Data Destruction Forms - Custody and Control of Electronic Devices and Media

The University of Manitoba has changed the process for commissioning and decommissioning electronic devices and media, including personal computers.

The Data Destruction form  must be completed for all electronic devices that are to be decommissioned.

Click here to download the Data Destruction Form

If there is more than one device included in your Data Destruction Form, click here to download Schedule 1 – Lot Information.

Click here for the Data Destruction Standard


PCCD Q&A – March Compu-rep Meeting

Question:  To whom will the Cherwell system send the order and delivery notifications (when the BookStore) processes an order for a personal computer?
Answer: The notification will be sent to the person responsible for deploying  the computer; however, it is important to note that the person responsible for deployment must be correctly identified on the order to ensure that this person receives the notification. Presently, the BookStore often received orders where the person responsible for deployment is not identified or is identified incorrectly. Further work is underway to make the process for collecting key information regarding the deployment with the order more robust.
The PCCD project team is aware that EPIC does not prompt the person placing an order to provide this information.

Question: I understand that the proposed Custody and Control of Electronic Devices and Media Policy requires that data be wiped or encrypted before the drive is returned to vendor. How can I comply with this policy if the drive has malfunctioned?
Answer: Dell offers a low cost option to keep the malfunctioning drive. If the drive was supplied as part of Dell system, this might be your best option. If it is necessary to return the drive to the vendor and you are  unable to wipe or encrypt the data, discuss the situation with the University’s IT Security Coordinator before returning the drive to the vendor.

Question:  Can you integrate the Data Destruction Form into Cherwell?
Answer: Some aspects of the Data Destruction Form have already been incorporated into Cherwell workflow; however, because some areas do not use Cherwell (at this time), it was necessary to provide a non-Cherwell method of gathering the information. Areas that use Cherwell will gather some of the information via Cherwell workflow rather than using the form.
The completed Data Destruction Form will be scanned and attached to a Cherwell ticket. The “filing system” for the completed forms will be Cherwell.

Question: Does the proposed Custody and Control of Electronic Devices and Media allow for home use of a computer after the user has left the University.
Answer: No. The policy purposefully and specifically prohibits the sale or donation of personal computers to external parties. A person who is leaving or has left the University would be regarded as an external party. The University does allow and has provisions for offsite use of University equipment by University employees.

Question: Does the policy restrict redeployment to a unit, faculty, department, etc?
Answer: No, the proposed Policy does not restrict redeployment according to organizational boundaries. If the equipment is registered in the Capital Asset Database then the equipment should be removed from the database or the database should be updated to reflect the transfer. This can be accommodated by clearly indicating on the Data Destruction Form that the redeployment will involve a transfer of ownership between units/faculties/departments, etc.

Question: Where is the drop off location at Bannatyne Campus for items that are to be decommissioned?
Answer: The project team has secured temporary space for decommissioning at Bannatyne campus. Because it is infeasible to receive equipment for decommissioning at the current H&SC desk location at Bannatyne, you should contact the H&SC and make arrangements to meet a H&SC representative at the temporary storage space. The project team is continuing to work with space planning to secure a better location at Bannatyne.

Question: Will the H&SC provide a receipt for items that are brought/delivered to the H&SC for decommissioning?
Answer: Yes. The Data Destruction Form includes an option to request an email confirmation of data destruction.
If the Data Destruction Form is email to the H&SC then your sent email is the record of the submission of the form. If the Data Destruction Form is brought to the H&SC in person then a H&SC representative will sign the form and, if you request it, provide you with a photocopy of the signed form.

Question:  Is the new decommissioning process to be used only for the computer itself or can peripherals and accessories also be brought/delivered to the H&SC.
Answer: Accessories and peripherals may be brought/delivered to the H&SC or you may arrange to have these items picked up by Physical Plant. You are encouraged to dispose of the peripherals and accessories along with the computer to minimize the transportation time and effort. Additionally, Physical Plant will no longer pick
up computers (that are eWaste) unless the request originates from the H&SC. Therefore, the easiest way for you to deal with accessories and peripherals that are eWaste is to bring them or have them transported to the H&SC for processing.

Question: Can we donate computers if the hard drive or other media has been removed?
Answer: The proposed Policy prohibits donation of used computers, regardless of whether the drive/media has been removed. The Policy does allow for donations to be made in exceptional situations with the prior written approval of the CIO, IST. The practice of donating used computers was discussed extensively by the ROSE steering committee and the University executive management team. It was decided that the practice of donating computers often gives risk to more risk and cost than the offsetting goodwill warrants. The Policy allows for exceptions where it can be demonstrated that the goodwill outweighs the cost and risk associated with the donation. Use good judgment when determining whether to request permission to make a donation.

