About this policy
Policy contact:
Date of last update:
October 31, 2019
Policy statement
All systems and storage media will be disposed of in accordance with IU policy and industry best practice. Data will either be 1) securely erased prior to disposal or transfer to IU Surplus Stores or 2) the destruction will be coordinated with IU Surplus Stores. 3) Secure erasure or inability to erase will be noted in HWDB record.
Exceptions to policy
Media known to contain no sensitive or institutional data can be disposed of in the normal trash or recycled. This includes media containing software, drivers, documentation, etc. distributed by vendors.
| Device types | Method | Procedure | Reference |
|---|---|---|---|
| Computers (non-Mac) | DBAN/Cryptographic Erase (see NIST 800-88) | Boot from the DBAN media and securely erase all persistent storage devices (hard drives, SSDs, etc). Wiped drives are left in the system when sent to IU Surplus Stores. Drives that can not be securely wiped are removed and handled per the entry below. | |
| Computers (Mac) | Mac Built In/Cryptographic Erase (see NIST 800-88) | Use the Apple Disk Utility to securely erase all persistent storage devices (hard drives, SSDs, etc). Wiped drives are left in the system when sent to IU Surplus Stores. Drives that can not be securely wiped are removed and handled per the entry below. Have UITS remove machine from DEP. (sct2@indiana.edu). Ensure that if the machine has a firmware password, that is removed. Remove from IU DEP (Device Enrollment Program) | |
| Hard Drives SSDs USB Storage | DBAN plus physical destruction/Cryptographic Erase (see NIST 800-88) | Persistent storage devices (hard drives, SSDs, etc) that are not disposed of with a complete system (per above) will be securely wiped using DBAN (if still functional) and destroyed. Destruction will be performed by IU Surplus Stores. | |
| Phones Tablets PDAs | Destruction | Devices will be destroyed in coordination with IU Surplus Stores. Apple Devices: Remove from IU DEP (Device Enrollment Program) | |
| Tapes CDs DVDs Floppies Zip Drives Other Media Types | Destruction | The items will be destroyed in accordance with IU and Industry standards. Items that can be securely destroyed using in-house cross-cut shredders (eg. CDs/DVDs) may be shredded. All other items will be destroyed in coordination with IU Surplus Stores. | IU Surplus Stores Document Destruction
|
| Printers Fax Machines Copy Machines (with persistent storage) | Various | Devices with persistent storage (hard drives, SSDs, etc) will be either be securely wiped per manufacturer standards, the devices will be removed and wiped, or they will be destroyed in coordination with IU Surplus Stores. | |
| Prox Cards Magnetic Cards Smart Cards | Destruction | Items will either be shredded in-use using approved cross-cut shredders or destroyed in coordination with IU Surplus Stores. | |
| DUO Tokens | Surplus | DUO tokens are assigned to an individual and should be kept by the person even after leaving IU. They should not be turned in at termination since they will be needed by the individual to access W-2 information for the following year. Tokens that are no longer functioning must be disposed of via surplus stores as e-waste. | |
| Other | Various | Any other devices that contain persistent storage will be dealt with on a case-by-case basis and in accordance with IU Policies and Industry best practices. |
References
- IU KB: How can I securely wipe disk drives?
- IU KB: At IU, how should my department dispose of old computer equipment?
- Protect IU: Secure Data Removal
- IU Financial Policy: Disposal and Redistribution of University Property
- NIST Standards and Guidance (800-88r1):THIS IS A PDF!!!