• Policies, Procedures & Guidelines
• Best Practices & Resources
• Secure Passwords
• Training
• Incident Response
• Breach Notification
• ISRS Security Forms
• Steering Committee

MnSCU Computer and Storage Media Destruction or Scrubbing Requirements

December 2, 2002, modified July 28, 2003

Computer equipment and/or storage media may not be transferred from one MnSCU user to another MnSCU user, sold, donated, discarded, or otherwise transferred unless the following procedure is followed before the transfer:

The following media must be destroyed by shredding to 1/4 inch pieces. No permanent transfer to second user allowed. Media temporarily transferred to another user must be returned to media owner. An approved disposal vendor who guarantees shredding of media data may be used.

Check the list of approved software and disposal vendors:

1. Floppy Disks
2. Back Up Tapes
3. CDROM Disks
4. CDRW Disks
5. ZIP Disks

The following requirements must be met before a hard drive or computer containing a hard drive is transferred to any other user:

1. The equipment is "scrubbed" with approved, multi-pass "wipe" utilities in accordance with this standard. Reformatting or defragging programs do not constitute "scrubbing" and are not sufficient to meet these standards.
2. A single pass "scrub" is required before transfer when the hard drive or computer is being transferred internally for use by other MnSCU employees. The entire drive must be written with zeroes or nulls.
3. A triple "scrub" pass is required before transfer if:
   1. The hard drive or computer will be disposed of externally, such as through surplus equipment, other sale or donation, or other disposition outside MnSCU.
   2. An administrative official determines that the hard drive or computer to be disposed of requires that additional precautions be taken because of the presence of a substantial amount of protected or sensitive data, such as equipment used primarily for institutional research, or personnel, student or legal data.
4. "Scrubbing" may be done through contract with an approved disposal vendor if the vendor guarantees the results, and that the vendor will protect any data on the hard drive or computer in accordance with the Minnesota Government Data Practices Act. A list of approved software and disposal vendors will be maintained at www.its.mnscu.edu.
5. Hard drives or computers provided for quasi-public use, such as in student labs or libraries, may be transferred to other uses without scrubbing. Users of such systems should be advised that there is no guarantee of privacy for information they access or enter in such systems.