A.7.14 Secure Disposal or Re-Use of Equipment
Equipment Sanitization & Re-Use Protocols
The operational handling of physical assets and digital media varies based on the transition state of the equipment:
- Remote Wipe Authority: For all corporate-owned or MDM-enrolled devices, anDREa triggers an authoritative remote cryptographic wipe whenever an endpoint changes custodians, is permanently decommissioned, or is reported lost/stolen.
- Asset Depreciation and Transfer: If an anDREa-owned device is gifted or sold to an employee following its financial depreciation cycle, it must undergo a full structural sanitation and factory reset. Licensed enterprise software and all localized corporate partitions must be completely removed.
- Offboarding Disposal Duties: Upon contract termination, the departing individual is required to migrate all active business data to anDREa’s cloud infrastructure. Following data migration, the individual must securely purge all local instances and file a formal deletion confirmation within their active offboarding ticket (see A.06.05: Responsibilities After Termination or Change of Employment and A.06.07: Remote Working).
Centralized Hardware Decommissioning Governance
Re-use
ICT hardware that is no longer suitable for anDREa’s operational or security requirements, but remains technically sound, is securely data‑wiped and then donated, sold, or otherwise transferred to trusted organizations for continued use, reducing e‑waste and embodied emissions while maintaining full data protection.
Destroying
When re-use is not an option, physical data carriers or whole devices are centralized for final destruction, the Management Team enforces strict chain-of-custody and physical security controls:
- Secure Pre-Destruction Storage: Digital media designated for destruction must be securely data-wiped, segregated, clearly labeled as "To Be Destroyed," and stored in a physically secure container or environment to prevent theft or unauthorized recovery.
- Supplier Vetting: If data carrier destruction is outsourced, anDREa utilizes exclusively certified third-party destruction vendors. Or, the drive must be physically damaged.
- Asset Accountability Registry: Every disposed, recycled, or destroyed hardware asset—along with the specific cleaning methodology used and the destination identity (if transferred)—must be formally recorded to maintain an audit trail.