Verizon’s annual report on 2024 data breaches is out. While 15% were due to breaches of a third party, such as a host’s infrastructure, 68% were due to human error. Social engineering attacks were common, but failure to follow protocol to dispose of unwanted or broken IT assets securely was also a problem
If your company still isn’t sure exactly how to recycle or sell your unwanted IT assets, it’s time to put a checklist into action. You don’t want to make the same costly mistakes others have made as those mistakes lead to massive fines and damage to your company’s reputation. Here are the key steps in a compliance checklist:
- Know the applicable regulations and compliance standards.
- Take an inventory of your assets being decommissioned or recycled.
- Make sure all data is sanitized.
- Choose a responsible ITAD vendor.
- Track your electronics’ progress.
- Keep all records.
- Monitor and adjust your IT asset disposal measures.
Understand the Key Regulations and Compliance Standards Businesses Need to Follow
Every industry has regulations and compliance standards that must be adhered to. If you don’t know what rules apply to your company, you need to investigate it. Generally, the National Institute of Standards and Technology (NIST) 800-12 is a good place to start when building an IT security framework. The main idea with NIST is that you’re placing security protections that match the risk a data breach would create. For some companies, the risk is low, while it’s high for others.
Beyond that, there are regulations like CCPA, eStewards, GDPR, GLBA, HIPAA, ISO 27001, and R2 to consider.
- CCPA (California Consumer Privacy Act) – California enacted laws to allow consumers to control exactly what information is collected by businesses and what they can do to protect themselves. This act applies to any business that shares or sells consumer information.
- eStewards – ITAD providers should be eStewards certified to ensure your electronics are recycled using the utmost attention to data security from the moment it is picked up by an ITAD provider, even if third-party vendors help with the process. An eStewards-certified processor ensures all employees and vendors pass background checks and will ensure the security of all devices containing data.
- GDPR (General Data Protection Regulation) – In 2018, Europe enacted rules to ensure consumers control how their personal information is used. Any business that collects data from people in the European Union must comply with GDPR laws.
- GLBA (Gramm-Leach-Billey Act) – A rule banks and financial institutions must follow to ensure any non-public personal information (NPII) is destroyed before electronics or paperwork are recycled, refurbished, or resold.
- HIPAA (Health Insurance Portability and Accountability Act) – HIPAA went into effect in 1996. It’s a rule that all doctors, medical practices, hospitals, and anyone in a medical setting must follow to ensure patient privacy and data security.
- ISO 27001 – The International Organization for Standardization set a worldwide guideline for information security. ITAD providers who hold this certification follow specific criteria to protect data from breaches, hacks, cybersecurity events, etc. It covers managing risk and continually analyzing and testing systems to ensure they’re as strong as possible.
- R2 – Seri’s R2 sets a global guideline for recycling electronics following a process of Test, Repair, Reuse, Recycle. Businesses that have electronics they no longer want or need should choose an ITAD provider with this certification.
We mentioned NIST 800-12 earlier. Another to keep in mind is NIST SP 800-88. This is especially important as it focuses on media sanitization. These guidelines are specific to how to destroy data in electronic devices and cloud-based architecture. If you store files in the cloud, both you and the cloud service provider must do your part to keep data secure. You need to have a plan for destroying data when it’s no longer needed.
Inventory Your Assets and Set Up Tracking
Now that you have a better understanding of what rules you need to follow, it’s time to take an inventory of the assets you need to dispose of. Include everything in your inventory. Make sure all hardware like external hard drives, printers, tablets, laptops, desktops, etc. are included. Software and peripherals also need to be on your list and tagged to ensure you’ve entered them in your spreadsheet. Record:
- Item name and manufacturer
- Model and serial number
- Date it left your place of business or storage area
- The data destruction method used
- ITAD company you selected
If they still have any value, you want to get the most money possible as you recycle them. Even if they’re no longer working, they may have parts that could be used to repair other devices. Make sure you choose an ITAD provider that helps you generate revenue that offsets the cost of ITAD services.
Look for a company that offers to pick up and destroy data right at your place of business. It’s one of the most secure options there is. You also want to verify that they offer real-time tracking so that you can track exactly where your assets are and what steps they’re undergoing. Until data is destroyed, assets are recycled, and you have a certificate to prove it, you need to keep track of their location.
Ensure Data Sanitization and Erasure
Data destruction or sanitization is an essential part of an ITAD process. The method used depends on the item and regulations you must follow. A good rule of thumb is that physical destruction guarantees the destruction of data. Other options include:
- Data Wiping – Software rewrites data stored on hard drives over and over until it is impossible to recover. A factory reset isn’t good enough. At a bare minimum, you need to use software that wipes data.
- Degaussing – This method only works on magnetic media like disc drives. A high-power magnet is used to demagnetize the device. Most modern electronic devices have moved away from magnetic media, however.
Choose a Responsible, Reputable ITAD Vendor
You must choose a reputable ITAD vendor that has a minimum of e-Stewards and R2 certifications. Those are just a start. It’s also worthwhile to look for a vendor who also holds ISO 14001 and NAID. Because these certifications are maintained through unscheduled, surprise inspections, you know you’re choosing a responsible, ethical, reputable vendor.
Track the Data Destruction and Recycling Process
If you’ve chosen to have electronic assets picked up at your location, verify how you can track the progress in real time. If you’re shipping them, make sure you have the tracking information from the moment the transportation company picks up your boxes. If you’re not offered real-time tracking, look for a different vendor.
You also want a company that allows you to track when they reach the facility, when and how the data is destroyed, and when the items go into shredders. Some companies, such as a military office might want the opportunity to enter the secure facility and watch the items go into shredders. Partner with a vendor that allows that.
Once the items are destroyed, get the certificate of destruction. You need this paperwork to prove you did everything correctly. If there ever is a data breach, you have proof you were not to blame.
Keep Records in a Safe Location
All records of data destruction, including your inventoried list of items being sent for recycling, have to be stored for as long as is required. You might want to store a copy in a secure cloud server and store hard copies in a fireproof safe as a backup
Continually Monitor Asset Disposal and Make Improvements as Needed
It doesn’t stop there. Keep auditing your ITAD checklist and make sure it still meets legal requirements and your company’s needs. If there are weaknesses, make improvements. Laws and regulations change regularly, so your security framework needs to keep up with these changes.
As you make changes, make sure your employees are kept updated. Add training programs to verify they know and understand what they need to do after updating practices.
Start With a Strong IT Team
You want to have a strong IT team in place that works with management, owners, and stakeholders to create a guide for all employees to follow. If you have a plan laid out on what steps employees need to follow, it will help a lot.
While our checklist gets you started, you do need to customize it to fit your exact industry. A hospital’s ITAD procedures will differ from that of a retailer. A government agency has different needs than a manufacturing facility. Make sure you research the compliance requirements for your business and use them to build your ITAD plan.
