2021 May 20 - Follow-Up Report: County of Hawaii Information Technology Asset Management

Home

Hardware and Software Security 8. Secured Disposal Status In Process We understand that the Director of IT plans to issue a memo with the “Electronic Records Destruction Policy for Computer and Electronic Media" to the Department heads and managers requiring the transfer of all obsolete hard drives to DIT for destruction. We recommend the County review this policy at least annually and update accordingly. Auditee Action: We reviewed the DIT Employee Policies Electronic Data Storage Destruction Policy (March 2020) and found the policy was periodically reviewed but not updated accordingly. To fully meet best practices, DIT should address the transfer of all obsolete hard drives to DIT for destruction including annual review process in DIT Employee Policies. We also understand that the current computer deployment location is temporary. However, if DIT continues to use the facility, we recommend that additional physical security controls be implemented to safeguard IT assets and media from loss or theft. Status: Implemented Auditee Action We verified additional physical security controls to safeguard IT assets and media from loss or theft, specifically we: Observed security camera system and safeguarding practices in place at Schultz Siding office and baseyard. Reviewed 82 disposal records and three police reports to confirm there were no redeployed items in DIT’s custody that were stolen. Compared Equipment Disposal Forms to Certificates of Disposal and found no exceptions. Observed manual hard drive crusher used to destroy obsolete hard drives and media tapes at secured location. Figure 2 Manual Hard Driver Crusher Photo courtesy Office of the County Auditor IT Asset Management Follow-up Audit Status of Recommendations page 10