Policy Title: Media Sanitation and Disposal
Impact: Employees, Students, Affiliates
Responsibility: Chief Information Officer
Effective Date: 04/16/2018
Revised Date:
Reviewed Date:
Relates to Procedure(s): 3.08.06
Legal Citation(s):
I. Policy Narrative:
To prevent unauthorized disclosure of North Idaho College (NIC) data, media containing institutional data leaving the control of the responsible department/division and destined for reuse or disposal must have all NIC data purged in a manner that renders the data unusable or unrecoverable.
II. Definitions
“Institutional Data” refers to any type of information that is processed, created, collected, transferred, recorded, or stored by NIC to conduct NIC business.
“Media” defines any physical or virtual medium that stores data in either a physical or digital manner.
“Media Sanitation” is the process in which data is rendered unusable or unrecoverable on different types of media.
Procedure Title: Media Sanitation and Disposal
Impact: Employees, Students, Affiliates
Responsibility: Chief Information Officer
Effective Date: 04/16/2018
Revised Date:
Reviewed Date:
Relates to Policy(s): 3.08.06
Legal Citation(s):
The following procedure outlines the secure management of media containing North Idaho College (NIC) data to reduce the possibility of inappropriate exposure or unauthorized use of NIC data. The procedures apply to NIC administrators, faculty, staff and information technology personnel who:
- Transfer media containing NIC data to another department on NIC campus.
- Transfer media containing NIC data to another entity as surplus property.
- Recommend media containing NIC data for permanent disposal.
I. Responsibilities
Each department is responsible for ensuring that NIC data is properly removed or destroyed from media before it leaves the control of the department for reuse or disposal.
If items are replaced or disposed of by the information technology (IT) department, IT will ensure that data is properly removed from the electronic device before leaving the control of NIC or transfer to another department.
II. Media Sanitation Methods.
The NIC IT department will maintain guidelines for acceptable media sanitation methods for different types of media.
III. Surplus Property.
Any NIC media that is declared to become surplus property must have its data rendered unrecoverable before it is considered surplus property. Following this, the surplus property guidelines located in the NIC Administrative Services Operational Guidelines Manual will be followed.
IV. Enforcement
Regarding employees and other affiliates, the consequences of policy violation will be commensurate with the severity and frequency of the offense and may include termination of employment or contract.
Regarding students, the consequences of policy violations will be commensurate with the severity and frequency of the offense and may include suspension or expulsion.
Violations of this policy will be addressed in accordance with appropriate NIC policies and procedures, as issued and enforced by the appropriate authorities.
Violations of any local, state, or federal law will be reported to law enforcement.
Consequences of policy violation may include, but are not necessarily limited to, the following:
- Notification: alerting a user to what appears to be an inadvertent violation of this policy in order to educate the user to avoid subsequent violations.
- Warning: alerting a user to the violation, with the understanding that any additional violation will result in a greater penalty.
- Loss of computer and/or network privileges: limitation or removal of computer and/or network privileges, either permanently or for a specified period of time.
- Penalties: if applicable, the violator may be subject to criminal or civil penalties.
V. Appeal
For employees, appeal of actions taken which result in an unresolved dispute will be handled via the Grievance Policy and Procedure. For students, all provisions of the Student Code of Conduct shall apply.
VI. Maintenance
This procedure will be reviewed by NIC’s Chief Information Officer (CIO), IT Department, and the IT Policy and Planning Council every three years or as deemed appropriate based on changes in technology or regulatory requirements.
VII. Exceptions
Exceptions to this procedure must be approved by the NIC IT Department and formally documented under the guidance of the CIO, and President’s Cabinet.