score-column1 " >

When disposing of IT assets, how far does an organization have to go? How can you be sure that a particular asset has been securely and safely recycled, remarketed or destroyed? This article offers key questions to consider when vetting an outside provider for the task of IT asset disposal.

Decommission. Retire. Deactivate. Whichever term you use, eventually IT hardware reaches an end. At that point, secure IT asset disposal (ITAD) becomes the last step in an organization's own IT asset management (ITAM) lifecycle. Once an IT asset is successfully brought offline, however, the organization must determine how far they should go to ensure that the asset's data has been securely erased or that the asset has been properly recycled, resold or otherwise destroyed. How far is far enough to ensure secure, efficient asset disposal? Unfortunately, accounts of public missteps suggest that greater vigilance and due diligence are still needed in this area.

        
did you know?
            Did you know that the two dominant methods of recycling used electronic products are shredding and demanufacturing?

        
fast fact:
            In 2014, U.S. citizens threw away 16 billion pounds of hard drives, transistors and circuit boards.

The End of the Line, but Not the End of Responsibility

Computers, servers and office equipment comprise part of an organization's ongoing asset inventory. Such assets, along with their associated data sets, are often tracked by systems and processes such as the IT Infrastructure Library's (ITIL) change management database systems (CMDBs), and software associated with both ITAM and data lifecycle management (DLM). These assets are also tracked via specific ITIL processes associated with change management and service management.

Using these methodologies and processes, however, typically means that organizations are more focused on managing data, hardware and systems that are still in operation versus hardware and systems that are being subsequently retired.

Yet, according to an HP report on inventory, configuration and IT asset management, the latter involves "processes that manage each asset through its complete lifecycle." For each asset, a complete lifecycle means "a beginning (procurement), a middle (moves, adds, changes) and an end (retirement)." At the end of a lifecycle, such as when decommissioning servers, many organizations document the specific process that should be followed, from notifications, project plans, schedules and sign-offs, down to the scrubbing of hard drives and the cancellation of associated equipment leases and software licenses. For example, the University of Nebraska-Lincoln follows its own detailed server decommissioning process. The end of the university's process involves removal and reallocation of hardware. This includes steps such as asset tag paperwork, returning leased hardware and sending hard drives to another team for disposal.

Since retirement of an asset often involves disposal of that asset, an organization's responsibility for that asset should extend until the organization is reassured that the asset has been securely recycled, resold or otherwise destroyed. However, the team responsible for due diligence when it comes to secure asset disposal varies from one organization to the next.

Proving Secure Disposal of IT Assets

Regardless of which team is responsible, ensuring and proving secure disposal of an organization's IT assets often involves vetting external providers of these services. Which criteria or questions can help you feel confident in the ultimate success of your asset disposal efforts? One place to look for inspiration is government organizations. These tend to offer guidance regarding proper disposal of IT assets for their own departments.

An example of this is the U.S. Environmental Protection Agency (EPA), which offers several checklists and criteria for selecting or reviewing the services of an external electronics recycler. Based on these and other sources, key areas emerge for consideration when outsourcing this function to an external provider. These include:

Third-Party Certifications and Designations

One thing the EPA stresses is the importance of third-party certifications for an electronics recycler, such as an R2 or e-Stewards certification. If a federal agency uses a recycler with either of these designations, the EPA indicates that the agency does not "need to perform additional due diligence to ensure compliance." That's likely because such certifications already require the recycler to meet stringent requirements set forth by the certifying body.

A service provider's compliance with other national or international regulations and standards can also demonstrate the provider's own levels of due diligence and responsible management regarding data erasure, degaussing or the secure disposition of e-waste. This might involve certifications with international standards bodies, such as ISO 14001, PCI Level 1, Systrust (SOC 3 Report) or the EU WEEE directive regarding e-waste.

Secure IT Asset Disposition: Yes, It's All About the Money

IT execs who worry about the cost of proper IT asset disposition should consider the cost of a data breach or waste-management violation. Here's how to weigh the options.

Certificates

Believe it or not, asking about certificates is different from asking about certifications. Asset disposal service providers and recyclers with secure chains of custody often include certificates of recycling or certificates of disposal as documented proof that an organization's IT assets were properly disposed of or recycled.

Organizations wanting to know the details of this process should ask whether the process leading up to the release of the certificate has been audited by an external party, and whether or not the provider's process is proven legally defensible.

The Use of Downstream Providers

Many third-party designations cover this area, but it never hurts to ask about who else may have access to the organization's assets once they are in the hands of the service provider. Many providers rely on partners somewhere in the chain: transportation, recycling, demanufacturing, remarketing or other types of disposition. Who do they use and when? How do they ensure that secure chain-of-custody processes are being used and that employees or contractors handling the assets have been properly vetted?

Properly Erasing or Scrubbing the Data Contained on an Asset

Various methods are used to "clean" hard drives and other systems containing potentially sensitive company and customer data. Find out which methods are used by the provider, as some are more stringent and more recommended than others. For highly sensitive data, ask whether or not the provider can erase, degausse or destroy items such as hard drives either onsite or offsite.

In order to remain compliant, you must follow the necessary procedures for asset disposal. For help, choose a third-party vendor you trust. Read the guide for help with your decision.

业务挑战

行业

数字服务

亚博电玩安全仓储及物流

云存储与迁移

资源

IT资产处置:保护资产应该走多远?

现在就获得免费报价

相关资源