Do You Know Where Your Retired IT Equipment Goes?

When a company gets rid of old computers, servers, hard drives or other technology, it’s easy to think the job is finished once everything is loaded onto a truck. For an IT or compliance team, that’s really just the point where a different part of the process begins.

If those assets contained company, employee or customer information, there should be a clear record of where they went, who handled them, how the data was sanitized and what ultimately happened to the equipment. That’s the basic idea behind chain of custody, and it’s becoming an increasingly important part of managing retired technology.

What Does Chain of Custody Actually Mean?

Chain of custody sounds like one of those terms that belongs in a compliance manual, but the concept is pretty straightforward.

Your organization should be able to follow an asset from the time it leaves your control until the data has been properly sanitized or destroyed and the equipment reaches its appropriate next destination.

That means the process isn’t just about what happens to a hard drive at the end. Transportation, storage, employee access, data sanitization, remarketing, recycling and downstream processing can all be part of the picture.

If an asset contains information your organization has a responsibility to protect, knowing who has control of that asset throughout the process matters.

Data Destruction Is a Process, Not Just an Action

The updated NIST Special Publication 800-88 Revision 2 provides guidance for organizations developing media sanitization programs.

One of the useful takeaways from the updated guidance is that sanitization should be part of a larger organizational process. The appropriate method depends on the media, the sensitivity of the information and what will happen to the equipment afterward.

For example, equipment that can be securely sanitized and reused may not need to be physically destroyed. Other media may require destruction based on the technology, condition or security requirements involved.

What’s important is having a defined process, verifying that it was completed and keeping the documentation to support it.

Certification Helps Verify the Process

There are a lot of places that will take old electronics, which can make IT asset disposition (ITAD) providers look fairly similar from the outside. Third-party certification helps provide some distinction because an independent organization is evaluating whether specific processes and controls are actually in place.

The U.S. Environmental Protection Agency recommends certified electronics recyclers for businesses, governments and other large organizations and recognizes R2 and e-Stewards as the two accredited electronics recycling certification standards in the United States.

Standards such as e-Stewards and R2 also include requirements related to data security and downstream due diligence. That’s important because responsible electronics management doesn’t necessarily end with the first company that receives the equipment. Materials and components can move through additional processors, and there should be controls around where those materials are going and how those partners are evaluated.

Documentation Should Be Easy to Produce

A good IT asset disposition program should leave your organization with more than an empty storage room.

You should have records showing what was collected and what happened to it. Depending on the project, that might include serialized asset reporting, chain-of-custody documentation, data sanitization records, Certificates of Destruction or Recycling, and information about equipment that was remarketed.

For businesses subject to regulatory or contractual requirements, those records can be especially important. For example, the Federal Trade Commission’s Disposal Rule requires businesses covered by the rule to take appropriate measures when disposing of consumer report information.

Even when a particular regulation doesn’t apply, good documentation makes it much easier to answer questions from customers, auditors, leadership or your own security team.

Instead of relying on the assumption that everything was handled correctly, you have a record showing that it was.

Know What You’re Getting From Your ITAD Provider

When evaluating an IT asset disposition provider, price and convenience are obviously part of the conversation, but there are a few other things worth understanding.

Find out how your equipment will be transported and tracked, how data sanitization is performed and verified, what happens to reusable equipment, how downstream processors are evaluated and what reporting you’ll receive when the project is finished. It’s also worth understanding which certifications the provider holds and what those certifications actually cover.

You don’t need to become an expert in electronics recycling to ask good questions. Your ITAD provider should be able to explain the process in a way that makes sense and provide the documentation to back it up.

SEAM helps organizations throughout South Dakota and the surrounding region securely manage retired IT assets with documented chain of custody, data destruction, remarketing and responsible electronics recycling. If you’d like to take a closer look at how your business is currently handling retired technology, we’re always happy to talk through the process and help you figure out what makes sense for your organization.