Administrative Regulation 2.21

ADMINISTRATIVE REGULATION:   AR: 2.21 DATE APPROVED: April12, 2016
SUBJECT: Copier and Fax Replacement or Disposal ORIGINATING DEPARTMENT: County Administration

POLICY:


It is the intent of the Board of County Commissioners to establish procedures to securely replace and/or dispose of copier and fax machines. All personnel of the County have a responsibility to ensure the confidentiality of federally regulated and otherwise protected sensitive or proprietary information residing on County owned/leased copiers and fax machines.  

PURPOSE:


The purpose of this policy is to ensure the confidentiality and security of information about Citrus County government’s employees, partners and citizens as well as any protected data and intellectual property and protect such data from unauthorized disclosure, protecting Citrus County government from potential breaches of agreements. This defines the 
replacement and/or disposal of copiers and fax machines. 

PROCEDURE:

  •  County owned/leased copiers and faxes must have all institutional data reliably erased from the storage media prior to its transfer out of County control, irreversibly destroying the data using current best practices for the type of media. Deleting or formatting the media do not actually erase data from the device and therefore are not acceptable methods for preparing the device for transfer or disposal. Removing the media is not sufficient without taking additional steps to destroy the data.
  • For leased equipment, the County personnel who are initiating the lease will ask the lessor to add an additional line-item requesting the destruction of the media and provide documentation attesting to the erasure of institutional data by an approved IT service provider or through the lease holder. Systems Management is not allowed to access the leased device without voiding the lease. The only exception is when the lease holder will not erase the data, but will give the hard drive to Systems Management to wipe clean. Certifications of destruction shall be submitted to the Records Manager.
  • For owned equipment, County personnel will request Systems Management perform the erasure of data according to approved procedures prior to release (e.g., sale, donation) of the copier or fax machine. 
  • Responsibility for following disposal policy will be based on the purchasing/leasing Department/Division/Office and should be considered in all contracts and lease agreements. Transfer of devices to other internal departments is authorized as long as information sharing is not an issue.

FOOTNOTES & REFERENCES TO RELATED A.R.’s: