Keep Your Organization’s Data Out of the Wrong Hands

What happens to the data stored on your organization’s devices once they’re out of commission? Securely disposing of old IT assets isn’t just a best practice; it’s crucial to protecting sensitive data, maintaining compliance, and reducing environmental impact.  

Explore insights from a recent GovTech-hosted webinar featuring OMNIA Partners experts Richard McVay and Jimmy Montalto, who shared valuable strategies for secure IT asset disposal (ITAD) and data protection. 

Improperly discarded devices can pose significant risks. According to the webinar, audience members highlighted some of the most common challenges: 

• Lack of a formal IT asset disposition policy 

• Insufficient staff training on secure disposal practices 

• Budget constraints limiting access to certified ITAD providers 

Richard McVay, OMNIA Partners’ Senior Director of IT Telecom, emphasized that “data breaches are the number one threat” when it comes to improperly disposed devices. Despite efforts to wipe data, information can often be retrieved if devices aren't thoroughly secured or destroyed. McVay explains that hackers today are sophisticated enough to retrieve data from devices previously thought secure. This vulnerability puts organizations at risk of costly breaches, potential fines, and legal action. 

For government agencies, ensuring proper ITAD practices is particularly critical. Deborah Snyder, the webinar’s moderator and Senior Fellow at the Center for Digital Government, pointed out that failing to securely dispose of data-bearing devices could erode public trust. Snyder highlighted the importance of maintaining a high standard for handling sensitive information and meeting regulatory requirements. 

Standards like FISMA (Federal Information Security Management Act) and NIST (National Institute of Standards and Technology) provide guidance on how government agencies should manage IT asset disposal. Organizations need to align their ITAD programs with these standards to avoid legal repercussions and uphold their responsibility to citizens. 

When it comes to secure ITAD, a multi-step approach is essential. Jimmy Montalto, Senior Director of Partner Development – IT at OMNIA Partners, recommends a comprehensive strategy that includes certification, data protection protocols, and sustainability practices. Below are critical practices for safeguarding data during ITAD: 

• Work with Certified ITAD Providers: Organizations are encouraged to partner with certified vendors who adhere to strict disposal practices. Look for certifications like NAID (National Association for Information Destruction), R2 (Responsible Recycling), and e-Stewards. These certifications ensure that vendors follow industry standards for data protection and environmental safety. 

• Verify Chain of Custody: Maintaining a clear chain of custody throughout the ITAD process ensures accountability. This approach involves tracking each device from initial collection to final disposal. “The further you are from the disposal process, the more room for error there is,” cautions McVay. Organizations should consider onsite destruction or working with a trusted vendor that provides proof of destruction. 

• Physical Destruction of Devices: In some cases, overwriting data on devices may not be enough. Physical destruction, such as shredding or degaussing, can be an effective last line of defense for high-risk devices. This method makes data recovery impossible, eliminating the risk of unauthorized data access. 

• Documentation and Certification: Proper documentation is vital in the ITAD process. Montalto suggests obtaining a certificate of destruction or resale for each device to confirm compliance. This certificate not only serves as a record of data destruction but also supports transparency and accountability for audits or legal purposes. 

For a streamlined approach, organizations should consider integrating ITAD into their procurement and asset management processes. By establishing a clear policy, organizations can ensure consistent and secure IT asset disposal practices across all departments. OMNIA Partners encourages a proactive ITAD strategy that aligns with broader procurement policies, making it easier for staff to understand their roles and responsibilities. 

In addition to data security, sustainability is an increasingly important consideration in ITAD. Organizations should aim to avoid contributing to e-waste, which often ends up in landfills or in environmentally harmful recycling processes overseas. To ensure sustainability, McVay and Montalto suggest prioritizing ITAD providers with environmental certifications and responsible recycling processes. 

Implementing a compliant ITAD policy starts with understanding regulatory requirements, such as those outlined by NIST and FISMA, for government agencies. Additionally, all employees involved in IT asset disposal should be trained on secure practices, from understanding internal policies to working with certified vendors. Snyder reminds us that “education is the cornerstone of secure ITAD,” as it empowers staff to handle IT assets responsibly and adhere to compliance standards. 

• Develop an ITAD policy 
• Document your IT asset disposal process and ensure it aligns with regulatory standards. 
• Include clear procedures for overwriting, destroying, and tracking devices. 
• Evaluate ITAD providers 
• Look for certified vendors who adhere to NAID, R2, or e-Stewards standards. 
• Ensure they incorporate green practices to limit e-waste and prioritize sustainability. 
• Secure a chain of custody 
• Consider onsite disposal services to maintain tighter control. 
• Obtain proof of destruction 
• Request certificates of destruction to confirm data has been securely disposed of. 
• Schedule regular audits to verify ITAD compliance. 
• Educate employees 
• Train staff on secure IT asset disposal practices and the importance of data security. 
• Provide clear guidelines on working with third-party vendors for ITAD. 
• Keep records of each device’s journey from decommissioning to disposal.

Mastering ITAD requires a balance of security, compliance, and sustainability. By implementing these best practices and working with certified partners, organizations can safeguard sensitive data, reduce environmental impact, and build trust within their communities. As McVay concludes, “A secure ITAD process not only protects your data but also strengthens your organization’s reputation.” Start building your ITAD strategy today and ensure that your old tech doesn’t become a liability tomorrow. 

Explore our IT solutions HERE