University Security Policy
With the change toward
a more restrictive and secure computer data security environment and the advent
of new and additional laws surrounding the protection of personal data,
All data contained on computers and storage media are subject to CSU’s Policy on Document Retention and needs to be archived for the appropriate period of time.
All surplus/old computers and any associated storage devices are to be sent to Property Control.
All removable storage media (e.g. floppy disks, Zip disks, CDs, DVDs, thumb drives, flash chips) no longer required by a department’s retention policy are to be destroyed. Many shredders now have the capability to shred old diskettes and CDs. Bulky removable storage media (external Hard Drives, etc.) may be sent to Property Control for disposal.
Any computer and associated storage device received by Property Control will be assessed by IS&T against the University’s published minimum computer standard.
Any computer not meeting the minimum computer standard will be put into storage to be destroyed by a contracted third party disposal company.
Any computer meeting the University’s published minimum computer standard will be made available to other CSU departments. If not claimed within 3 months, the equipment will be put into storage to be destroyed by a contracted third party disposal company.
Quarterly the contracted third party disposal company will visit the university to pick up any machines for destruction performing the following tasks:
1.) The disposal company will wipe the hard drives and any other storage devices with a DOD (Department of Defense) standard overwrite and issue a certificate of data destruction for all wiped drives.
2.) The disposal company will record the serial numbers of the equipment as they palletize and prepare them for shipment.
3.) Once packing has been completed, CSU Property Control will verify the list of equipment readied for shipment.
4.) The disposal company and CSU Property Control will sign the list.
5.) The disposal company is responsible for the destruction and disposal in an EPA approved method.
6.) Once the machines and storage devices have been destroyed, the disposal company will issue to IS&T a certification of destruction listing the serial numbers of all units destroyed.
7.) IS&T will verify that the units removed by the contracted company are listed on the certificates of destruction.
All student lab computers and student lab equipment will be evaluated, by the CIO or his/her designee, to determine if it is appropriate for the equipment to be auctioned. If approved, the equipment will be made available to other CSU departments and if unclaimed, wiped and auctioned. If not approved, the equipment will be made available to other CSU departments and, if unclaimed for 3 months, put into storage until a contracted company is brought in to wipe the drives and remove the equipment for destruction (hard drive) and recycling (all other computer components).