Sanitize Devices and Media Before Disposal
University-owned devices must be sanitized before disposal or transfer. That means they must be erased, overwritten, or destroyed so that data cannot be recovered using normal system functions or software data recovery utilities.
U-M Property Disposition is responsible for the disposal, transfer, or resale of all university property, including all computers and storage media devices, designated as surplus by U-M schools, colleges, and units. All U-M-owned devices sent to Property Disposition must be accompanied by a certificate of sanitization/destruction, or they must use the KillDisk fingerprint option. Charges will apply for devices that do not use one of those methods to certify that a device was properly sanitized. Property Disposition will also accept devices and do the sanitization or destruction for you for a fee.
How you sanitize or request sanitization of a device or storage media depends on the type of device/storage and who manages it. Types of devices or media that must be sanitized includes, but is not limited to:
- Computer hard drives. Computer hard drives might be installed in a computer, or in an external enclosure, and may include solid state drives (SSDs).
- Tapes (magnetic media). Reel-to-reel backup tapes, cassette tapes.
- Optical media. Compact disks (CDs), DVDs, and blu ray disks.
- USB drives. Thumb drives and other USB or similar drives.
- Mobile devices. Phones, tablets, and other portable devices that may hold or be used to work with data.
- Printed materials.
The following options are available for disposing of UM-owned devices:
- MiWorkspace-managed devices. Return these to Neighborhood IT for proper sanitization and disposal. Contact your local support person or the ITS Service Center.
- Michigan Medicine devices are managed by Health Information Technology & Services (HITS). For questions about sanitization and disposal of devices, stop by any one of the Help Me Now locations or contact the HITS Service Desk at (734) 936-8000.
- U-M departmentally-managed devices. Check with your department for your department's preferred disposal method. You or your department can avoid fees by following these do-it-yourself directions:
- U-M fee based services.
- Property Disposition offers for-fee secure erasing and physical destruction services. See Computer Preparation, on the Declaring and Sending Surplus page.
- U-M Computer Showcase Tech Repair offers Secure Device Sanitization services for individuals and U-M departments, as well as assistance moving data to a new device if needed.
- Copiers and multi-function devices: The U-M Managed Copier Program leases copiers and multi-function devices for units and departments. See Copier and Multi-function Device Data Security.
- Personal devices used for U-M work. See Prepare Personal Devices for Disposal.
Physical Destruction for Secure Disposal
When devices, drives, or media are inoperable, it may be necessary to destroy them to ensure secure disposal. Destruction may also be required by some laws or regulations governing certain types of data.
- Ask Property Disposition to destroy a device. See Declaring and Sending Surplus on the Property Disposition site for more information.
- Destroy a device yourself (strongly discouraged). See Destroy Devices and Media for instructions.
Certificates of Destruction Required for U-M Devices Declared as Surplus
You are required to provide a Certificate of Destruction when taking U-M owned devices to Property Disposition if you have completed one of the secure disposal methods identified above or destroyed a device . The Certificate of Destruction must accompany the U-M Property Disposition Declaration of Surplus Form which is also required for all U-M property that a department or unit no longer needs.
- If you execute KillDisk to securely erase a device, the program will automatically generate a Certificate of Destruction at its conclusion.
- If you use another method to securely erase or physically destroy media or devices, you must attach a completed copy of this Certificate of Destruction (PDF) to the equipment when you bring it to Property Disposition. If you are bringing multiple of the same media or device make and model, you can provide one certificate that lists individual serial numbers of each device. Your unit is required to maintain a scanned or hard copy of the Certificate of Destruction for three years after disposing of the device or media. You can download the certificate to Google Drive or your computer to fill out as an interactive PDF, or you can print it and fill it out by hand.
If you do not attach a certificate matching the equipment you are dropping off, or use the KillDisk fingerprint option when erasing a device, Property Disposition will process the equipment as if it was not erased or destroyed, and your department will be charged the standard fees for secure erasure or device destruction. If you would prefer, you can also take advantage of Property Disposition's secure erasure and disposal service.
You are also responsible for destroying any printed or paper copies of sensitive U-M data or records that no longer need to be retained. See Shred Sensitive Paper Documents for best practices.