It’s time your IT asset disposal program manager ditches a murky understanding of DoD data destruction(Department of Defense 5220.22-M) by adding a clearer understanding of the NIST 800-88 (National Institute of Standards and Technology 800-88 Guidelines for Media Sanitization).

The DoD data destruction standard does not provide the adequate specifics an organization or business will require in order to run a secure program in a real world operation. The DoD does provide broad guidelines that should be adhered to by any organization maintaining or disposing of sensitive data.

The NIST 800-88 Guidelines, however, provides a detailed roadmap for creating a data destruction program built on the principles of identifying risk, life cycle stage of media, selecting and implementing appropriate methods of destruction, verifying and overseeing success, and documenting procedures and work performed.

“We perform DoD data destruction” has been a mantra of the ITAD (IT asset disposal) industry for well over a decade. But when one pushes for more specifics from a vendor or program manager one is likely to find inconsistent interpretations of the standard from a belief that it exclusively refers to three pass binary wiping, seven pass binary wiping, to a misconception that only physical shredding and pulverization of media can achieve data security.

In reality the DoD data destruction method does have recommended standards for two step erasure of drives using a clear and binary pass overwriting. It also includes basic standards for the removal of physical identifiers, chain of custody documentation, and physical destruction of optical media. The DoD standard does not recommend any specific tools, software, machinery, or provide any types of certifications to vendors or products.

The NIST 800-88 provides a clear manual that guides IT professionals to select the appropriate tool by the life cycle, risk level, and type of media. For example the document points out that a degausser should never be used for solid state media. Since SSD media is not magnetic media the degausser would not destroy the data on the chip sets. This type of granular knowledge is a must have for every IT asset manager.

Here at ITAMG we help our clients understand the NIST 800-88 model and how to develop custom programs that address unique business, industry, and regulatory compliance requirements.  

For more information on appropriate methods and documentation of data destruction practices please review our short guide to NIST 800-88.

If your IT department generates valuable surplus computer equipment whether through a regular refresh project, office relocation, staff reduction or merger it will be helpful to understand how to bid out an IT asset disposal project to computer liquidators.

We suggest contracting a prime source for ongoing IT asset disposal services, but from time to time it may be required to get a fixed bid on excess IT assets. In this post we will be providing a few tips on how to solicit offers in a way that will fairly evaluate capable vendors.

1. Qualify a list of bidders before distributing a Request for Proposal. Do not waste time taking offers from vendors that do not meet your company’s security, environmental compliance, or risk assessment requirements. When researching vendors and compiling a list of potential bidders weed out any vendors that do not meet your internal requirements. We suggest only bidding projects to vendors with third party certifications such as ISO 14001, Responsible Recycling (R2), and e-Stewards certification.

2. Create a spec sheet for the equipment that you will be bidding out, including an accurate estimate of the quantity of machines by locations. As an example for a desktop, note the make, model, processor model, RAM configurations, hard drive type and size, and form factor. Sometimes providing a service tag or part number will be enough, but to avoid potential issues from discrepancies it is best to have all bidders on the same page at day one of bidding. For a vendor to include all shipping and packaging costs in an offer they will need to know how many units and where the units are located.

3. Create a fixed timeline to receive accurate pricing. Provide bidders with a deadline for bids and what day the equipment will be released and ready for pickup. Most vendors will have an expiration date for competitive offers. A long timeline for a sale puts the vendor and your organization at risk of a bid expiring and the depreciation of the market effecting value returns for all parties. Reduce your company’s exposure by providing accurate timelines and rebidding if the timelines are not met.

4. Make sure all service level requirements are specified at the time of bid. Clearly outline any packaging services, de-racking, wiring, on-site data destruction, or any other services that will come at a cost to your company or vendor at the time of the bid. In order to fairly evaluate vendors one needs to avoid selecting a vendor and then finding out that there are additional costs and reductions to the value back because the requirements of the equipment sale were not clearly specified at the bidding.

Following these guidelines will help you seamlessly sell surplus IT equipment.

Looking for a tool to get the most value back on your company's IT disposals?

Download the ITAMG Inventory Template Today:

Evaluating an IT liquidation provider to purchase your corporate IT equipment can be a difficult task to accomplish. There are a good deal of variables that can lead an IT manager down a path where he or she will be unable to accurately evaluate competitive quotes, incur unnecessarily high service costs, or set incorrect expectations of value returns that will not be achieved at the end of a project.

Here are some quick tips to make you aware of potential pitfalls and help you eliminate these variables.

1. Know what you’re selling. Having a good understanding and detailed inventory of the models, specs, functional conditions, and cosmetic conditions of your equipment is the most empowering tool you will have available in the process. The more details and assurances you’re able to provide to a vendor the more comfortable and competitive the solution the ITAD provider will be able to offer. Its understandable most IT departments will not have the resources to test equipment and note cosmetic issues on every machine, but if you’re aware of equipment defects and issues provide this information to your IT liquidation vendor and get an understanding of what the cost reductions will be ahead of executing the project.

2. Understand your service level requirements. Make sure to provide all IT liquidators bidding on your project with detailed information on what data destruction service level, packaging requirements, building access requirements, shipping requirements, or any other data and asset management requirements you may have. This can be particularly important when the service level will affect the value of the equipment. For example, if you choose to require a vendor to shred the hard drives from a laptop liquidation there be additional costs for the destruction services and the machines’ overall value will be decreased from removing the hard drives.

