Audience:
All members of the Northwestern Community who utilize University-owned computers.
Definition:
Facilities Management offers a service to formally dispose of Northwestern University computers and peripherals. This service has been designed to help Northwestern meet the Environmental Protection Agency (EPA) regulations for equipment disposal. Information on this service can be found on the Computer & Electronics Recycling web page.
Northwestern University Information Technology (IT) recommends utilizing this service as it also offers data removal for no charge. For equipment acquired using federal funds, you must get approval of Accounting Services for Research and Sponsored Programs (ASRSP) for disposal. Information on ASRSP can be found at http://www.northwestern.edu/asrsp/.
Equipment with inventory tags (or cost exceeding $5,000) must be reported to the Accounting Services Equipment Inventory Coordinator.
Policy Statement:
It is the responsibility of the department or individual in possession of Northwestern-owned computer(s) to ensure that data has been properly removed from the hard drives of computers before removal or redeployment by one of the following two methods:
- For computers that are slated to be removed from Northwestern ownership, please utilize Northwestern's Computer & Peripherals Recycling Program to handle the proper removal of data and recycling of hardware. This program is further detailed in the Program Summary section below.
- For computer redeployment within Northwestern or for disposal not by Facilities Management, the steps given in the Procedure section below must be followed for the proper removal of data. For departments and individuals who require assistance with these procedures, Distributed Support Services is available to assist.
Background Issues:
Procedure
Deleting files from the computer does not remove the data. Data that has been "deleted" without utilizing the methods listed below can simply be "undeleted."
Desktop computers must have their hard disk drives sanitized (data overwritten) with software that completes a three-pass binary wipe. A three-pass binary wipe writes zeros, ones and then pseudo-random over existing data. This procedure should be completed prior to removing the equipment from the existing environment.
Northwestern IT recommends products such as DBAN (opensource software/freeware) for erasing hard drives prior to disposal.
Software
Generally, Microsoft licenses its original Windows operating system to the processor and motherboard of the desktop computer. So, while it is required that all data be erased using the method above (including the operating system) it is appropriate to pass on the original Microsoft Operating System installer disk with the computer when it is sold or repurposed in another department.
However, any software purchased from the Northwestern IT's site licensed program (examples include: Microsoft Office, Adobe Photoshop, etc.) must be retained by the University and can be redeployed by the department that originated the purchase. Note: This includes operating system upgrades.
Satisfies ISO 27002 9.2.6
Last Review Date:
December 2016
August 2016
Original Issue Date:
July 2004
Revision Dates:
February 2006
March 2008
July 2011
December 2013
August 2016
Additional Information:
It should be noted that U.S. Department of Defense (DOD) standard for sanitizing hard drives is significantly more stringent and primarily involves the destruction or significant magnetization of the hard drive.
For additional information, please see: