A Guide to Secure IT Asset Disposal for Facilities Managers

With artificial intelligence (AI) and forensic software used to harvest sensitive data becoming more prevalent, getting IT asset disposal (ITAD) right is more important than ever.

 Businesses must know exactly what happens to their redundant IT assets after they leave their premises – controlling where the equipment is sent, who manages it and how it’s disposed of is critical in protecting sensitive business data, and maintaining an organisation’s reputation.

To support businesses who may be at the start of their ITAD journey, we’ve compiled almost 40 years of industry expertise into one complete step-by-step guide. ITAD can often be the responsibility of facilities managers, as in large organisations IT assets form a significant part of the estate and are crucial to the day to day running of the business. Facilities managers can use this guide to ensure their redundant IT equipment is secure when it leaves their organisation.

Coordinating the collection of redundant IT equipment from sites across the UK is no simple task, however with considered strategy in place, facilities managers can ensure that all assets are accounted for, tracked, and disposed of in the correct manner.

Start by nominating a site contact at every location – maintaining clear communication throughout the process is key. Identify the site-specific collection volumes and equipment types and create a site-by-site asset schedule to ensure every asset is processed securely and tracked for full visibility.

Coordinate with your ITAD partner collection windows that minimise disruption to business operations and utilise one strategy with site-specific planning to avoid over complicating the matter.

When assets are being prepared to leave a business’s premises, it’s vital that the appropriate robust restrictions are enforced on-site, otherwise organisations risk unauthorised personnel accessing the equipment and the sensitive data they store.

Ensure a designated, secure area is chosen to store the redundant assets in while they’re staged for removal, avoiding unattended, communal areas. By keeping this area separate to where operational equipment is held, businesses can ensure that only the assets that require disposal are removed from the premises, which is supported by recording what has entered and left the staging area.

The important aspect to note is that businesses are responsible for the security of all data held on both operational and redundant IT equipment, and that continues until every asset is disposed of by a trusted, certified ITAD provider like S2S Group.

From asset identification and secure loading, to arriving on site and data destruction itself, every stage of the ITAD process should be recorded and documented for visibility by a reputable provider.

Facilities managers should expect to see collection documents, asset inventories, tracking records, evidence of secure data destruction and final certification of the process. Without this, businesses risk not understanding what has happened to their assets once they’ve left their premises, and who has accessed their sensitive information.

To remain compliant with GDPR and the WEEE Directive, organisations must be able to evidence that all critical data has been irreversibly destroyed throughout the ITAD project, to avoid incurring fines of up to £17.5million or 4% of annual turnover.

At S2S Group, our live tracking portal Trakk-IT allows our customers full visibility of their IT assets from collection to disposal, providing a clearer, central chain of custody using RFID technology. This greater control over business IT assets gives our clients the peace of mind and the evidence they need to prove that their assets were handled securely and responsibly.

Standard collection procedures aren’t always appropriate for organisations who require a more robust security strategy such as police estates, courts and the emergency services.

These organisations should outline pre-approved personnel and grant their official security clearance for site inductions. Where escorts are required, they should be issued well in advance of the collection day, to ensure the process is as efficient and secure as possible.

Alongside this, detailed asset records should be made available to ensure the visibility of all data-bearing equipment so they can be tracked the moment they’re collected by a provider.

It can be easy for facilities managers to misjudge how much sensitive data some, less day-to-day IT equipment can contain. Devices such as printers, CCTV equipment, servers and hard drives are often the most overlooked in comparison to more common equipment like laptops and mobile phones that are used daily.

These devices can store sensitive information on RAM and internal hard drives for years, meaning businesses often forget to securely wipe these assets when they become redundant, before they’re sent for disposal. Facilities managers should assess their entire IT asset estate before commissioning an ITAD project to ensure all data-bearing redundant equipment is accounted for and handled responsibly by providers like S2S Group.

One example of when facilities teams must ensure that an ITAD project is planned thoroughly is for data centre decommissioning, due to the high volume of sensitive information stored on their racks and kit.

Recently, we supported a leading IT Managed Services Provider with a data centre decommissioning project. This involved managing 17 data centre assets through collection, transportation, tracking and secure destruction

Our specialist team travelled to the client’s site to remove all equipment from the racks and record each asset before carefully loading it into our secure lorries for transport back to our Approved Authorised Treatment facility (AATF) in Rotherham.

Following processing, the equipment was securely shredded or wiped using our ADISA Standard 8.0 approved data destruction procedures.

Choosing the right partner to manage a data centre decommissioning project, regardless of its size, is vital for facilities managers to protect all sensitive business data. Having clear evidence and documentation is vital for internal governance and reporting.

Whether a business is managing a single site, a national estate or a high security environment, we can help organisations plan, collect, track and securely process redundant IT assets.

By providing a fully documented chain of custody from collection through to final processing, facilities managers gain complete peace of mind in knowing their reputation is protected. Talk to our team of experts to start your ITAD journey with a trusted provider today.