Elevate the power of your work
Get a FREE consultation today!
How to create a ITAD policy
The following is a generic framework policy for IT asset control and disposal. This framework emphasizes the need to control data on IT equipment throughout its use, internal transfer, and disposal. It is important that an asset disposal policy to be tied to an IT asset usage policy as they involve many of the same issues. This policy impacts many different aspects of the organization and should be developed and coordinated with stakeholders within the Purchasing/Procurement, Information Technology, Environmental/Risk Management, and Facilities Management departments.
This document is intended as a policy framework and not a set of procedures that inform your organization on how to meet policy requirements. You should create your policy first and then develop the procedures and processes that derive from it.
Available resources include the following:
Be sure to speak with a representative from Iron Mountain if you would like further assistance. We can provide training, tools, and examples of best practices in order to get you started and further improve your programs & procedures.
All employees and personnel that have access to organizational computer systems must adhere to the IT asset control policy defined below in order to protect the security of the network, protect data integrity, and protect and control computer systems and organizational assets. The asset control policy will not only enable organizational assets to be tracked concerning their location and who is using them but will also protect any data being stored on those assets. This asset policy also covers the disposal of IT assets.
IT assets should not be confused with nor tracked with other organizational assets such as furniture. One of the main reasons to track IT assets other than for property control is to maintain data security. A special IT asset tracking policy will enable the organization to take measures to protect data and networking resources.
This policy will define what must be done when a piece of property is moved from one location to another. This policy will provide for an asset tracking database to be updated so that the location of all computer equipment is known at all times. This policy will help network administrators protect the network by enabling them to know what user and computer is at what station in the event of a network intrusion. This policy also covers the possibility that data on a computer being moved between secure facilities may be sensitive and must be encrypted while in transit.
This policy is designed to protect the organizational resources on the network by establishing policies and procedures for asset control. These policies will help prevent the loss of data or organizational assets and will reduce risk of a data breach or loss due to poor planning.
The Security Officer [insert role] is ultimately responsible for the development, implementation and enforcement of this policy.
Defines which IT assets should be tracked and to what extent.
Categorized the types of assets subject to tracking – including:
Assets that cost less than $ [INSERT AMOUNT] and do not contain date should not be specifically tracked. These include components such as video or sound cards. However, all assets that store data should be tracked regardless of cost. Examples include:
Small memory storage assets will not be tracked by location but by trustee. These assets include:
Trustees of the devices must sign for receipt of the devices in their possession. All employees must also agree to handle memory sticks, floppy disks, and CD ROM disks in a responsible manner and follow the following guidelines:
The Memory Device Trustee Agreement requires employees to sign for receipt of these devices and agree to handle these assets in accordance with the terms of this policy. This form must be executed by all employees that will work with any organizational data on the first day of employment. The form should also be updated whenever and employee receives one or more memory sticks, temporary storage drives, or data backup drives.
1. Asset Transfer Checklist – When an asset listed on the Asset Types list is transferred to a new location or trustee, the IT Asset Transfer Checklist must be completed by the trustee of the item and approved by an authorized representative of the organization. The trustee is the person in whose care the item resides. If the item is a workstation, then the trustee is the most common user of the workstation. For other equipment, the trustee is the primary person responsible for maintenance or supervision of the equipment.
The trustee must fill out the Asset Transfer Checklist form and indicate whether the asset is a new asset, moving to a new location, being transferred to a new trustee, or being disposed. The following information must be included:
Once the trustee fills out and signs the Asset Transfer Checklist form, it must be signed by an authorized representative.
2. Data entry - After the Asset Transfer Checklist has been completed, it will be submitted to the asset tracking database manager. The asset tracking database manager will ensure that the information on the form is entered into the asset tracking database within one week.
3. Checking the database - Managers who oversee projects that result in a change to equipment location should check periodically to see if the assets that were moved have been updated in the asset tracking database. The database should include a recent move list that can be easily checked.
This policy applies to any asset transfers, including the following:
In all cases the asset transfer checklist must be completed.
When transferring assets to another trustee, any confidential information on the device must be protected and/or destroyed. The method of data destruction is dependent upon the sensitivity of the data on the device and the next user of the device (i.e. within the organization and its control or outside the organization).
Please refer to NIST Special Publication 800-88 Revision 1 “Guidelines for Media Sanitization” in order to select which methods are appropriate to your organization’s level of risk tolerance.
Asset disposal is a special case since all sensitive data must be removed during or prior to disposal. The manager of the user of the asset should determine the level of sensitivity of the data stored on the device. The data erasure requirements for the device are based upon the sensitivity of the data as determined during the data assessment process:
1. None (Unclassified) - No requirement to erase data. However, in the interest of prudence normally erase the data using any available means such as software-based sanitization, physical destruction, or degaussing. Page 7 of 8
2. Low (Sensitive) - Erase the data using any available means such as sanitization, physical destruction, or degaussing.
3. Medium (Confidential) - The data must be erased using an approved technology in order to ensure that data is not recoverable using advanced forensic techniques.
4. High (Secret) - The data must be erased using an approved technology to ensure that the data is not recoverable using advanced forensic. Approved technologies are to be specified in a Media Data Removal Procedure document. Asset types include:
This policy defines the types of data that may be stored on removable media, whether that media may be removed from a physically-secure facility, and under what conditions such removal would be permitted.
Removable media includes the following:
Removable media should be handled according to the sensitivity of data stored on the device as determined by the data assessment process:
1. Unclassified - Data may be removed with approval by the first level manager and the permission is perpetual for the employee throughout the duration of employment unless revoked. The device may be sent to other offices using any public or private mail carrier.
2. Sensitive - Data may only be removed from secure areas with the permission of a director level or higher level of management. Approvals are effective on a one-time bases only.
3. Confidential - The data may only be removed from secure areas with the permission of a Vice President or higher level of management. Procedures for maintain data security while in transit and at the new destination of the media must be documented.
4. Secret - The data may only be removed from secure areas with the permission of the President or higher level of management. Procedures for maintain data security while in transit and at the new destination of the media must be documented
5. Top Secret - The data may never be removed from secure areas.
Because data security and resource protection are critical to the organization, employees that do not adhere to the foregoing policy may be subject to disciplinary action - up to and including termination of employment. Any employee who becomes aware of any violation of this policy is required to report such violation to their supervisor or other another authorized representative of the organization.
Each employee in the organization is expected to be aware of current policies and procedures related to IT Security and shall be trained on these policies and procedures on at least an annual basis. Employees are required to sign an acknowledgment that they are aware of the policy and will fully comply with its requirements.
A guide to optimizing assets for value generation, sponsored by Iron Mountain.
Setting business goals at the start of a new year allows for a clean slate and a chance to refocus on objectives that align with evolving market trends and strategies. Here are 11 business goals to set in the new year.