IT Asset Disposal Policy: What to Include

An IT asset disposal policy sets out how your organisation retires equipment that may hold data or value. It does not need to be long. It needs to be clear about who decides, what standard applies and what records are kept.

1. Purpose and scope

State that the policy covers all IT and electronic equipment owned or leased by the organisation that can store data or has resale value: computers, phones, tablets, servers, storage, networking, printers, CCTV recorders and removable media.

2. Roles

• Asset owner: requests disposal.
• IT: removes devices from management and confirms backups.
• Information security: sets destruction standards and approves exceptions.
• Finance: removes assets from the register and records proceeds.
• Procurement: approves disposal providers.

3. Data destruction standard

Name the standard, typically NIST SP 800-88, and the level by data classification. For example: Purge with verification for general devices; Destroy for media holding the most sensitive data, and for any drive that fails erasure.

4. On-site requirements

Define which equipment, if any, must be destroyed on site before leaving your premises.

5. Approved providers

Require providers to: maintain chain of custody; destroy data to the named standard; issue serial-level certificates; use licensed recyclers; and provide reports. Review them periodically.

6. Records

Keep destruction certificates, chain-of-custody records, sale records and recycling documentation with the asset register, for the retention period set by your records policy.

7. Reuse and sustainability

State a preference for reuse and resale over recycling, and for recycling over disposal, and require reuse and recycling figures for sustainability reporting.

8. Exceptions

Donations, staff purchase schemes and lease returns each need a defined route that still includes certified data destruction.