• Section 1 - Summary
• Section 2 - Scope
• Section 3 - Definitions
• Section 4 - Policy/Regulation
• Section 5 - Procedures
• Part A - Roles and Responsibilities
• Part B - Disposal or Transfer of IT Equipment
• Part C - Removal of University Information
• Desktop and Laptop Computers
• Servers
• Other Devices
• Leased Equipment
• Part D - Destruction of IT equipment
• Part E - Sale of IT Equipment
• Part F - Breach
• Section 6 - Guidelines

Section 1 - Summary

(1) The purpose of this Procedure is to ensure that all University related information is adequately removed from information technology (IT) equipment prior to disposal.

(2) The disposal of IT equipment includes equipment being sold internally or externally, re-allocated to other departments within the University, trade-in to a vendor or supplier, return on end of lease, loan to any entity, donation or physical destruction of equipment including collection by rubbish removalists.

Section 2 - Scope

(3) This Procedure applies to:

1. External Vendors contracted to physically cleanse IT equipment as part of the disposal process.
2. Organisational Units within VU who purchase or lease IT equipment.
3. Information Technology staff.
4. Desktop PCs, laptops/tablets, servers, smart phones and other electronic storage devices.

Section 3 - Definitions

(4) Nil

Section 4 - Policy/Regulation

(5) See IT Asset Policy.

Section 5 - Procedures

Part A - Roles and Responsibilities

Part B - Disposal or Transfer of IT Equipment

(6) IT equipment may be left at designated drop off points (IT help desk office locations on each campus) or contact the University’s nominated removalist service to arrange the collection and delivery of IT equipment to the VU Asset Management Office.

(7) IT equipment including all desktop PC's, laptop computers, servers and other electronic storage devices must be disposed of according to Finance Procedures for the disposal of capital assets and/or attractive items:

1. Attractive Items
   1. Expensed items worth less than $5,000 are considered attractive items and are the responsibility of the organisational unit to record and manage in accordance with the Attractive Items Procedure. Attractive items may include but are not limited to computer equipment and software.
   2. Upon transfer or disposal of an attractive item, the attractive item Attractive Item Transfer/Disposal Form must be completed and returned to the VU Asset Management Office.
2. Capitalised Items
   1. Capitalised items are those worth more than $5,000 and are registered University assets.
   2. Upon transfer or disposal of Capitalised items, The IT Asset Transfer/Disposal Form must be completed and returned to the VU Asset Management Office.

Part C - Removal of University Information

(8) All University information including computer software, logos and data must be removed from IT equipment prior to disposal.

Desktop and Laptop Computers

(9) All University information including computer software, logos and data is to be removed from PCs and laptops prior to disposal

(10) Where the PC or laptop is severely damaged and cannot be operated to achieve the removal of software, any storage media must be either removed physically and reformatted on another PC or physically destroyed.

(11) The University must retain relevant documentation and licensed software media unless allowed by the license conditions, for example, software used under a site license.

Servers

(12) Backup of Information

1. As servers often contain data and information used by the whole University community it is vital to ensure that this is archived at the time the machine is taken out of production service.

(13) Removal of University Information

1. Removal of all University related information is to be completed by physically wiping any hard disks on the server. If the operating system software license permits, the operating system can be re-installed.

(14) Removal of other non-volatile memory

1. If a purchaser requires the presence of the operating system to verify the working condition of the hardware, the operating system must be set to its original default distribution state.
2. This process requires removing all VU generated data, applications, personal files of users and cleaning of selected files relating to passwords, groups, logs, mail boxes, print queues etc.

(15) To maintain security of the network infrastructure, the disks must be erased.

(16) Where the server is severely damaged, and cannot be operated, any storage media must be either removed and physically wiped on another machine or physically destroyed.

(17) The University must retain relevant documentation and licensed software media unless allowed by the license conditions.

Other Devices

(18) All VU proprietary or otherwise confidential information must be removed prior to disposal. This can be achieved by resetting the device to the original factory default.

Leased Equipment

(19) Removal of University Information steps according to the type of device is to be undertaken prior to disposal.

Part D - Destruction of IT equipment

(20) Destruction methods used must ensure that recovery of University information is impossible or impractical.

(21) External vendors contracted to dispose of IT equipment must provide a certificate of data destruction.

Part E - Sale of IT Equipment

(22) All sales of IT equipment must comply with the IT Asset Policy and Appropriate Workplace Behaviour Policy. Sales and payment processes are to be followed in accordance with Finance Policies and procedures.

(23) Complete erasure of data storage or reset to factory settings must be performed on University owned equipment and/or devices prior to the finalisation of sale or donation.

(24) IT equipment must not contain confidential, proprietary or other sensitive information when sold, regardless of the value of the asset.

Part F - Breach

(25) Disposing of IT assets in dumpsters or gifting to individuals or other parties outside of the control of the University is strictly prohibited. 

(26) Improper disposal of IT assets may result in the improper disclosure of proprietary, privileged or sensitive information and may lead to disciplinary action.

Section 6 - Guidelines

(27) Nil