About

Policy 5307 – Data Sanitization Policy

Revision Date:  02/09/2023

Last Review:  02/09/2023

Original Effective Date: 11/09/2011

Responsible Office: Office of Technology Services


Policy:

In compliance with the Office of Technology Services (IT STD 1-17), the University has adopted the following policy related to the removal of security-sensitive data
from computer storage devices and electronic media.

Each University department is responsible for removing security-sensitive data from its computer storage and electronic media devices prior to completing a transfer. The following procedures are to be followed to comply with this policy.  Technical support is available through the University Help Desk.

Definitions:

Data Sanitization is the process of deliberately, permanently, and irreversibly removing or destroying data stored on a device or electronic media.

Security-sensitive refers to data that are confidential or protected from disclosure by either federal or state laws.

Computer storage devices include personal computers, laptops, computer servers, copiers, fax machines, scanners, tablets such as iPads, and VoIP phones, along with other electronic equipment that stores data.

Device refers to any device or system owned, managed, or used to transmit, store, or process data.  Examples include, but are not limited to, laptops, desktops, servers, routers, firewalls, smart phones, PDAs, tablets, monitoring systems, printers, fax machines, copiers, or network storage devices.

Electronic media include electronic and storage media, including tapes, disks, CDs, cassettes, DVDs, USB drives, removable storage devices, and portable computing equipment.

Procedures:

Procedure for computer storage and electronic media devices declared as surplus equipment:

  1. The department erases sensitive data before releasing the device.
  2. The Department submits an Equipment Disposition Request using standard property procedures.
  3. The Department contacts the Help Desk to have a ticket created for device sanitization
    or cleaning.  The Help Desk will assign the appropriate technician to perform the service.
  4. A technician will execute a “disc wiper” program, if necessary, removing all data
    on internal hard drive(s).  The data sanitization will take place where the equipment
    is currently located or at the Computing Center before the equipment is surplused
    to the Property warehouse.
  5. The method of data sanitization will be determined by following OTS Data Sanitization
    Standards and Requirements.
  6. A data sanitization form complete and signed by the appropriate technician will be
    kept on file at the Computing Center.  A “sanitized for surplus” label completed by
    the technician must accompany all surplus equipment requiring data sanitization before being surplused to Property.
  7. VoIP equipment can be sanitized by the Technical Services/Telecommunications personnel.

Transferring a computer storage device to another department:

  1. The Department submits an Equipment Transfer Request using standard property procedures.
  2. Prior to physically moving the device, the Department contacts the Help Desk to have
    a ticket created for device sanitization or cleaning.  The Help Desk will assign the
    appropriate technician to perform the service.  NOTE: Data cannot be retrieved once a device is sanitized or cleaned.
  3. The Property Office will conduct random spot checks of surplused computer storage
    devices to ensure that the University maintains compliance with this policy.

The following list includes examples of equipment requiring data sanitization/cleaning
prior to being surplused:

CLASS CODE

CLASS CODE

CLASS CODE

ADAPTER, COMPUTER

COMPUTER, ROUTER

PRINTER

ADDRESSOGRAPH

COMPUTER, SCANNER

PRINTER, ACCESSORY

ANALYZER, COMPUTER

COMPUTER, SERVER

PRINTER, BLUEPRINT

ANALYZER, MEDICAL

COMPUTER, SWITCHER

PRINTING EQUIPMENT

ASPIRATOR

COMPUTER, TAPE DRIVE

READER, MEDICAL

AUDIO VISUAL EQUIPMENT

CONTROLLER, COMPUTER

RECORDER, AUDIO/TV

BLOOD PRESSURE MONITOR

CONTROLLER, MEDICAL

RECORDER, BLOOD PRESSURE

BLOOD TESTING EQUIPMENT

COPIER

RECORDER CARTRIDGE

BOOK, CHECK UNIT

COUNTER, MEDICAL

RECORDER, DIGITAL

BRAILLE EQUIPMENT

DIAGNOSTIC, LABORATORY

RECORDER, ELECTRONIC

BRAILLE WRITER

DIAGNOSTIC, MEDICAL

RECORDER, LABORATORY

BREATH, TESTING

DIALYSIS EQUIPMENT

RECORDER, MEDICAL

CAMERA

DISPENSER, MEDICAL

RECORDER, PHYSIOLOGICAL

CAMERA. CCTV

DISPLAY UNIT, COMPUTER DATA

RECORDER, TELEPHONE

CAMERA, MEDICAL

DUPLICATING, OFFICE EQUIP.

ROBOT EQUIPMENT

CAMERA, SECURITY

DUPLICATING, PRINTING EQUIP.

SCANNER, COMPUTER

CAMERA, TV

ECGIELECTROCARDIOGRAPH EQUIP.

SCANNER, COMPUTER

CAMERA, VIDEO

EEGIELECTROENCEPHALOGRAPH

SCANNER, MEDICAL

CARDIAC  MONITOR

ELECTROSHOCK THERAPY MACHINE

SPEECH TESTING EQUIPMENT

CARDIOGRAPH

EMGLIELECTROMYOGRAPH

SPHYGMOMANOMETER

CARDIOSCOPE

ENCODER

SPIROMETER

CART, MEDICAL

EYE TESTING EQUIPMENT

STIMULATOR, MEDICAL

CHECK, WRITER

FAT PERCENTAGE INDICATOR

SURVEILLANCE EQUIPMENT

COMMUNICATION EQUIPMENT

FAX MACHINE

TELECOMMUNICATIONS EQUIPMENT

COMPUTER

FINGERPRINTING EQUIPMENT

TELEPHONE

COMPUTER SOFTWARE

GLUCOMETER

TELEPHONE ANSWERING EQUIPMENT

COMPUTER TRAINING EQUIPMENT

HEARING TESTING EQUIPMENT

TELEPHONE EQUIPMENT

COMPUTER, ACCESSORY

HEMOGLOBINOMETER

TELEPHONE, INTERCOM/PAGING

COMPUTER, BRAILLE

IDENTIFICATION SYSTEM

TELEVISION PRODUCTION EQUIP.

COMPUTER, COMPACT DISC

IMAGING EQUIPMENT, MEDICAL

TESTING EQUIPMENT, MEDICAL

COMPUTER, COMPONENTS

IMAGING EQUIPMENT, OFFICE

TONOMETER

COMPUTER, DATA PROCESSING

INCUBATOR, MEDICAL

TRACKING SYSTEM

COMPUTER, DISK DRIVE

INTOXIMETER

TRACKING SYSTEM, INMATE

COMPUTER, DISK STORAGE

IV PUMP

TRANSMITTER, MEDICAL

COMPUTER, DOCUMENT FEEDER

LABELLING EQUIPMENT

TRANSCRIBER

COMPUTER, DRIVE

LABORATORY EQUIPMENT

TYMPANOMETER

COMPUTER, EQUIPMENT

MEDICAL EQUIPMENT

TYPEWRITER

COMPUTER, HANDHELD

METER, MEDICAL

ULTRA SOUND, CARDIAC

COMPUTER, LAPTOP

MICROFICHE READER

ULTRASOUND EQUIPMENT

COMPUTER, LASER DISC

MONITOR, MEDICAL

X-RAY EQUIPMENT

COMPUTER, LCD PROJECTOR

NAVIGATION EQUIPMENT

X-RAY EQUIPMENT, ACCESSORY

COMPUTER, MAINFRAME

PHYSIOGRAPH

 

COMPUTER, MEDICAL

PLOTIER

 

COMPUTER, MOBILE DATA UNIT

POLYGRAPH EQUIPMENT