PUBLISHED BY IAITAM Publishing, LLC 1137 State Route 43 Suffield, Ohio Copyright 2008 by IAITAM Publishing, LLC All rights reserved.

Transcription

1 Disposal Management

2 PUBLISHED BY IAITAM Publishing, LLC 1137 State Route 43 Suffield, Ohio Copyright 2008 by IAITAM Publishing, LLC All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. When assessing any legal matter, do not rely solely on materials published by third parties, including the content in this paper, without additionally seeking legal counsel familiar with your situation and requirements. The information contained in the IAITAM Best Practice Library and each of its volumes is provided for informational and educational purposes and does not constitute legal or other professional advice. Furthermore, any applicability of any legal principles discussed in this paper will depend on factors specific to your Organization, situation, and location. Consult your corporate legal staff or other appropriate professionals for specific questions or concerns related to your corporate governance and compliance obligations. IAITAM makes every effort to ensure the correctness of the information we provide, to continually update our publications, and to emend errors and outdated facts as they come to our attention. We cannot, however, guarantee the accuracy of the content in this paper, since laws change rapidly and applicability varies by reader. The information in this publication is provided on an as is basis without warranties of any kind, either expressed or implied. IAITAM Publishing, LLC disclaims any and all liability that could arise directly or indirectly from the reference, use, or application of information contained in this publication. IAITAM Publishing, LLC specifically disclaims any liability, whether based in contract, tort, strict liability, or otherwise, for any direct, indirect, incidental, consequential, punitive or special damages arising out of or in any way connected with access to or use of the information in this paper. IAITAM Publishing, LLC does not undertake continuous reviews of the Web sites and other resources referenced in this paper. We are not responsible for the content published by other organizations. Such references are for your convenience only. For further information on where IAITAM Publishing, LLC books are available, contact IAITAM Publishing, LLC at or by calling IAITAM. Visit our website at IAITAM Best Practice Library and Best Practice BluePrint are trademarks of IAITAM Publishing, LLC. ISBN-13: ISBN-10:

3 Table of Contents Disposal Management Overview... 1 Introduction to Disposal Management... 1 Defining Disposal Management... 1 Purpose of Disposal Management... 1 Why Disposal Management relates to IT Asset Management... 1 Implementation Goals for Disposal Management... 2 Goal 1: The Organization Disposes Of Assets Legally and Securely... 2 Goal 2: Asset Disposal Requirements Are Identified and Understood... 3 GOAL 3: Disposed Assets Are Accurately Tracked... 3 GOAL 4: The End of Life Process Is Defined and the Disposal Procedures Are Implemented... 4 Goal 5: Software Is Harvested and Reallocated During the Disposal Cycle... 5 Goal 6: Information Security for Disposed Assets Is Ensured... 5 Core Processes for Effective Disposal Management... 6 Self-assessment and Action Planning... 7 Measurements and Verifications Examples... 8 Activities and Products... 9 Asset Disposal Requirements Process Introduction to Asset Disposal Requirements Asset Disposal Requirements Defined How Asset Disposal Requirements relate to ITAM U.S. Resource Conservation and Recovery Act (RCRA) Definition of Hazardous Waste (as per U.S. Environmental Protection Agency).. 12 Types of waste Computer parts that fall under the definition of solid waste RCRA Required Treatment for Solid Waste and Hazardous Waste The EU WEEE Directive (2003) EU RoHS Directive (2003) Requirements Federal Electronic Waste Disposal Law Audit policies and administrative actions Penalties for not obeying the law i

4 Asset Disposal Security Process...29 Introduction to Asset Disposal Security...29 Defining the Disposal Security Process...29 How the Disposal Security Process relates to ITAM...29 Disposal Security Process...30 Disposal security considerations...33 Guarding Against Security Theft...35 Methods of Securing Data...39 Securing Proper Documentation...41 Audit Trail...42 Drive wiping options...44 Physical Security...46 Analyzing security risks...47 Software Harvesting Process...51 Introduction to Software Harvesting...51 Defining Software Harvesting...51 How Software Harvesting Relates to ITAM...51 End of Life Relationship...52 Budget Spending...53 Compliance Factors...54 Software Acquisition by Harvesting...56 Divestitures...57 Reduction in labor force...59 Benefits of Tracking...60 End of Life Process...63 Introduction to the End of Life process...63 Defining the End of Life process...63 How the End of Life process relates to ITAM...63 Determining what to do with an asset...63 Removing the Asset from the Environment...65 Disposal Options...67 Due Diligence...70 Contact Vendors...71 Developing a Hardware Disposal Process...73 Introduction to Developing a Hardware Disposal Process...73 ii

5 Defining a Hardware Disposal Process How the Hardware Disposal Process relates to ITAM Environmental Regulation Types of Disposal Logistical considerations for a Disposal Program Documentation management Inventory reconciliation Disposal Vendor Selection Performing Due Diligence The sale of non-functioning monitors, PCs, and laptops Disposal vendor audit Roles and Responsibilities Templates, Workflows and White Papers Disposal Workflow Asset Change/Disposal Form Data Erasure Confirmation Disposal Job Description Sample Disposal Policy Sample Invoice Quarterly Recycle Report Certification of Recycling WEEE Directive Located on CD Disposal Audit Located on CD Glossary of Terms iii