The Importance of Chain of Custody in ITAD Collection Services
When it comes to IT asset disposition (ITAD), ensuring a secure and transparent chain of custody is crucial. Whether you're a smaller business handling DIY shipping or a large corporation with comprehensive needs, the integrity of your IT assets from de-installation to final disposition can make or break your data security. Let’s explore why this is so essential and discuss how to choose a provider that meets this need.
What is Chain of Custody?
Regarding ITAD, NIST defines chain of custody as:
“A process that tracks the movement of IT assets through its collection, safeguarding, analysis, data destruction, refurbishment and resale or recycling lifecycle by documenting each person who handled the assets from the date/time it was collected or transferred, with the purpose for any transfers, through to its final disposition.”
This ensures that all assets are handled only by the correct professionals who are trained in these meticulous tracking procedures, ensuring that they never end up in the wrong hands.
Why is Chain of Custody Important?
It is crucial for your company that your ITAD provider maintains meticulous tracking procedures since it is the company that owns the technology that is liable for them until final disposition (resold, recycled, etc.). This means that if meticulous tracking procedures are not followed and your assets end up in the wrong hands, resulting in a security breach, US data privacy laws would hold the owner of that tech, not the ITAD provider, liable for all fines and litigation that resulted from that security breach, not to mention damage to your brand reputation. Furthermore, if your retired assets end up improperly disposed of and cause environmental contamination or human health concerns, laws like the Resource Conservation and Recovery Act (RCRA) will hold the owners of those assets responsible for clean-up and litigation costs.
ITAD-related risks are multiplied for large businesses because they have a large volume of equipment across multiple asset classes from multiple manufacturers with multiple lifecycles and ownership types (lease vs ownership). Those assets are also distributed across multiple locations across the states and sometimes across different countries. All of this creates an ITAD process that is far more complex and riskier than it is for smaller companies with fewer assets, making a meticulous chain of custody especially critical for large businesses.
The Role of Chain of Custody Tracking in ITAD
If your ITAD provider does not provide a clear chain of custody arrangement, you risk exposing your company to data breaches and environmental contamination issues. A reliable provider will do their due diligence to mitigate all risks during transportation and throughout all processing steps. They should also offer different levels of chain of custody, with the most secure methods reserved for companies like those in the financial or healthcare industry that may require the utmost security, for example, tamper-evident sealed trucks that do not make any stops between pickup and the processing center.
However, since such stringent methods come at a cost, they should also offer a less costly method that over 80% of companies that do not require such stringent measures could use instead. No matter what, they should still follow better than industry standards to ensure your assets are secure. For example, they should have teams of trained technology relocators and offer real-time tracking of assets throughout the entire ITAD process using an online portal that you can access yourself. This level of transparency allows you to verify that your IT assets are exactly where they should be at any given time.
DIY Shipping vs. Professional Collection Services
For small companies, DIY shipping services to ITAD processors can be seen as a cost-effective option. However, shipping products yourself can introduce significant risks due to the lack of a clear chain of custody. Without proper tracking, you can't be sure where your assets are or how they're being handled, increasing the potential for data breaches. There is additional risk from damage and losses when you opt for the cheapest shipping method, utilize labor not trained in how to package them safely, or use inadequate packing materials. If you are a small company and choose the DIY option, use a premium courier or freight service with detailed tracking options.
On the other hand, larger companies should opt for ITAD managed service providers (ITAD MSPs) to handle the logistics. They should offer comprehensive white glove services that include packaging, wrapping, strapping skids, and secure transportation of IT assets from pickup at the client’s site to the processing location. In some cases, like data center decommissioning, they will send skilled technicians to perform deinstallation first, before they hand it off to the white glove professionals. This will provide peace of mind that assets are handled professionally at all removal and transportation phases and the chain of custody is maintained.
How to Ensure Security and Compliance
Choosing an ITAD provider that offers detailed chain of custody procedures is paramount. Their services should be supported by standard operating procedures (SOPs) that are meticulously followed at every stage and designed to ensure that your assets never get misplaced or otherwise end up in the wrong hands.
