SELECTING A DATA DESTRUCTION PROVIDER

It’s no secret that choosing your data destruction tools will involve a lot of research; you’ve got to consider the reliability of the solution, the way it operates, how user-friendly it is, and, of course, the price. Unfortunately, many businesses get hung up on the price of the solution and simply purchase the cheapest option available. Not only is this practice grossly negligent, particularly in an era when the average data breach costs $4 million, but it violates the most basic of regulatory data destruction laws: due diligence.

According to the National Association for Information Destruction (NAID), due diligence can be understood as the legal requirement that, when selecting a data destruction vendor, an organization must employ it based on the merits of the product rather than the low price point. In the event of a data breach, one of the first questions your organization would be faced with would be “Why did you select this data removal provider?” If your answer is, “Because of the low price,” you’ve just proven that you neglected to perform due diligence and could expect a lengthy and public lawsuit to result in hefty fines and stigma for your organization.

Thankfully, this doesn’t mean that you’re obligated to purchase the priciest product on the market, either. Let’s look at some easy steps to determine what data destruction software fits your organization’s needs and how to choose a data removal tool while maintaining regulatory compliance.

1. How Do They Destroy Data?

This is perhaps the most obvious question to ask yourself when choosing a data removal vendor–how will they be erasing your personally identifiable information? Will they be wiping the data? Do they simply shred hard drives? Do they document their destruction processes? While these options may seem equally effective, it should quickly become apparent that not all data destruction methods are created equal.

For example, shredding hard drives may sound like a simple solution, but it substantially increases your risk for a data breach. Not only does it require you to entrust your hardware to strangers, but your information can still be recovered via simple forensic techniques. A more practical data destruction solution would be to use a wipe that can be operated without ever unplugging your machine to verify that nobody is stealing your personal information. Moreover, you’ll find yourself much more in control by using a wipe because you decide when the data wipe is employed and can check that all the information has been erased.

Using a personal wipe will allow you to verify that your data has been destroyed, ensure that no unsavory figures had access to your personal files, and give you the opportunity to ensure that the data destruction has been properly documented. For these reasons, you’ll typically want to employ the services of a wipe over the potentially unsafe or ineffective physical destruction methods. Before you employ any data destruction tools, however, it’s essential that you compare them to your industry standards.

2. What Are Their Certifications?

Different industries will require different performance specifications. While a financial institution will want to adhere to NIST guidelines, a healthcare provider will likely be more concerned with HIPAA’s regulatory standards, and for good reason; failure to comply with industry standards can have a disastrous impact on an organization’s reputation and ability to do business. These standards exist because each industry has unique responsibilities when it comes to protecting client information, but that doesn’t mean that there can be no overlap. In fact, the more industry guidelines that a data destruction tool meets, the better.

Look at Clarabyte’s data wipe for an example. It exceeds the requirements of more than a dozen industry and technical standards including:

• HIPAA–For healthcare organizations.

• FACTA–Credit and loan providers.

• NIST-Corporate standards of data destruction.

The list goes on and on, but the message is clear: This is a reliable data wipe. While another wipe may meet HIPAA standards and thus be legal for a healthcare provider to use, it’s worth considering why that wipe meets only one regulatory standard when others exceed the requirements of more than a dozen.

In short, while you have to consider how a wipe compares to your industry’s standards, don’t be afraid to see how it performs for other organizations as well. There’s no such thing as data security that’s too safe, and complying with various industry regulations is always an excellent sign. Once you’ve ensured that your potential provider has the appropriate certifications and is utilizing optimal data destruction practices, it’s time to consider how effectively you can implement this data destruction software into your organization.

3. Means of Implementation

If you’re responsible for wiping the data from 100+ hard drives, then it simply isn’t feasible for you to personally go through a step-by-step process for each piece of equipment. On the other hand, if you were to employ the services of an automated data wipe, the process of destroying the sensitive information would immediately become more efficient and save you time and hassle while wiping your hard drives. Or, worse yet, you may find yourself with a wipe that you simply have no idea how to use. For either of these situations, you’ll want to consider using a wipe that has proven to be scalable and easy-to-use if you want to ensure the proper erasure of personal information.

Clarabyte’s data wipe, ClaraWipe, is a fully automated solution that is able to fit itself into nearly any organizational layout. Whether you’re wiping five hard drives or 500, ClaraWipe is able to fit neatly into your data destruction protocols. And there’s no need to worry about any kind of technical know-how requirements; ClaraWipe is remarkably easy to operate because no organization should face a data breach simply because their wipe was overly-complex.

This isn’t just about selecting Clarabyte’s data wipe, this is about choosing a solution that you’re comfortable with and can rely on to fit your unique situation. Schedule a live demonstration of ClaraWipe and see why it’s so highly acclaimed. Regardless of your choice in software, however, you’ll want to make these same considerations: Will this wipe fit my organization? Am I confident that I can operate this solution? Can I test it out before I purchase it?

Putting the Pieces Together

Each of the above points is a crucial aspect of selecting a data destruction provider, but none of them are worth much on their own. Only by combining these steps into one cohesive plan will you be able to decide on a data destruction tool that works for your organization and can protect you from the ever-increasing costs of data breaches. So, before you go and decide what data removal solution to use solely based on price, reevaluate what’s important to your organization and make a selection more in-line with your industry’s regulatory standards.

References

Androutsopoulos, Valerie. “The Importance of Choosing the Right Data Destruction Service Firm.” Attorney at Law. Web.

Johnson, Bob. “Data Protection Laws Require Due Diligence.” NAID. 16 Aug. 2012. Web.

Ponemon Institute. Data Breach Costs Rising, now $4 Million per Incident. PR Newswire. 2016. Web.