L&I, Office of Information Technology Procedure

(PDF)

1. Scope:

This procedure applies to all employees within all bureaus, divisions, boards, commissions, and councils within L&I. This includes any contracted employees in the service of L&I. (Hereinafter referred to collectively as “L&I Users”).

2. Procedure:

The procedure is implemented by Infrastructure and Computing Services (ICS). This procedure for IT equipment surplus is defined by Workstation Operations & Technical Services (WOTS) and Compute Services Operations (CSO) Office of Information Technology (OIT) divisions, in conjunction with the Department of General Services (DGS).

L&I’s Information Technology Service Management (ITSM) tool is the document of record for all configuration items (CI) concerning IT equipment.

1. Procedure to Dispose of L&I-Owned Workstations




Step	Responsibility	Action
1.	Program area manager or supervisor	Ensures that data and files are moved to a shared drive or backed-up prior to an L&I User’s last day of work.
2.	Program area manager or supervisor	Ensures a copy of the application software used to create archived data is maintained.
3.	Program area manager or supervisor	Instructs ITSM submitter to prepare an ITSM request.
4.	ITSM submitter	Prepares an ITSM request choosing one of the following from the service catalog: Hardware /computers/deleting (if removing device from the network and program area), or Hardware/computers/replacing/ (if replacing device with a new workstation and the old workstation is being removed from the network and program area).
5.	L&I User	Ensures all personal files and important data are moved to a migration folder.
6.	WOTS	Verifies that Program Area has saved all information. If the workstation is being ‘surplused’ and disposed of without replacement, WOTS technician labels and transfers the workstation from the work area to a holding area. If the workstation is being ‘surplused’ and disposed of with replacement during a work station deployment, WOTS technician or workstation service provider labels and transfers the workstation from the work area to a holding area for the service provider to pick-up.
7.	WOTS	Removes hard drive from the workstation, labels, and moves hard drive to a secure holding location for transfer process.
8.	WOTS	Returns hard drive to the WOTS Equipment Control Group in the central office.
9.	WOTS	Degauss hard drive or sanitizes the hard drive using the DOD scrub.
10.	WOTS	Records the information needed on the Media Disposal log and places the log in the Secure Media Disposal Box for DGS pick-up.




2. Procedure to Dispose of L&I-Leased Workstations




Step	Responsibility	Action
1.	Program area manager or supervisor	Ensures that data and files are moved to a shared drive or backed-up prior to an employee’s last day of work.
2.	Program area manager or supervisor	Ensures a copy of the application software used to create archived data is maintained.
3.	Program area manager or supervisor	Instructs ITSM submitter to prepare an ITSM request.
4.	ITSM submitter	Prepares an ITSM request choosing one of the following from the service catalog: Hardware /computers/deleting (if removing device from the network and program area), or Hardware/computers/replacing/ (if replacing device with a new workstation and the old workstation is being removed from the network and program area)
5.	WOTS	Verifies that program area has saved all information it desires to keep.
6.	WOTS	Removes hard drive from workstation, labels, and moves hard drive to a secure holding location for pick-up.
7.	WOTS	Arranges for the secure return of the hard drive to WOTS Equipment Control Group in central office.
8.	WOTS	Degauss hard drive or sanitizes hard drive using DOD scrub provided by the OA If errors occur, the hard drive is destroyed.
9.	WOTS	Records information needed on Media Disposal log and places log in the Secure Media Disposal Box for DGS pickup.
10.	PC service provider or program area staff	Boxes and ships the workstation, without any hard drive, back to the workstation leasing agent.

3. References

L&I Policy Definitions Document

APP-001 - Release of Protected Data

SEC-000 - Security Planning Policy

SEC-015 - Data Sanitization

ITP-SEC015 - Data Cleansing Policy

ITP-SEC019 - Policy and Procedures for Protecting Commonwealth Electronic Data

NIST SP 800-88 - Guidelines for Media Sanitization

4. Version Control