3. Set a rigid time frame for the project. The secondary markets fluctuate rather quickly and most IT disposal vendors will not be willing to hold aggressive return rates in effect for longer than 10 business days. Keep in mind that if you’re planning a project 30-90 days out to set these expectations upfront so the vendors are able to give realistic pricing that can be met. We suggest in these situations to get the IT asset recovery estimate from vendors early in the planning stage and qualify capable providers. You can then re-price the project and make final decisions closer to the release of the equipment.

Having a good understanding of your disposal inventory, conditions of the equipment, service levels required, and time frame of project will allow you to control the process and meet the expectations set with your IT asset disposal vendor.

Looking for a tool to get the most value back on your company's IT disposals?

Download the ITAMG Inventory Template Today:

Proper handling of end of life computer equipment and electronic media is critical to avoiding costly data breaches and debilitating exposures to your business and client data.  Your options for hard drive disposal should not be limited by archaic security policies, vendor capabilities, or lack of in-house expertise or access to industry leading tools.    

The below is a quick guide to the common tools and methods utilized by sophisticated IT asset disposal providers and IT departments alike. 

Binary wiping and secure erasure:

Many times referred to as Department of Defense (DoD) three pass erasure, secure erasure writes multiple passes of binary code over a drive’s data to eliminate the path to the data.  The term DoD erasure is an asset disposal industry and IT shorthand and it should be noted that no software or erasure method is specifically endorsed by the DoD.  The method is a commonly accepted software tool for destroying data on magnetic and solid state media.

Having a contracted erasure service or in-house capability to securely erase machines is ideal to reuse machines in your environment, sell machines to a computer liquidator at optimum value, and ship or relocate machines that are not encrypted. 

Enterprise erasure tools should include reporting and verification utilities that allow organizations to save detailed certificates of destruction to the NIST 800-88 standards as well as identify drives that do not wipe to one hundred percent satisfaction.  When drives fail to wipe securely the user can quarantine and use another physical destruction method. 

DoD erasure is a method approved in the NIST 800-88 Guidelines for Media Sanitization in certain situations, but is not recommended for media that has higher risks associated to an exposure or contains top secret data. 

Hard Drive Shredding and Media Pulverization

Hard drive pulverizing or media shredding are terms commonly used for the industrial shredding of electronic media.  Although the equipment can be expensive for many business to own and maintain, many organizations utilize the method with the help of various asset disposal or document shredding service providers.  This method is ideal for quickly and cost effectively destroying large quantities of hard drives, optical media, flash drives, and other electronic storage. 

Hard drive shredding can be performed off-site at a vendor’s facility or on-site utilizing specialty shredding equipment typically deployed by the tier one IT asset disposal providers like IT Asset Management Group. 

Hard Drive Punching

Smaller machinery like hard drive punchers are ideal for eliminating the risk of shipping live and accessible data by first punching the drives before shipping or relocating the drives for the final shredding and recycling process.  Punchers are utilized where the large footprint of a shredder would not be possible or cost effective.  This method is ideal for small quantities of drives and is typically not cost or time effective for the destruction of large quantities of media.

Much like hard drive shredders there are hundreds of different kinds of hard drive punchers and some are not as effective for solid state drives or other types of media.  It is important to research and understand what a specific machine or service provider is able to do on a case by case basis. 

Degaussing Hard Drives

Degaussing hard drives is another solution ideal for smaller projects where an industrial hard drive shredder may not be available in the geographical area or economically appropriate for the project.  Degaussers use powerful magnets to destroy data on hard drives and other media but does not work for solid state hard drives or flash media.

Degausser machines are no longer the prevalent tool that they once were due to the superior output of shredders and more effective verification methods of enterprise erasure software utilities.  Nonetheless, the tool remains active due to security policies that have been written and not updated or where other tools prove to be near impossible to deploy.

For more information on appropriate methods and documentation of data destruction practices please review our short guide to NIST 800-88.

The best place to start is the beginning of course, regardless if this is your first IT Asset Disposal (ITAD) project or your hundredth. An investment in knowledge pays the best interest and knowing the “Four Knows” can help return that interest for your surplus IT equipment.

1. Know what you need
     a. Does your company have:
          i. A data destruction policy or security requirement?
          ii. A no reuse policy?
          iii. Any specific reporting requirements?

Knowing your company’s requirements for ITAD projects will ensure all quotes are based within a given framework.

2. Know what you have
     a. Do you have:
          i. An accurate equipment inventory?
          ii. An understanding if the equipment is still functional?
          iii. All the peripherals for the devices?

Knowing the project inventory will ensure that project quotes and project timelines are accurate.

3. Know who you work with
     a. Have you:
          i. Researched R2 recyclers and eSteward vendors?
          ii. Performed vendor due diligence?
          iii. Asked for a referral?

Knowing your vendor’s policies and procedures will reduce exposure risk and improve vendor selection.

4. Know your projects potential
a. Have you:
          i. Received multiple quotes?
          ii. Inquired about donation possibilities?
          iii. Asked your vendor to work with your VAR?

Knowing the value of the equipment will ensure you don’t get rid of it for free when you should be getting capital back.

An investment in knowledge pays the best interest and knowing the “Four Knows” can help return that interest on your redundant IT equipment.

Looking for a tool to get the most value back on your company's IT disposals?

Download the ITAMG Inventory Template Today: