How Physical Destruction of IT Assets Can Leave Government Data Vulnerable

As with many business types, government entities deal with different levels of data, and even different levels of confidentiality.  In some cases, data is perfectly harmless, but even if it doesn’t rise to the level of national security or consumer privacy, you don’t necessarily want it falling into the wrong hands.

This is why government entities and South Dakota businesses handling government data need to be very careful when it comes to data destruction, and specifically, the destruction of IT assets.  While you can certainly adopt a DIY approach, it’s best to treat government data with the highest level of care, and this includes professional help from a certified ITAD service provider.  Here are just a few common mistakes to avoid when destroying IT assets containing government data.

Insufficient Destruction Policies and Procedures

The digital era is still in relative infancy, despite the fact that we’ve wholeheartedly embraced the advantages of computer, internet, and mobile technologies.  The unfortunate downside of rushing into digital business practices is that we’ve failed to account for all of the ways in which criminals can exploit it, and we’re still catching up.

When you upgrade to new equipment and devices and get rid of old ones, you know you need to destroy the sensitive data they contain, in keeping with consumer privacy laws and any applicable regulations.  However, you may not have policies and procedures in place to deal with this.  As a result, old and outdated devices could languish on-site for an interminable amount of time, posing a risk for theft (both internal and external).

Just as you engage in life-cycle planning for IT assets, you need to have an end-of-life-cycle plan that includes a timeline for destruction, as well as clear directives for how to secure inventory until destruction.

Improper Storage

Without clear policies and procedures in place concerning how to deal with unused IT assets, they could end up sitting on desks, in drawers, in storage closets, or in other areas where they are forgotten and unaccounted for.  This is like an invitation for unscrupulous employees or visitors to your business to walk away with them…and the confidential data they contain.

At the very least, you need to create a system by which equipment and devices are tracked and inventory is returned to secure storage when it is no longer in use.  This can be managed by an IT professional or team, a facilities manager, or another person or group, but inventory tracking and management is essential.  In truth, you should also have measures in place to take control of devices and remotely wipe them if they are lost or stolen.

Destruction by Uncertified Vendors

The best way to ensure physical destruction of IT assets containing government data, in compliance with all applicable laws and regulations, is to partner with a certified ITAD service provider that supplies your office with locking bins for device collection, visits your location on a schedule to collect devices, and shreds them on site while you watch, providing Certificates of Destruction and Recycling as proof for your records.  Of course, this means doing your homework.

Even when you work with a vendor that offers ITAD services, you still have to make sure the vendor you choose offers the expected level of service.  This means finding an ITAD partner that holds certification with entities like R2, e-Stewards, and more, and that fully vets downstream partners to ensure compliance.

If your South Dakota business is seeking a certified ITAD service provider for destruction of IT assets containing government data, contact the qualified professionals at SEAM today at 605-274-7326 (SEAM) or online to request a quote.