UW-Extension Information Technology Equipment Disposal Policy
Last Updated: July 3, 2003
The purpose of this policy is to ensure appropriate destruction of proprietary, sensitive, or personal information when UW-Extension disposes of, or sends to surplus, information technology equipment.
When information technology equipment is sent to surplus or is disposed of, all data must be removed from the media in such a way that it is beyond the reach of all ordinary and most laboratory recovery methods. Simply erasing the data or reformatting the media is not acceptable because it does not prevent data from being recovered by technical means. Information technology departments throughout UW-Extension can assist users in data sanitization.
Three methods are acceptable for secure data sanitization:
- Degaussing:
- Degaussing magnetically erases data from magnetic media and hard drives. Before attempting any degaussing process, please consult an information technology professional. Degaussing may damage information technology electronics, making them unusable.
- Overwriting:
- The disk may be completely overwritten with data so that the old data cannot be recovered. The number of times data must be overwritten depends upon the sensitivity of the data. The US Department of Defense has defined a clearing and sanitizing standard (DoD 5220.22-M) that is used to meet their requirements. There are a number of free and commercial products that can be used to sanitize the disks, including those that meet DoD standards.
- Physical Destruction:
- As a last resort, information technology equipment can be "totally destroyed". For UW-Extension information technology equipment, the degaussing or overwriting processes are likely sufficient, but when the level of data sensitivity calls for it, total destruction of the equipment can be undertaken if there is no longer any use for the equipment or if the equipment no longer has any value. The National Industrial Security Program Operating Manual used by national security agencies defines "destroy" as "to disintegrate, incinerate, pulverize, shred or melt the equipment."
If you have any questions, regarding this policy, please contact your information technology department or the Chief Information Officer for assistance.