Policy 5307 - Data Sanitization Policy
Effective Date: 9/12/2016
Original Date: 11/9/2011
Responsible Office: Property Officer
In compliance with the Office of Technology Services (IT STD 1-17), the University has adopted the following policy related to the removal of security-sensitive data from computer storage devices and electronic media.
Data Sanitization is the process of deliberately, permanently, and irreversibly removing or destroying data stored on a device or electronic media.
Security-sensitive refers to data that are confidential or protected from disclosure by either federal or state laws.
Computer storage devices include personal computers, laptops, computer servers, copiers, fax machines, scanners, tables such as iPads, and VoIP phones, along with other electronic equipment that stores data.
Device refers to any device or system owned, managed, or used to transmit, store, or process data. Examples include, but are not limited to, laptops, desktops, servers, routers, firewalls, smart phones, PDAs, tablets, monitoring systems, printers, fax machines, copiers, or network storage devices.
Electronic media include electronic and storage media, including tapes, disks, CDs, cassettes, DVDs, USB drives, removable storage devices, and portable computing equipment.
Each University department is responsible for removing security-sensitive data from its computer storage and electronic media devices prior to completing a transfer. The following procedures are to be followed to comply with this policy. Technical support is available through the University Help Desk.
Procedure for computer storage and electronic media devices declared as surplus equipment:
- The department erases sensitive data before releasing the device.
- The Department submits an Equipment Disposition Request using standard property procedures.
- The Department contacts the Help Desk to have a ticket created for device sanitization or cleaning. The Help Desk will assign the appropriate technician to perform the service.
- A technician will execute a “disc wiper” program, if necessary, removing all data on internal hard drive(s). The data sanitization will take place where the equipment is currently located or at the Computing Center before the equipment is surplused to the Property warehouse.
- The method of data sanitization will be determined by following OTS Data Sanitization Standards and Requirements.
- A data sanitization form complete and signed by the appropriate technician will be kept on file at the Computing Center. A “sanitized for surplus” label completed by the technician must accompany all surplus equipment requiring data sanitization before being surplused to Property.
- VoIP equipment can be sanitized by the Technical Services/Telecommunications personnel.
Transferring a computer storage device to another department:
- The Department submits an Equipment Transfer Request using standard property procedures.
- Prior to physically moving the device, the Department contacts the Help Desk to have a ticket created for device sanitization or cleaning. The Help Desk will assign the appropriate technician to perform the service. NOTE: Data cannot be retrieved once a device is sanitized or cleaned.
- The Property Office will conduct random spot checks of surplused computer storage devices to ensure that the University maintains compliance with this policy.
The following list includes examples of equipment requiring data sanitization/cleaning prior to being surplused:
|CLASS CODE||CLASS CODE||CLASS CODE|
|ADAPTER, COMPUTER||COMPUTER, ROUTER||PRINTER|
|ADDRESSOGRAPH||COMPUTER, SCANNER||PRINTER, ACCESSORY|
|ANALYZER, COMPUTER||COMPUTER, SERVER||PRINTER, BLUEPRINT|
|ANALYZER, MEDICAL||COMPUTER, SWITCHER||PRINTING EQUIPMENT|
|ASPIRATOR||COMPUTER, TAPE DRIVE||READER, MEDICAL|
|AUDIO VISUAL EQUIPMENT||CONTROLLER, COMPUTER||RECORDER, AUDIO/TV|
|BLOOD PRESSURE MONITOR||CONTROLLER, MEDICAL||RECORDER, BLOOD PRESSURE|
|BLOOD TESTING EQUIPMENT||COPIER||RECORDER CARTRIDGE|
|BOOK, CHECK UNIT||COUNTER, MEDICAL||RECORDER, DIGITAL|
|BRAILLE EQUIPMENT||DIAGNOSTIC, LABORATORY||RECORDER, ELECTRONIC|
|BRAILLE WRITER||DIAGNOSTIC, MEDICAL||RECORDER, LABORATORY|
|BREATH, TESTING||DIALYSIS EQUIPMENT||RECORDER, MEDICAL|
|CAMERA||DISPENSER, MEDICAL||RECORDER, PHYSIOLOGICAL|
|CAMERA. CCTV||DISPLAY UNIT, COMPUTER DATA||RECORDER, TELEPHONE|
|CAMERA, MEDICAL||DUPLICATING, OFFICE EQUIP.||ROBOT EQUIPMENT|
|CAMERA, SECURITY||DUPLICATING, PRINTING EQUIP.||SCANNER, COMPUTER|
|CAMERA, TV||ECGIELECTROCARDIOGRAPH EQUIP.||SCANNER, COMPUTER|
|CAMERA, VIDEO||EEGIELECTROENCEPHALOGRAPH||SCANNER, MEDICAL|
|CARDIAC MONITOR||ELECTROSHOCK THERAPY MACHINE||SPEECH TESTING EQUIPMENT|
|CART, MEDICAL||EYE TESTING EQUIPMENT||STIMULATOR, MEDICAL|
|CHECK, WRITER||FAT PERCENTAGE INDICATOR||SURVEILLANCE EQUIPMENT|
|COMMUNICATION EQUIPMENT||FAX MACHINE||TELECOMMUNICATIONS EQUIPMENT|
|COMPUTER SOFTWARE||GLUCOMETER||TELEPHONE ANSWERING EQUIPMENT|
|COMPUTER TRAINING EQUIPMENT||HEARING TESTING EQUIPMENT||TELEPHONE EQUIPMENT|
|COMPUTER, ACCESSORY||HEMOGLOBINOMETER||TELEPHONE, INTERCOM/PAGING|
|COMPUTER, BRAILLE||IDENTIFICATION SYSTEM||TELEVISION PRODUCTION EQUIP.|
|COMPUTER, COMPACT DISC||IMAGING EQUIPMENT, MEDICAL||TESTING EQUIPMENT, MEDICAL|
|COMPUTER, COMPONENTS||IMAGING EQUIPMENT, OFFICE||TONOMETER|
|COMPUTER, DATA PROCESSING||INCUBATOR, MEDICAL||TRACKING SYSTEM|
|COMPUTER, DISK DRIVE||INTOXIMETER||TRACKING SYSTEM, INMATE|
|COMPUTER, DISK STORAGE||IV PUMP||TRANSMITTER, MEDICAL|
|COMPUTER, DOCUMENT FEEDER||LABELLING EQUIPMENT||TRANSCRIBER|
|COMPUTER, DRIVE||LABORATORY EQUIPMENT||TYMPANOMETER|
|COMPUTER, EQUIPMENT||MEDICAL EQUIPMENT||TYPEWRITER|
|COMPUTER, HANDHELD||METER, MEDICAL||ULTRA SOUND, CARDIAC|
|COMPUTER, LAPTOP||MICROFICHE READER||ULTRASOUND EQUIPMENT|
|COMPUTER, LASER DISC||MONITOR, MEDICAL||X-RAY EQUIPMENT|
|COMPUTER, LCD PROJECTOR||NAVIGATION EQUIPMENT||X-RAY EQUIPMENT, ACCESSORY|
|COMPUTER, MOBILE DATA UNIT||POLYGRAPH EQUIPMENT|