ROWAN UNIVERSITY POLICY

Title: Electronic Media Disposal Policy

Subject: Information Security
Policy No: ISO: 2013:04
Applies: University-wide
Issuing Authority: Information Security Office - Chief Information Security Officer
Responsible Officer: Vice President for Information Resources and Chief Information Officer

Date Adopted: 07-01-2013

Last Revision: 06-01-2014

Last Review: 09-01-2014

I.     PURPOSE

The purpose of this policy is to establish a standard for the proper disposal of media containing electronic data. The disposal procedures used will depend upon the type and intended disposition of the media. Electronic media may be scheduled for reuse, repair, replacement, or removal from service for a variety of reasons and disposed of in various ways as described below.

II. ACCOUNTABILITY

Under the direction of the President, the Chief Information Officer and the Chief Information Security Officer shall implement and ensure compliance with this policy. The Vice Presidents, Deans, and other members of management will implement this policy in their respective areas as needed.

III.  APPLICABILITY

This policy applies to all members of the Rowan community who access and use the University's electronic information and information systems. This policy and Rowan's "Code of Conduct" also govern access and use of the University's electronic information and information systems originating from non-Rowan computers, including personal computers and other electronic devices. The access and use of electronic information provided by research and funding partners to Rowan is also governed by this policy.

The use of information systems acquired or created through use of University funds, including grant funds from contracts between the University and external funding sources (public and private), are covered by this policy. This includes University information systems that are leased or licensed for use by members of the Rowan community.

IV. DEFINITIONS

1. "Electronic Media" – Physical object on which data can be stored, such as hard drives, zip drives, floppy disks, compact discs, CD-ROMs, DVDs, USB drives, memory sticks, MP3 players (iPod), Personal Digital Assistants (PDA's), digital cameras, smart phones and tapes.
2. "Sensitive Information" – Sensitive information is classified as Protected Health Information (PII), Confidential information, or Internal Information as defined in the Rowan University Information Classification Policy.
3. "Sanitization" – To expunge data from storage media so that data recovery is impossible. The most common types of sanitization are destruction, degaussing, and overwriting.

V. REFERENCES

Rowan University - Information Classification Policy ISO: 2013:07

VI. POLICY

A.  All electronic media must be properly sanitized before it is transferred from the custody of its current owner. The proper sanitization method depends on the type of media and the intended disposition of the media.

...

All electronic media other than computer hard drives must be rendered unusable before leaving the University. Use of certified commercial disposal systems such as "Shred-it" is encouraged.

VII.  NON-COMPLIANCE AND SANCTIONS

Violation of this policy may subject the violator to disciplinary actions, up to or including termination of employment or dismissal from a school, and may subject the violator to penalties stipulated in applicable state and federal statutes. 
 
 
  By Direction of the CIO:



__________________________________
Mira Lalovic-Hand,
VP and Chief Information Officer