Disposal of IT Assets: Review your Policy

With the introduction of new devices into the workplace this year, both BYOD and internal device upgrades, it’s a good time to take a look at your physical data management practices to ensure that old devices are being disposed of safely.

As noted in our post on establishing a Document Retention Policy, you want to be sure that papers and CDs are shredded and that old electronic devices are properly purged of data.

For end-of-life IT assets, it’s important to properly dispose of items versus simply placing them in storage or throwing them out. Devices left in storage are often unattended and are at risk for theft or loss. Throwing out devices, particularly small ones like flash drives, is not a safe data disposal practice. In addition, recycling or refurbishment and resale of devices is a more environmentally-friendly approach to IT asset disposal.

Simply deleting data files will not permanently remove the information; special software will be required. You will want to run your hard drive disk wipe and data cleaning several times to overwrite the whole disk with random data.

There are companies that specialize in data destruction, refurbishment and resale: IT asset recovery companies. If you use such a company, or do the data wipe on your own, you should ensure that a forensic analysis is done on the device to confirm the data wipe. If data was not fully erased, destruction should be an option. You should keep records of your devices and the process of data destruction for a proper IT asset audit trail.