However, that is not all there is to ensure security and compliance. They should also account for every pound, item, and serial number. This starts from the initial pickup of the assets to their receipt by ITAD processors, where they will be scanned and weighed. It continues through all transportation phases to the final disposition, whether resale or recycling. Serial numbers are recorded so that the ITAD provider and the company know exactly where every single asset ended up. They should also compare the weights and serial numbers from the beginning of the process to those at the end to ensure no assets remain unaccounted for. Ideally, your ITAD provider will also have an interactive online tool where you can track your assets in real-time by location or by serial number, ensuring full transparency and compliance.
Audit-Proof Documentation
Post-processing, itemized reports from the ITAD process, and serialized certificates will ensure your records are audit-proof. This thorough documentation provides peace of mind and safeguards your company against potential security risks and compliance issues, and streamlines everything in case of an internal or external audit. Ideally, your provider will have an online reporting tool that you can access at any time to obtain all necessary documents.
ICT's Comprehensive ITAD Services
ICT stands out in the industry by offering nationwide white-glove handling services with a quick turnaround time. They use a nationwide network of vetted technology relocation experts to handle the collection, packing, skidding, palletizing, wrapping, labeling, and removal of your equipment. Every step is meticulously documented, ensuring a secure chain of custody. You can verify it yourself using their advanced interactive online reporting tools to track your assets. They offer multiple levels of chain of custody and can allow you to track the shipment by location or by individual asset once it is received at the processing center. If extra security is needed, they will scan every asset, including individual hard drives, before they leave your site so that they can be tracked by serial number and offer tamper-evident sealed trucks if your company requires that level of security. Finally, they offer customizable audit-ready records, including certificates of data destruction and responsible recycling, so that you can rest assured the entire process was handled professionally and securely and that your records will be meticulous and easily updated.
Case Study: ICT securely removed and transported over 1200 end-of-life IT items (32 skids), including LCD monitors, computers, phones, and toner cartridges, from a data analytics company in Pennsylvania. All assets were securely wiped of data, leading to 100% reuse, zero waste, and zero cost to the client.
Final Thoughts
Choosing the right ITAD provider with a robust chain of custody tracking system is essential for protecting your company's data and ensuring regulatory compliance. By partnering with a provider like ICT, you can rest assured that your IT is handled securely and transparently from start to finish. This not only mitigates risks but also enhances your company's reputation for data security and environmental responsibility.
Find Out How We Can Help
If you are an enterprise, government, or institution looking for ITAD solutions or have additional questions, please contact us at ICT. Also, take a look at our comprehensive white paper on Safeguarding the Chain of Custody or our white paper Comparing Chain of Custody offered by 8 major ITAD providers for more information.
Selected References
Alabi, O. A., Adeoluwa, Y. M., Huo, X., Xu, X., & Bakare, A. A. (2021). Environmental contamination and public health effects of electronic waste: An overview. Journal of Environmental Health Science and Engineering, 19(1), 1209-1227. https://doi.org/10.1007/s40201-021-00654-5
Bloomberg Law. (2023). Consumer Data Privacy Laws. https://pro.bloomberglaw.com/insights/privacy/consumer-data-privacy-laws
ICT Mission Reuse (n.d.) ICT Mission Reuse. https://mission-reuse.com/
NIST. (n.d.) Chain of custody - Glossary | CSRC. National Institute of Standards and Technology. Csrc.nist.gov. https://csrc.nist.gov/glossary/term/chain_of_custody
US EPA. (2018, August 15). Summary of the Resource Conservation and Recovery Act | US EPA. US EPA. https://www.epa.gov/laws-regulations/summary-resource-conservation-and-recovery-act
©ICT Inc. 2024-2027. All rights reserved. Unauthorized reproduction, distribution, or use of this article, in whole or in part, without proper attribution to ICT Inc. is strictly prohibited.
