Secure Disposal of University Computers and Digital Media

 PARENT POLICY

University Security Policy

 PURPOSE

      With the change toward a more restrictive and secure computer data security environment and the advent of new and additional laws surrounding the protection of personal data, Cleveland State University is implementing a policy to help ensure the safe and secure disposal of computers and any data they may contain.  All computers (Personal Computers, Macs, Laptops, Hand-held computers, and Servers and their external storage devices) purchased by CSU are subject to this policy.  All removable storage devices for use with computers are also subject to this policy.

 PROCEDURE

      All data contained on computers and storage media are subject to CSU’s Policy on Document Retention and needs to be archived for the appropriate period of time.

      All surplus/old computers and any associated storage devices are to be sent to Property Control.

      All removable storage media (e.g. floppy disks, Zip disks, CDs, DVDs, thumb drives, flash chips) no longer required by a department’s retention policy are to be destroyed. Many shredders now have the capability to shred old diskettes and CDs. Bulky removable storage media (external Hard Drives, etc.) may be sent to Property Control for disposal.

Any computer and associated storage device received by Property Control will be assessed by IS&T against the University’s published minimum computer standard. 

Any computer not meeting the minimum computer standard will be put into storage to be destroyed by a contracted third party disposal company.

Any computer meeting the University’s published minimum computer standard will be made available to other CSU departments.  If not claimed within 3 months, the equipment will be put into storage to be destroyed by a contracted third party disposal company.

Quarterly the contracted third party disposal company will visit the university to pick up any machines for destruction performing the following tasks:

1.)                          The disposal company will wipe the hard drives and any other storage devices with a DOD (Department of Defense) standard overwrite and issue a certificate of data destruction for all wiped drives.

2.)                          The disposal company will record the serial numbers of the equipment as they palletize and prepare them for shipment.

3.)                          Once packing has been completed, CSU Property Control will verify the list of equipment readied for shipment.

4.)                          The disposal company and CSU Property Control will sign the list.

5.)                          The disposal company is responsible for the destruction and disposal in an EPA approved method.

6.)                          Once the machines and storage devices have been destroyed, the disposal company will issue to IS&T a certification of destruction listing the serial numbers of all units destroyed.

7.)                          IS&T will verify that the units removed by the contracted company are listed on the certificates of destruction.

All student lab computers and student lab equipment will be evaluated, by the CIO or his/her designee, to determine if it is appropriate for the equipment to be auctioned.  If approved, the equipment will be made available to other CSU departments and if unclaimed, wiped and auctioned.  If not approved, the equipment will be made available to other CSU departments and, if unclaimed for 3 months, put into storage until a contracted company is brought in to wipe the drives and remove the equipment for destruction (hard drive) and recycling (all other computer components).

REVISION HISTORY

 Revised: