IT disposition for banks, credit unions and insurers
Financial institutions and insurers carry customer financial data on branch PCs, teller workstations, laptops and servers. Disposal is part of the information security program examiners review.
Rules that apply to disposal
A summary for orientation, not legal advice. Your counsel or compliance officer defines what your policy requires.
- FTC Safeguards Rule (16 CFR Part 314)
- Requires covered financial institutions to securely dispose of customer information as part of a written information security program.
- FTC Disposal Rule (16 CFR Part 682)
- Requires reasonable measures to protect against unauthorized access to consumer report information when it is disposed of.
What financial services clients get
- Per-serial certificates for audit files
- Physical destruction option for drives where policy requires it
- Multi-branch pickup coordination across Ohio
- Vendor due-diligence documents on request
- NIST SP 800-88 sanitization or physical destruction, named per device
- Certificate and serialized report for every request
Equipment we collect
- Branch and teller workstations
- Staff laptops, phones and tablets
- Servers and storage
- Firewalls, routers and switches that hold network configuration
- Loose drives and backup tapes
Common situations
- A branch is closing or consolidating
- Equipment from several branches is collected on a schedule that fits your closing dates. Every site appears on one report, so the record for the whole project is in one place.
- Servers or core systems are being replaced
- Storage that held customer financial data is purged or destroyed drive by drive. Each drive serial is paired with the server it came from.
- An exam or audit asks for disposal records
- Because every certificate lists serial numbers, you can answer a request about a specific device instead of pointing to a batch.
Questions
Does the Safeguards Rule set a deadline for disposal?
The rule calls for secure disposal of customer information no later than two years after it was last used to serve the customer, unless you need to keep it for a legitimate business or legal reason. Retired equipment that still holds that information falls under the same requirement.
Can every drive be destroyed instead of wiped?
Yes. Choose physical destruction in the request and every drive is shredded and listed by serial number on the certificate.
Can you send documents for our vendor review?
Yes. Tell us what your vendor management program asks for. We send our process description, a sample certificate and the other documents we have.
Related guides
- Certificate of data destruction: what it must containWhat a certificate of data destruction should list, the details NIST SP 800-88 calls for, the gaps that make one worthless in an audit, and a real example.
- What hard drive shredding costs, and what sets the priceWhat decides hard drive shredding cost: quantity, media type, drive removal, on-site or off-site service and documentation. Plus how to compare quotes.
Tell us what you're retiring.
Get a written, itemized quote in one business day.