PURPOSE:
The purpose of this policy is to establish a standard for the proper disposal and sanitation of electronic media. The disposal procedures used will depend upon the type and intended disposition of the media. Electronic media may be scheduled for reuse, repair, replacement, or removal from service for a variety of reasons. Proper disposal of electronic media will reduce the risk to both the university and the School of Engineering and Technology (E&T).
SCOPE:
The scope of this policy includes all electronic media within E&T that has been designated for disposal, transfer, or other disposition outside of the control of E&T. All employees and faculty of E&T; as well as vendors, contractors, partners, students, collaborators and any others doing business or research with E&T will be subject to the provisions of this policy. Any other parties, who use, work on, or provide services involving E&T computers and technology systems will also be subject to the provisions of this policy.
Data transferred as a part of normal business operations is not covered by this policy. This policy will not supersede any Indiana University developed policies.
DEFINITIONS:
Electronic Media is defined as any device that is used to store or record electronic information, including, but not limited to hard disks, magnetic tapes, USB memory sticks, DVDs/CDs, videotapes, audiotapes, handheld electronic devices and removable storage devices such as floppy disks and zip disks.
Sanitizing is defined as the removal of information from electronic media or equipment such that data recovery using standard techniques or analysis is prevented.
Overwriting is one method of sanitation and is used to replace previously stored data on the electronic media with a pattern of meaningless random or non-random information.
Originating User is defined as the department, center, or office with effective ownership or control of the data on the computer hard drive or other storage media.
Department of Defense (DOD) Standard 5220.22-M, DOD Industrial Security Program, defines several methods for sanitizing various electronic media including, but not limited to, overwriting a specific number of patterns of meaningless data over the entire contents of the media or physically destroying the media.
Transfer of electronic media is allowed by this policy as long as the transfer does not violate any federal, state or university laws, rules or regulations.
All electronic media disposed of or transferred outside of the control of E&T will be either physically destroyed or the media will be sanitized in accordance with Department of Defense standards.
Reusable electronic media transferred inside the control of E&T may be sanitized at the discretion of the Originating User. If overwriting is deemed appropriate the media must be sanitized in accordance with Department of Defense standards.
The Computer Network Center is available to consult and is prepared to handle the disposition of electronic media.
VIOLATION OF POLICY:
If it is suspected that electronic media has not been handled in accordance with this policy, or electronic media is identified that has not been handled in accordance with this policy; notify the E&T Computer Network Center Director.
Any exceptions to this policy must be approved in advance by the Computer Network Center Director and Dean, School of Enginneering and Technology.
ENFORCEMENT:
Any person found to have violated this policy will be subject to appropriate disciplinary action as defined by the provisions of Indiana University Policy IT-02, Policy on Sanctions for Misuse or Abuse of Indiana University Technology Resources.