It Asset Disposal Vendor Due Diligence

By Author: ITAMG mechanically destroys hard drives and permanently eliminates the ability to recover data off o
Total Articles: 170
Comment this article

In this second installment of best practices for vetting a disposal vendor and documenting a process for electronic waste disposition IT Asset Management Group (ITAMG) is advising organizations to prepare for audits around eWaste recycling, environmental compliance, and data security for end of life media and IT assets by performing and documenting a site visit to the disposal vendor’s facility.

ElectronicsRecyclingFacilityIn the first post ITAMG described the importance of having a Master Service Agreement that covers the critical components of any IT asset disposal program.

It is important to note that the burden of performing due diligence when selecting a vendor and developing a compliant process extends further than signing an agreement with a third party vendor. It is in the stakeholders’ best interest to investigate and document firsthand the capabilities and infrastructure of any vendor handling electronic waste or data destruction projects regardless of the reputation, certifications, or track record the vendor may present.

Performing a site visit will help your organization vet a computer recycling ...
... firm by confirming and documenting several attributes and capabilities of the vendor. Consider you may be looking to confirm something as basic as the recycling vendor is operating inside a building with four walls and an enclosed roof (which is not surprisingly a requirement for many 3rd party certifications) all the way to more complex receiving, audit, and technology driven capabilities of the vendor such as the inventory tracking system, data wiping, and refurbishing capabilities of the firm.

Key attributes of the recycling facility and process to document:

Access controls and security of building, technical areas and warehousing
How and where shipments are received
Tracking process for loads and assets from receiving to shipping (recycle or final sale)
Process, tools, and infrastructure used to wipe and physically shred or destroy hard drives and other electronic storage devices
Inventory management system capabilities and equipment audit process
Inspection for general health and human safety conditions
Dismantling, refurbishing, technical, and packaging capabilities of the site
During your visit to the electronics waste recycling or IT Asset Disposition vendor’s facility take careful notes on the vendor’s process, infrastructure, tools, software, and volume of equipment in processing and assets in warehousing.

Ask questions to determine if the amount of assets your firm will be generating for disposal is in the scope of what the operation can handle. Use your best judgment to determine the capability of the vendor to service your needs in a timely manner.

Some vendors may have issues with photos being taken in certain places, but where allowed take as many photos as you can and use these photos to document your visit, the process, and capabilities of your selected vendor.

A documented site visit is a powerful display of performing due diligence and to mitigate liability of an unlikely breach or exposure that could occur from an improper computer disposal.Once you have performed and documented your disposal vendor site audit, consider setting a reoccurring meeting to go over any major process or facility changes that may occur over time.

In the coming weeks we will be following this post with more on how to document your due diligence in sourcing downstream waste handlers, maintaining a secure data destruction program, and other important asset management, certification of destruction, and financial considerations to account for.