Simply believing data has been erased from retired equipment at some point is not enough to give IT managers peace of mind. Where is the equipment stored prior to erasure and where does it go after? With equipment coming and going and being processed through various stages of disposition, it can be difficult to control the flow of equipment and monitor the location of each piece of equipment at any given time.
What happens to an IT asset from the moment the user relinquishes it until your IT asset disposition partner picks it up? Was it left in an open area? Was it shipped by UPS or FedEx back to the main office (hint: not the most secure process). Where is the equipment stored prior to erasure, and who has access? How long is the equipment stored with data on it?
During the data-erasure process, what if the staff member performing the erasure is called away to a different task, leaving behind a stack of un-sanitized laptops, which are moved on to the next step by a different staff member without confirming their erasure status?
Without a documented process that includes data security, you risk letting equipment containing sensitive data slip through the cracks during the retirement or redeployment process. A well-documented disposition process is a necessity for any organization that is concerned about data security. The current average cost of a single data breach can be measured in thousands – or even millions – of dollars.
How to avoid off-network risk
Most electronic data breaches occur when assets are not connected to a network. Off-network risk is higher if your internal asset management processes do not address security at every step. To minimize the risk of a data security breach, you must have data security, audit and quality checks build into the entire disposition process. When moving and storing physical assets that are no longer connected to the network, you must create the accountability and security control necessary to minimize risk.
The benefits of working with an ITAD partner
An ITAD service provider can help you assess your current program, identify gaps and find solutions that protect your data and minimize your workload and your costs. It will help you create and implement a plan with a clear, documented retirement process that will ensure no asset or hard drive is overlooked in the ITAD data erasure process.
If you are a key stakeholder in the disposition process, you can ask experienced ITAD partners for best practices. Our document, “10 Myths About IT Asset Disposition (ITAD) Data Erasure,” discusses some best practices and addresses the many misconceptions that exist about the process, standards, and technology related to data erasure.
