-step approach addresses every layer of the PDF that carries identifiable information.
This is the method recommended for documents that may enter legal proceedings or intelligence contexts, where chain-of-custody documentation of the sanitisation process is required.
FileIntel's PDF Metadata Remover strips all three metadata layers — Info dictionary fields, trailer dictionary entries, and the XMP stream — using pdf-lib in the browser. Files are processed locally; nothing is transmitted to any server. For compliance purposes, the browser-based approach offers an additional privacy assurance: the document never leaves the user's machine during sanitisation.
Verify the output with ExifTool after using any tool, including this one, for documents that will be submitted to federal agencies or used in legal proceedings.
Acrobat's "Remove Hidden Information" option (not Sanitize Document — a different, weaker function) clears fields visible in the Properties dialog but does not reliably remove the XMP stream. After using this function, ExifTool typically still recovers metadata from the XMP store. This function does not meet NSA sanitisation standards for "all metadata stores within the file format."
Printing a PDF to a new PDF file via a print driver does not remove metadata — it introduces new metadata from the print driver (Producer field), creates a new Author from the current user account, and generates new timestamps. The resulting file has different metadata from the original but is not sanitised. This method is specifically insufficient under NSA media sanitisation guidance which requires removal from "all metadata stores," not replacement.
The exact command sequence for full federal-standard compliance:
$ exiftool -all= -overwrite_original document.pdf
# Step 2 — For highest assurance: structural rewrite with QPDF first
$ qpdf --linearize input.pdf temp-sanitized.pdf
$ exiftool -all= -overwrite_original temp-sanitized.pdf
# Step 3 — Verify Info dictionary is cleared
$ exiftool -Author -Manager -Keywords -Creator -Producer temp-sanitized.pdf
# All lines should return empty values
# Step 4 — Verify XMP stream is cleared (critical step)
$ exiftool -XMP:all temp-sanitized.pdf
# Should return no XMP fields — if any appear, run Step 1 again
# Step 5 — Verify no incremental updates remain
$ grep -c "%%EOF" temp-sanitized.pdf
# Should return 1 — more than 1 means incremental updates exist
Check your PDF's metadata against federal standards
The Privacy Risk Score shows every field — Author, Manager, Keywords, XMP stream. Browser-only, nothing uploaded.
Section 4 — How to verify compliance
Verification is the step most organisations skip. Running a sanitisation tool and assuming it worked is not sufficient for federal compliance. NSA media sanitisation guidance explicitly requires verification that the sanitisation achieved the intended outcome.
The following verification sequence covers every metadata layer. Mark each step complete as you work through it:
For documents submitted to federal agencies under CUI handling requirements, maintain a sanitisation log including: the document filename, the sanitisation tool and version used, the date of sanitisation, the operator who performed it, and the ExifTool verification output confirming all fields were cleared. This log supports audit requirements under CMMC 2.0 Level 2 practice CA.L2-3.12.4 (assess security controls) and MP.L2-3.8.3 (sanitize or destroy information system media).
Section 5 — Limitations CISA guidance acknowledges
Federal guidance is explicit about what metadata sanitisation does not address. Understanding these limitations is essential for security professionals who need to know where the boundary of their sanitisation procedure sits.
Scanned documents. A PDF created by scanning a physical document is an image-based PDF. It has minimal metadata but the image itself may contain printer tracking dots — microscopic yellow dots embedded by colour laser printers that encode the printer's serial number and print date. ExifTool does not detect or remove these. CISA's printer security guidance (Alert TA18-106A) addresses this separately.
Embedded objects and linked data. Metadata sanitisation removes the Info dictionary and XMP stream. It does not remove embedded files, linked data sources, OLE objects, or macros that may carry separate metadata. Acrobat's Sanitize Document function addresses some of these; a full sanitisation for classified documents requires more comprehensive review.
Content-derived re-identification. NIST SP 800-188 explicitly notes that removing metadata does not prevent re-identification through document content itself — writing style, specific terminology, unique formatting choices, or rare data combinations within the body text can identify the author even with all metadata stripped. Metadata sanitisation is a necessary but not sufficient control for full anonymisation.
Digital signature invalidation. Metadata sanitisation of a digitally signed document will invalidate the digital signature, because the signature covers the document content including the metadata stores. Federal agencies should sanitise metadata before applying digital signatures, not after. If a pre-signed document requires sanitisation, a new signature must be applied after sanitisation.
Forensic residue in slack space. PDF file structure can leave residual data in areas of the file not covered by the cross-reference table. This is addressable only by a complete file rewrite (QPDF linearisation or Acrobat Sanitize Document). ExifTool alone does not perform a file rewrite and does not address forensic residue in file slack space.
The most common compliance failure in federal document sanitisation is tools that clear the Info dictionary but leave the XMP stream intact. From the Acrobat Properties panel, the document appears fully sanitised — all fields blank. Running ExifTool reveals the complete original metadata in the XMP namespace. For any document containing CUI or PII, ExifTool verification of the XMP stream is not optional.
Sanitise your PDFs before federal submission
Strips Info dictionary, trailer dictionary, and XMP stream. Free, browser-only, zero upload.
Security professionals ask
This article is an independent analysis of publicly available federal guidance for informational purposes. FileIntel is not affiliated with CISA, NIST, the NSA, or any US government agency. For official compliance determinations, consult your contracting officer, agency security office, or a qualified information security attorney. Federal requirements vary by contract, CUI category, and agency-specific policies.