ITS Technical Procedure: Electronic Data Removal
1. Hard drives permanently leaving Albright College:
- Hard drives will be wiped to the DOD 7 pass data wipe standard.
- After the drive is wiped using DOD 7 pass, the serial number will be recorded in the Computer and HD Retirement Records and the drive will be stored in the IT Services server room until picked up for recycling.
- In cases where the hard drive has not been removed from a case, the serial number of the device containing the hard drive will be recorded in the Computer and HD Retirement Records.
- Hard drives that cannot be wiped using the DOD 7 pass data wipe standard due to hardware malfunction will be labeled for permanent destruction and will be stored in the secure cabinet in the setup room until they can be given to a hard drive destruction company to be physically destroyed.
- The hard drive destruction company will provide documented proof of the serial numbers of the hard drives picked up and the method used for hard drive destruction.
Exception: Occasionally Albright donates outdated computers to outside organizations. Under these conditions hard drives that have been wiped to the DOD 7 Pass standard, can be reinserted into a computer for donation rather than being recycled.
2. Electronic devices or media being transferred within Albright College (between departments or employees having different software and data access privileges) must have their data removed.
- The hard drive will have its data wiped to the DOD 7 pass data wipe standard before the computer is reimaged and redistributed for use.
- Tablets and Cell phones will have their data removed using either a vendor supplied data removal tool or a third party data removal application.
3. Disposal of electronic media other than hard drives
- Smartphones and Tablets will have their serial numbers recorded in the Computer and HD Retirement Records.
- Items such as magnetic tapes, diskettes, CDs, DVDs and USB storage devices, tablets, cell phones must be physically destroyed by degaussing, shredding or smashing, so that the data-containing component is unreadable, before the item is disposed of via trash or recycling.
Exception: If a vendor includes a reliable, secure method for removing all data from a device, that procedure can be used instead of physical destruction.
Note: Any electronic device or media received by IT Services for retirement, redistribution, or destruction which has not had its data securely wiped using an approved method must be stored in a secure location. Computers with hard drives still within them and other large objects that contain storage media will be stored in the server room. Hard drives and small devices that contain storage media will be stored in a secure cabinet in the setup room. Any request for exceptions to this procedure should go to the Albright College CTO.
APPROVALS AND REVISIONS
Approved by Chief Technology Officer, June 6, 2012
For a printable copy of this procedure, click here.