Question: How does the process apply to electronic devices other than personal computers (e.g. servers, networking equipment, etc).
Answer: From a strict project perspective, as the name implies, the Personal Computer and Commissioning and Decommissioning project was responsible only for personal computers. However, the University has set up these processes such that the H&SC will provide a value added service to the University and we envision that the H&SC will become responsible for processing all electronic devices and media. You are strongly encouraged to contact the H&SC about the disposal of electronic devices and media other than personal computers. Remember, the proposed Policy has broad applicability; it is not limited in scope to personal computers.

Question: Does the Data Destruction Form accommodate “bulk” processing, i.e.  more than one computer on one form?
Answer: Yes. There are planned changed to the Data Destruction Form. A new Schedule provides a table that can be used to list multiple items associated with a single form.
All items on a common form must have certain things in common. For example, equipment that is being redeployed must be reported on separate from than equipment that is being recycled. If further clarification is required regarding a specific situation, please contact the H&SC before completing the form.

Question: How does the Policy apply to situations where there are multiple people using a computer?
Answer: The Policy was not intended to prohibit the use of a computer by multiple people, nor was it intended to make it onerous to manage a computer used by multiple people.
Please provide additional information to the PCCD team about the use cases for multiple users. We will review the use cases and advise how they can be addressed. Alternatively, on an ongoing operational basis, you can consult with the University’s IT Security Coordinator. It may be appropriate, in some cases, to encrypt profiles or to direct users to avoid storing certain types of information on the hard drive of a shared use computer.
The more information you can provide to the PCCD team regarding  share used computer use cases, the better the project team will be equipped to address this situation/requirement. Determination of a change in “Control and Custody” may be less obvious in some situations. If in doubt, discuss the matter with the University’s IT Security Coordinator.

Question: Is there still an “Amnesty” for old computers, hard drives, and other media?
Answer: The University wants you to use this new decommissioning process regardless of whether you know who last used the equipment. From the point forward, you should take any necessary steps to ensure that a single person is identified as the person responsible for each computer.
If you turn in a Data Destruction Form (and equipment) indicating that you don’t know who last used the equipment; however, you are responsible for providing all of the information on the form wherever it is available. Evidently, if someone repeatedly turns in relatively current equipment claiming to not now who last used the equipment this will eventually be cause for concern and may be investigated.
Internal Audit might, at some time, audit compliance with the proposed Policy and associated processes. Although the Policy is still pending at this time, you are expected to begin following the Policy, as proposed, and the respective processes, commencing immediately. Although the official launch date for the new processes is Feb 24, 2014, the official launch is mostly related to promotion of the Cherwell workflow into production. It is recommended that you commence using the Data Destruction Form and the process immediately.

Question: Can the H&SC accommodate the volume of equipment that might be turned in under the amnesty program?
Answer: The H&SC has already received large volumes of equipment under the amnesty program and will not refuse equipment. It would be prudent, however, to contact the H&SC in advance if you are planning to bring a very large lot of equipment for decommissioning. Normally, large lots will be transported by Physical Plant, and the H&SC will arrange the transportation, which help with managing the decommissioning workload.

Question: Where is the related documentation going to be located?
Answer: A webpage will be created for PC commissioning and decommissioning and it will contain information pertaining to today’s discussion as well as information pertaining to the Apple and Microsoft deployment tools. In the interim, the Data Destruction Form is available above

Question: What tools are approved for wiping data?
Answer: The ATA Secure Erase command, where available and properly implemented, can be used to wipe data from solid state devices. DBAN may be used to wipe data from rotating magnetic media. N.B. Wipe tools that were designed to render data unreadable on traditional rotating magnetic media may not be effective on SSDs. Refer to the Procedure and Standard for more detailed information.

Question: What happens to the equipment after it (and the associated Data Destruction Form) is brought to the H&SC?
Answer: The H&SC will retain the equipment for up to four weeks before destroying the data. Data destruction depends on the nature of the equipment, but hard drives and solid state drives will normally be physically destroyed using a purpose build drive crusher. Once the data has been destroyed the resulting (non-sensitive) eWaste will be transported by Physical Plant to an EPRA collector for responsible recycling.

Question:
Who is the operational owner of the decommissioning process?
Answer: Brenda McArthur, Manager, H&SC
Generally, questions regarding the decommissioning process should be directed to the H&SC.

Question:
What about smart phones
Answer: From a project perspective, the personal computer commissioning and decommissioning project is not responsible for the process for decommissioning smart phones; however, the Policy applies to smart phones and the processes accommodate smart phones. Please contact the H&SC for advice/guidance as to the best way to decommission any electronic devices or media that may contain sensitive information.

