![\"Security\"](\"https:\/\/www.itadsummit.com\/wp-content\/uploads\/bb-plugin\/cache\/Security-circle.jpg\")
\n\tThe sensitive work performed by data center decommissioning companies is more critical than ever. In a world increasingly driven by data, how data-bearing hardware is securely disposed of is enough to keep CIOs awake at night.<\/p>\n
So when federal authorities recently slapped a\u00a0$60 million fine\u00a0on Morgan Stanley for failures in its data center decommissioning processes\u00a0<\/strong>dating back to 2016, industry leaders unsurprisingly paid attention. The ruling served as a timely (albeit expensive) reminder of the rigor required in protecting customer data.<\/p>\n While it\u2019s clear the relationship between data center operators and data center decommissioning companies demands close management, what does this mean in practice? Here are four lessons to draw from\u00a0the penalty notice\u00a0issued to the banking giant:<\/p>\n According to the\u00a0 OCC\u2019s (Office of the Comptroller of the Currency)\u00a0consent order, Morgan Stanley failed to exercise proper oversight of the decommissioning of two of its data centers in the United States.<\/p>\n The bank failed to sufficiently vet and monitor third-party vendors, including subcontractors. It also failed to maintain an appropriate inventory of customer data stored on the decommissioned devices, the ruling asserts.<\/p>\n As a data center operator and custodian of personally identifiable information (PII), you must remember:<\/p>\n The ultimate responsibility for customer data sits with the business that the customer entrusts the data with\u2014and that is you.<\/p>\n This is why the companies you hire to assist with decommissioning work must be thoroughly vetted and comprehensively monitored. You cannot hide behind shortcomings in your contractor\u2019s work.<\/p>\n <\/p>\n For many businesses nowadays, data is the lifeblood. This is almost certainly true for your company, too.<\/p>\n With this in mind, organizations must commit to the strongest possible practices around data management.<\/p>\n This includes how you manage the decommissioning and disposal of the data center equipment you no longer need. Most firms don\u2019t have sufficient expertise or capacity to do all the decommissioning work themselves.<\/p>\n In your data management framework, take care to specify:<\/p>\n Morgan Stanley\u2019s failure to sufficiently vet and monitor its decommissioning partners doesn\u2019t mean decommissioning work shouldn\u2019t be outsourced.<\/p>\n What it does mean is that your organization must include (and enforce) clear direction around 1) the handling of data-bearing hardware and 2) the hiring and supervision of data center decommissioning companies\u00a0in your data management policy.<\/p>\n \u201cThere is no statute of limitations or safe harbor for improperly discarded IT assets. The equipment at Morgan Stanley was discarded four years ago. If a hard drive turns up five or ten years down the road with personal information on it, it is still a data breach plain and simple.\u201d<\/p>\n NAID \/ i-sigma<\/strong>\u00a0boss Bob Johnson<\/strong><\/p>\n <\/p>\n Your policies are only as good as the culture that sustains them.<\/p>\n Develop in your organization a\u00a0strong culture\u00a0around data security. This culture should permeate all aspects of your operation, from staffing and software to physical premises and hardware.<\/p>\n As with any culture, its development starts at the top. While the responsibility in larger firms rolls up to the management board, mid-sized companies and start-ups must also embrace core principles of data security at the highest level.<\/p>\n Bear in mind:<\/p>\n Data security is a leadership issue that touches all corners of a company, from accounting and product development to sales and marketing.<\/p>\n Your data management policy sets the framework for data security throughout your organization, from the physical security of data centers and hardware reuse to due diligence protocols and vendor management.<\/p>\n <\/p>\n Destroying data-bearing hardware may seem like the safest move of all, but it is not necessarily the smartest.<\/p>\n The rush to destroy end-of-use equipment is a product of\u00a0legacy thinking, a knee-jerk reaction that leads firms to leave money on the table and destroy otherwise functioning hardware.<\/p>\n Fully explore the conversation around\u00a0secure reusing\u00a0and remarketing of hardware with your decommissioning partner.<\/p>\n <\/p>\n It doesn\u2019t matter whether you\u2019re on the cutting edge of fintech, running a B2B e-commerce operation, or offering video streaming and adtech services, data protection regulation cuts across sectors. These days, pizza chains and florists are as dependent on customer data as they are on fresh dough and flowers.<\/p>\n Consider the European Union\u2019s\u00a0General Data Protection Regulation (GDPR), which requires tight standards for any organization holding the data of individuals in the EU, wherever\u00a0that company operates in the world. Or the California Consumer Privacy Act, which is\u00a0widely seen as the first step\u00a0toward a more comprehensive approach to data privacy in the United States.<\/p>\n In Morgan Stanley\u2019s case, it was ruled to be \u201cengaging in unsafe or unsound practices relating to information security and non-compliance under 12 C.F.R. Part 30.\u201d<\/p>\n Bottom line: it doesn\u2019t matter what sector you operate in, where you\u2019re headquartered, or to what degree you contract out the work, the protection of your customer data ultimately remains your responsibility\u2014and that extends to the practice of decommissioning data centers.<\/p>\n Working with data center decommissioning companies shouldn\u2019t be unduly burdensome. A good data center decommissioning company will help securely solve your problems and save you headaches.<\/p>\n Invest time in the vetting process. Identify firms that<\/p>\n Once you find the right partner, you\u2019ll be in good hands.<\/p>\n <\/p>\n Author: Horizon Technology<\/em><\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" ITAD Blog Data Center Decommissioning Companies: Managing The Security Risk ITAD Blog…<\/p>\n1. The Ultimate Responsibility For Data Oversight Is Yours\u00a0<\/strong><\/h2>\n
Action Points for Mitigating Risk<\/strong><\/h4>\n
\n
2. Build A Solid Framework For Data Management<\/strong><\/h2>\n
\n
3. Cultivate A Culture That Prioritizes Data Security<\/strong><\/h2>\n
Hold Your Horses!<\/strong><\/h2>\n
4. No Business Sector Is Exempt From Data Protection Requirements\u00a0<\/strong><\/h2>\n
Manage Your Risk<\/strong><\/h2>\n
\n