<<Prev Rule

Texas Administrative Code

Next Rule>>
TITLE 1ADMINISTRATION
PART 10DEPARTMENT OF INFORMATION RESOURCES
CHAPTER 202INFORMATION SECURITY STANDARDS
SUBCHAPTER CSECURITY STANDARDS FOR INSTITUTIONS OF HIGHER EDUCATION
RULE §202.78Removal of Data from Data Processing Equipment

(a) Institutions of higher education shall comply with the requirements and procedures addressing the sale or transfer of data processing equipment in §403.278, Government Code (between institutions of higher education or state agencies) or Chapter 2175, Government Code (for all other transactions).

(b) Prior to the sale or transfer of data processing equipment institutions of higher education shall assess whether to remove data from any associated storage device.

  (1) Electronic state records shall be destroyed in accordance with §441.185, Government Code. If the record retention period applicable for an electronic state record has not expired at the time the record is removed from data process equipment, the institution of higher education shall retain a hard copy or other electronic copy of the record for the required retention period.

  (2) If it is possible that restricted personal information, confidential information, mission critical information, intellectual property, or licensed software is contained on the storage device, the storage device should be sanitized or the storage device should be removed and destroyed. Additional information on sanitization tools and methods of destruction (that comply with the Department of Defense 5220.22-M standard) are provided in the "Sale or Transfer of Computers and Software" guidelines available at http://www.dir.state.tx.us.

(c) Institutions of higher education shall keep a record/form (electronic or hard copy) documenting the removal and completion of the process with the following information:

  (1) date;

  (2) description of the item(s) and serial number(s);

  (3) inventory number(s);

  (4) the process and sanitization tools used to remove the data or method of destruction; and

  (5) the name and address of the organization the equipment was transferred to.


Source Note: The provisions of this §202.78 adopted to be effective April 24, 2006, 31 TexReg 3373

Next Page Previous Page



Home TxReg TAC OM NewTac Public Footer Bar