Policy 5307 – Data Sanitization Policy

Revision Date:  02/09/2023

Last Review:  02/09/2023

Original Effective Date: 11/09/2011

Responsible Office: Office of Technology Services

Policy:

In compliance with the Office of Technology Services (IT STD 1-17), the University has adopted the following policy related to the removal of security-sensitive data
from computer storage devices and electronic media.

Each University department is responsible for removing security-sensitive data from its computer storage and electronic media devices prior to completing a transfer. The following procedures are to be followed to comply with this policy.  Technical support is available through the University Help Desk.

Definitions:

Data Sanitization is the process of deliberately, permanently, and irreversibly removing or destroying data stored on a device or electronic media.

Security-sensitive refers to data that are confidential or protected from disclosure by either federal or state laws.

Computer storage devices include personal computers, laptops, computer servers, copiers, fax machines, scanners, tablets such as iPads, and VoIP phones, along with other electronic equipment that stores data.

Device refers to any device or system owned, managed, or used to transmit, store, or process data.  Examples include, but are not limited to, laptops, desktops, servers, routers, firewalls, smart phones, PDAs, tablets, monitoring systems, printers, fax machines, copiers, or network storage devices.

Electronic media include electronic and storage media, including tapes, disks, CDs, cassettes, DVDs, USB drives, removable storage devices, and portable computing equipment.

Procedures:

Procedure for computer storage and electronic media devices declared as surplus equipment:

1. The department erases sensitive data before releasing the device.
2. The Department submits an Equipment Disposition Request using standard property procedures.
3. The Department contacts the Help Desk to have a ticket created for device sanitization
   or cleaning.  The Help Desk will assign the appropriate technician to perform the service.
4. A technician will execute a “disc wiper” program, if necessary, removing all data
   on internal hard drive(s).  The data sanitization will take place where the equipment
   is currently located or at the Computing Center before the equipment is surplused
   to the Property warehouse.
5. The method of data sanitization will be determined by following OTS Data Sanitization
   Standards and Requirements.
6. A data sanitization form complete and signed by the appropriate technician will be
   kept on file at the Computing Center.  A “sanitized for surplus” label completed by
   the technician must accompany all surplus equipment requiring data sanitization before being surplused to Property.
7. VoIP equipment can be sanitized by the Technical Services/Telecommunications personnel.

Transferring a computer storage device to another department:

1. The Department submits an Equipment Transfer Request using standard property procedures.
2. Prior to physically moving the device, the Department contacts the Help Desk to have
   a ticket created for device sanitization or cleaning.  The Help Desk will assign the
   appropriate technician to perform the service.  NOTE: Data cannot be retrieved once a device is sanitized or cleaned.
3. The Property Office will conduct random spot checks of surplused computer storage
   devices to ensure that the University maintains compliance with this policy.

The following list includes examples of equipment requiring data sanitization/cleaning
prior to being surplused: