COM 0261.000 2020-2022 - Laserfiche WebLink

Home

Hardware and Software Security 8. Secured Disposal We understand that the Director We reviewed the DIT Employee Policies In Process of IT plans to issue a memo with Electronic Data Storage Destruction the "Electronic Records Policy(March 2020) and found the policy Destruction Policy for Computer was periodically reviewed but not updated and Electronic Media" to the accordingly. Department heads and managers requiring the transfer of all To fully meet best practices, DIT should obsolete hard drives to DIT for address the transfer of all obsolete hard destruction. We recommend the drives to DIT for destruction including County review this policy at least annual review process in DIT Employee annually and update accordingly. Policies. We also understand that the We verified additional physical security Implemented current computer deployment controls to safeguard IT assets and media location is temporary. However, from loss or theft, specifically we: if DIT continues to use the facility, we recommend that additional • Observed security camera system physical security controls be and safeguarding practices in implemented to safeguard IT place at Schultz Siding office and assets and media from loss or baseyard. theft. • Reviewed 82 disposal records and three police reports to confirm Manual Hard Drive Crusher there were no redeployed items in DIT's custody that were stolen. • Compared Equipment Disposal ,, - 3 Forms to Certificates of Disposal 10 I and found no exceptions. \, '-.gr • Observed manual hard drive crusher used to destroy obsolete . ` " hard drives and media tapes at `'- secured location. Figure 2 Photo courtesy Office of the County Auditor 1 IT Asset Management Follow-up Audit Status of Recommendations 110