Data Security and Property Management

1
Data Security and Property Management

• Ivonne Bachar, CPPM CF
• Director
• Property Management Office
• Office of Research Administration
• TIPS Meeting July 2006

2
What are the challenges?

• Mitigating Stanfords risk relative to the
  handling of data security on moveable assets
  (capital and non-capital)
• Computers, PDAs, and other data-storing devices
• Ensuring policies and procedures are complete
  enough to address business and compliance needs
  while not contradicting each other or requiring
  extraordinary administrative handling
• Further integrating related property management,
  EHS, and disposal processes while providing
  needed services
• Increasing campus-wide awareness

3
Reference Documents

• Guide Memo 63 http//adminguide.stanford.edu/63.pd
  f
• Information Security
• Information Security Office
• Disk and Data Sanitization Policy and Guidelines,
  Sept. 2005www.stanford.edu/group/security/securec
  omputing/files/data_destruction_guidelines_v102.pd
  f
• Property Manual http//ora.stanford.edu/ora/pmo/ma
  nual/
• Utilization (under revision-See Chapter 8)
• Disposals (under revision-See Chapter 9)

4
Key Collaborators
Property Management
S.U.
Internal Audit
ITS
Legal Counsel
Dean of Research
EHS
External resources also utilized National
Property Mgmt. Assoc., University Surplus
Property Assoc., benchmarking with other
Universities.
5
Activities

• Vet issues/concerns within Property Advisory
  Group (PAG)
• Established Excess Property Advisory Group
  (E-PAG)
• Review and redefine equipment disposal processes
  increased integration with EHS and Surplus
  Property Sales (SPS)
• Clarify responsibilities for data security
  participate in Work Anyplace Taskforce within
  Business Affairs
• Create Computer Sanitization Kit for DPAs and
  others
• Increase awareness
• Participate in Work Anyplace Taskforce within
  Office of Business Affairs
• Review policies procedures make
  recommendations which will support mobile
  business needs while mitigating security issues
• Increase awareness

6
Highlights

• Departmental responsibility to sanitize computer
• Options provided
• Data Removal kit to be provided
• Data removal important/critical when
• Transfer from one custodian to another
• Transfer from one department to another
• Item processed as excess and leaving SU
  accountability
• Handling of excess property will be primarily
  driven by whether it is
• An electronic asset
• Operational beyond repair
• All excess requests to be generated in Sunflower
  by DPA
• Pick-up of electronic excess assets to be done by
  E-tech from EHS, partnering with PMO/Surplus
  Sales

7
Special Event

• July 26, 2006 PACE meeting
• Special focus on data security
• Features representatives from
• ITS
• Environmental Health Safety
• Internal Audit
• Property Management Office
• Legal Office
• Data Removal Demo
• Distribution of Computer Sanitization Kit

8
Contact Information

• E-PAG group chairperson
• Sandra Passetti
• sandram_at_stanford.edu
• 5-7890
• Your Property Service Representative
• http//ora.stanford.edu/ora/pmo/psr/default.asp
• Your DPA
• http//ora.stanford.edu/ora/pmo/dpa_lookup/default
  .asp