Question: What about leased equipment?
Answer: The Policy requires that the media in leased electronic devices (e.g. leased computers) be wiped using an approved method/tool before returning the item to the lessor.

Question: What if I have a computer that is three years old and still usable?
Answer: The Policy allows for redeployment of useful computers. N.B. the IT Standards Committee will be releasing a minimum standard that computers should meet if they are redeployed for normal/typical use. Computers that do not meet the minimum standards for normal/typical use should not be redeployed for that purpose. It is recognized that there are circumstances at the University were computers that do not meet the minimum standard for redeployment  may be reasonably redeployed other purposes to which the minimum standard does not apply.

Question: Who arranges for transportation of eWaste to the H&SC?
Answer: A technical representative who has equipment that requires transportation to the H&SC for decommissioning will forward a copy of the completed Data Destruction Form to the H&SC. The requirement for transportation of the equipment to the H&SC shall be indicated on the Data Destruction Form. The H&SC will raise a Cherwell IT service management ticket and forward the ticket number to Physical Plant along with the request for transportation services.

Question: To where/whom do I deliver or send the Data Destruction Form.
Answer: The completed Data Destruction Form should be delivered or forwarded to the (local campus) H&SC. Details for submitting the form are provided in the instructions included on the current version of the Form.

Question:  The H&SC desk at Bannatyne is located in the library. How do I drop off equipment at the Bannatyne H&SC?
Answer: If you plan to bring equipment to the Bannatyne H&SC you must contact the H&SC in advance and make mutually convenient arrangements for the equipment drop off. The project team is working to secure suitable, permanent space for decommissioning at Bannatyne campus.

Question: The standard practice in our faculty/department/unit is to remove media that might contain sensitive data and physically destroy the media before it leaves our area. How can we arrange for transport of the media to the H&SC and have the rest of the eWaste sent directly to recycling.
Answer: The process for decommissioning has been standardized and the standardized process does not involve removing media until the equipment has been received by the H&SC. The Office of Legal Counsel, the Privacy Officer, and the Chief Risk Officer were all involved in the design of the standardized processes.
Exceptions to the documented process increases risk. The further one deviates from the standard process, the higher the risk to the University.
You are accountable to the Custody and Control of Electronic Devices Policy and Procedure. Please comply with the documented process.
Under typical circumstances, Data will not be wiped, removed or destroyed before electronic devices and media are transported to the Help & Solutions Centre for decommissioning. If the equipment might contain very sensitive data or there are other reasons why the data must be destroyed before the equipment is transported then a software wipe is recommended.
Removing and physically destroying the media before transporting the equipment to the H&SC is inconsistence with the standardized process.

Question: What evidence provides an audit trail demonstrating that Physical Plant took custody of the equipment (for transport to the H&SC)?
Answer: The (most current) version of the Data Destruction Form includes a section where the person relinquishing control of equipment to Physical Plant for transport to the H&SC can request that the Physical Plant representative provide a signature confirm transfer of custody.
The signed form should be retained in the area where the equipment was used. The form will have been forwarded to the H&SC prior to arranging pickup of the equipment. It is optional, but unnecessary, to forward an updated copy of the form (showing the signature from Physical Plant) to the H&SC.

Question: What evidence provides an audit trail demonstrating that the H&SC received the equipment from Physical Plant?
Answer: Two separate records will be created when equipment is delivered by Physical Plant to the H&SC. Physical Plant will request that someone from the H&SC sign the delivery receipt, which Physical Plant will retain. The Help and Solutions Centre will record the receipt of the equipment in an IT service management ticket in Cherwell.

Question: Is the transportation service provided by Physical Plant secure?
Answer: Physical Plant will be aware that the goods that they are transporting might contain sensitive data and must be transported in a secure manner. When transporting equipment that might contain sensitive data, Physical Plant will take appropriate precautions, which might include direct delivery between the point of origin and the H&SC.
Physical Plant will only transport equipment that might contain unsecured (i.e. unencrypted) sensitive information intra-campus. Data must be removed, destroyed, or encrypted, in accordance with the Custody and Control of Electronic Devices Policy, before equipment is transported inter-campus or between an off campus location and the Help and Solution Centre.

Question:
Please reduce the length of the Data Destruction Form from three pages down to two pages.
Answer: There are likely changes that can be made to the Form to make it easier to use.
The operations team will be responsible for further improvements to the Form.


IST SERVICE DESK

Mon - Fri: 8am to 8pm
204-474-8600 or
chat now

Walk-In:
Fort Garry
123 Fletcher Argue
Mon - Fri: 8am to 8pm

Bannatyne
230 Neil John Maclean Library
Mon - Fri: 8am to 4:30pm

New! Submit requests & check ticket status online at: umanitoba.ca/ist/service_catalogue/