All data on magnetic media must be rendered unreadable before being transferred between individuals or units within the University, to third-parties for equipment trade-in or warranty work, or before being transferred to University Surplus for recycling. Procedural specifics for this policy are detailed in the IT15- Storage Media Security Standard. Oversight for this policy (compliance, maintenance, and definition for the associated standard) is assigned to the Chief Information Officer for each campus and University Administration unless governance is otherwise provided for in University or campus Policy.
Magnetic media: Magnetic media refers to any form of data storage device (tape or disk) which uses a magnetic surface for storing information and data.
Rendered unreadable: treated or processed in a manner such that the original data or information cannot be determined.
Original data or information: the information or data of value the magnetic media was intended to store.
Surplus: to transfer materials to University Property Accounting for shipment to the State of Illinois’ Central Management Services (CMS).
Note: The above definitions were written so as to permit appropriately encrypted data to be considered unreadable without further processing.
This policy is a required response to Illinois Executive Order 2006-12 covering surplused electronic media. It defines the policy and standard by which magnetic media (computer disk drives, diskettes, flash memory, etc.) are handled when moved between employees and when sent to campus surplus for reuse or destruction.
In 2003 the State passed a regulation that required all magnetic media to be overwritten or ‘scrubbed’ ten times before being sent to surplus. The goal of this regulation was to ensure that sensitive or personal information stored on magnetic media was unrecoverably erased before entering the State surplus stream. In response to a general lack of compliance with the 2003 regulation, Executive Order (EO) 2006-12 was issued earlier this year. EO 2006-12 empowered CMS to implement policies to assure compliance. As a result, CMS stated that it will not accept electronic items at its surplus warehouse unless they are certified by the contracted vendor, which gives the University no option but to use the vendor. Thus the legal obligation to scrub electronic media prior to surplusing has been eliminated.
As such the existing policy is being modified to eliminate unnecessary and redundant media scrubbing while still protecting the University and the University Community from accidental or unintended data releases via the surplus process. This revision changes the existing policy in two dimensions
- the number of overwrites required is reduced from 10 to 1 before magnetic media will be accepted by surplus
- the required mechanism used for overwriting has been made more flexible
Petitions for exemptions or exceptions to this policy should be made in writing to the Chief Information Officer.