Developing an ITAD Plan to Reduce Data Risk

Does your business have an IT Asset Disposition Plan (ITAD)? Don't worry, you're not alone — 60% of businesses don't. And, no, stuffing your office's old hardware and laptops in a storage closet does not count as an ITAD plan. Learn how to develop an ITAD plan that is regulations compliant, environmentally friendly and brings value to your organization.

Thirty years ago, most medium and large businesses had hulking mainframes on desks or in operations rooms. As newer models arrived, old ones were tossed in the garbage or put in storage closets. That was the extent of a company's ITAD program. Today, offices contain more electronic components than a moon lander, but disposition plans have changed little. Sixty percent of medium- to enterprise-level organizations have no ITAD program in place, which increases their data risk.

Why Is ITAD Growing in Importance?

The main reason ITAD is growing in importance is the increasing number of devices that are viewed as repositories of data. It's all around us in phones, desktops, tablets, e-readers, medical devices, and on and on.

"There are more and more of these devices than at any other time," said C. Brooks Hoffman, principal for Iron Mountain's SITAD Product Team, in a recent webinar on Managing Personal Data Risk With Secure IT Asset Disposition. "The list of devices is growing by the day."

Eventually, all of these devices reach the end of their electronic life. Millions of businesses and billions of people, all with their devices, create a steady stream of disposition. The World Economic Forum estimated that 50 million tons of electronic waste (e-waste) is produced each year, which translates into about 800 laptops in need of disposal every second.

"People are unsure how to get rid of this waste, so it stacks up," commented Chris Greene, director for Iron Mountain's SITAD Product Team, during the same ITAD webinar.

This is where having an ITAD plan comes in, an undertaking that organizations should begin by reaching out to a third party, Greene advised.

Why Do Organizations Need an ITAD Plan?

Greene says improper disposal of e-waste is "inherently risky" on several levels. Two of the major reasons organizations need an ITAD plan in place are:

Environmental concerns: E-waste and its components can be incompatible with the same waste management afforded to regular household waste. So much so, that it is illegal to dump e-waste in landfills in many states and countries.

"Proper disposal isn't just the right thing to do, it's the law," Greene said.

Sensitive data: If you do a cursory wipe of your laptop and toss it into the dumpster, not only are you likely breaking the law, but you are also creating data risk.

Hoffman says one gigabyte of data can translate into about 650,000 documents. Most people would never dump 650,000 records into a dumpster, but wouldn't flinch at tossing a laptop into one, which is essentially the same thing.

In regard to such careless disposal, Greene mentioned that "companies are being held accountable."

The European Union's General Data Protection Regulation (GDPR) may have changed the privacy landscape, but healthcare and financial verticals lead the way with regulation. Oftentimes, organizations need to navigate a labyrinth of local laws in addition to state and federal laws, and even local ordinances in individual countries. In the United States, these patchwork laws may get more complicated in the years ahead.

How Can Organizations Get Started?

It's vital for organizations to get a formal policy and procedure in place that includes data protection, involving all stakeholders in the process.

Once you have your plan drawn up, start looking for a vendor partner that is certified and steeped in ITAD best practices. The vendor should provide an itemized, trackable list, so that devices can be monitored in a secure, auditable workflow from pickup to disposal at an ITAD-certified site.

"It is not enough to make sure they are properly recycled; you have to make sure the items get to where they are supposed to go," Hoffman said.

With some planning and choosing the right ITAD partner, you'll be in compliance and doing your part to create an environmentally sustainable system.

Thirty years ago, most medium and large businesses had hulking mainframes on desks or in operations rooms. As newer models arrived, old ones were tossed in the garbage or put in storage closets. That was the extent of a company's ITAD program. Today, offices contain more electronic components than a moon lander, but disposition plans have changed little. Sixty percent of medium- to enterprise-level organizations have no ITAD program in place, which increases their data risk.