Eight Key Security Requirements for IT Asset Disposition

The recent IT asset theft case emphasizes overlooked security gaps in IT asset disposition (ITAD) processes. Featured in the most recent edition of EScrap News, Colin Staub's article 'ITAD employee admits to stealing and reselling devices' highlights a significant ITAD security breach involving a driver who pleaded guilty to stealing and reselling government and corporate IT assets instead of securely disposing of them.

The article details the criminal case, the potential data security implications, and the broader concerns regarding ITAD accountability and record reconciliation. With stolen government devices ending up in unauthorized hands, this case highlights why businesses and government agencies must be meticulous when selecting an ITAD vendor.

At SK tes, we recognize that ITAD security is only as strong as its weakest link. That's why we go beyond standard protocols to ensure airtight asset tracking, secure chain of custody, and comprehensive certifications to protect our clients from data breaches and compliance risks.

ITAD Risk Factors Revealed by This Case:

• Weaknesses in the Chain of Custody: Devices were stolen directly from ITAD jobs and later sold, showing a failure in end-to-end asset tracking.
• Fraudulent Certificates of Destruction: Clients were led to believe that their assets were destroyed, exposing them to compliance and security risks.
• Failures in Record Reconciliation: Without a rigorous reconciliation process, missing assets were not identified until law enforcement intervened.
• Lack of Separation of Duties: A single employee controlled asset collection, system induction, and certification issuance without independent validation, creating a major security vulnerability.

Eight Key Security Considerations During IT Asset Disposition:

To avoid falling victim to similar incidents, organizations must demand:

• End-to-end chain of custody:

  Every asset should be tracked with full visibility on an online tracking portal from request to pick-up to final disposition.

• IT asset counts and reconciliation:

  Every asset should be tracked, or every load weighed, at both collection and receipt and reconciled for verification.

• Adequate separation of duties and defined job roles:

  ITAD companies should ensure that no single employee or job role has unchecked control over asset handling, tracking, and certificate issuance.

• Employee background checks and clearances:

  ITAD teams handling sensitive data should undergo strict vetting and security clearances appropriate for every country they operate in.

• Certifications and compliance:

  A reputable ITAD service provider should be certified to industry standards like:
  • R2v3: A leading standard for responsible ITAD and recycling, ensuring that ITAD providers follow strict protocols. Read more about R2v3.
  • ISO 9001: A globally recognized quality management standard that ensures ITAD vendors maintain consistent, high-quality service delivery. Read more about ISO 9001.
  • ISO 27001: This internationally recognized standard for information security management requires strict controls for asset handling, access control, and risk management. Read more about ISO 27001.

• Tamper-proof asset tracking:

  GPS-tracked transportation, real-time logging, and reconciliation processes ensure accountability at every step.

• Controlled access to processing facilities:

  ITAD processing facilities should have separate areas for receiving, processing, and forward shipping equipment. Only authorized personnel should have access to each area, reducing the risk of internal theft.

• Open for audits and spot checks:

  ITAD companies should welcome clients and prospective clients onto their sites to see the process first-hand. Look for companies offering online or virtual tours, demonstrating openness and transparency.

At SK tes, we don't just meet these standards - we exceed them. Our secure ITAD solutions ensure complete transparency and compliance, giving our clients peace of mind.

You can watch our virtual tour to get an insider's view of our secure IT asset processing facilities.