AMI carried out the survey to find out how companies are dealing with end-of-life IT equipment, and whether or not they are taking the right steps to dispose of this equipment in a secure manner. The results reveal an interesting contradiction between companies spending thousands on network security, etc., yet exposing themselves to the risk of data breach at the end of life stage by failing to ensure that data is wiped properly.
AMI’s survey found that even companies that use third-party IT retirement services are failing to take the necessary precautions; one-third don’t get formal confirmation that their data has been completely erased. This, in turn, exposes them huge fines under GDPR regulation which comes into force on MAY 25TH 2018, so if you have not marked this date yet,now would be a good time..
In their press release….
– AMI survey finds that 32% of companies that use third-party IT retirement companies don’t get formal confirmation that their data has been completely erased
– 25% of companies leave end-of-life IT assets on premise for more than one year
– 47% claim to manage specialist data-destruction process themselves
– 77% of companies say they would be seriously affected by data theft from old equipment, with 8% saying they would go out of business
The survey reveals that many Irish companies have overlooked the risk posed by failing to properly dispose of end-of-life IT assets. Some 47% of those surveyed stated that they manage data-destruction themselves and wipe or physically destroy data on site. As well as this, a quarter of respondents said that end-of-life IT assets remain on their premises for more than one year, highlighting that many organisations do not have established processes in place for managing the disposal of old IT equipment.
Despite these practices, the majority of organisations accept that the consequences of data theft from a retired device would be very grave, with 77% of those surveyed stating that it would have a serious effect on their company. Of those companies, 8% believe that their company would be forced to cease trading as a result.
Of those organisations that do have established processes for handling end-of-life assets, just over half (52%) send retired assets to a third-party specialist. A further 43% donate the equipment to employees, schools or charities.
For this reason, it’s clear why 71% of respondents say that security of data disposal is their most important consideration when it comes to choosing a means of disposal for data-bearing devices.
GDPR will introduce more stringent guidelines around where data flows and how it is processed. In the event of a data breach or compromise, companies who are unable to account for the whereabouts of their data could face fines of up to 4% of global turnover or €20 million, depending on which is greater. This will require companies to closely review supplier processes and policies to safeguard their interests. However, according to the survey results, 39% of those who work with a third-party IT retirement provider never audit the provider’s security processes.
The survey also found that despite the significant value of old IT equipment, 70% of businesses say that they don’t recover any value when retiring old assets. More than half of these (37%) would consider it in the future.
Philip McMichael, managing director, AMI, said: “It is extremely clear from the results of this survey that Irish organisations are leaving themselves vulnerable at the end-of-life stage by failing to securely manage the retirement of their old IT assets. Companies need to establish processes for disposing of this equipment and dramatically reduce the amount of time that it spends in storage, as this increases the risk of data going missing. It also devalues the equipment, so it’s in companies’ own interest to manage this process effectively.
It’s interesting to see that so many companies claim to manage and carry out data destruction themselves as this is a specialist security process that requires advanced tools to ensure that data-bearing equipment is erased to the most stringent global standards. Unless companies have trained specialists in place using the correct software and carrying out data erasures, they should reassess their ability to carry out this process themselves and align themselves with a specialist IT retirement provider.
Those that do work with IT retirement companies need to ensure that they receive formal confirmation that their data has been destroyed, as organisations that are happy to hand over data-bearing devices without a certification process in place are putting themselves at real risk of a data breach.
Companies that work with an IT retirement specialist can benefit from the creation of a new revenue stream that can be used for a variety of purposes, such as upgrading IT equipment or even charitable donation. However, the primary focus for Irish organisations now has to be plugging the security gap stemming from current and past failings to securely tackle IT retirement.”