NCUA Guidelines for Third-Party Vendors: Complete Data Disposal Guide

1. Define Clear Disposal Procedures

The appropriate disposal techniques should be expressly stated in contracts with third-party vendors. Whether paper-based or electronic, these techniques should guarantee that the disposed information cannot be recovered or recreated.

2. Secure Methods for Paper Disposal

To dispose of paper-based information securely, utilize compliant disposal services that ensure the information is rendered unreadable, or shred the information on-site using cross-cut shredders.

3. Electronic Information Disposal

Managing electronic data presents additional challenges due to its potential for recovery even after deletion. Approved methods include:

• • Software-based Overwriting: Replacing data with random information using compliant tools
• • Degaussing: Using magnetic fields to scramble data (for magnetic media only)
• • Physical Destruction: For highest security requirements

4. Comprehensive Disposal Logs

Third-party vendors must maintain comprehensive records of the disposal procedure. Logs should include:

• • Wiping technique used
• • Date of disposal
• • Media type and serial number
• • Person responsible for disposal

5. Contractual Obligations for Leased Equipment

When leasing equipment like printers, fax machines, or telephones, ensure rental agreements explicitly specify the need for thorough sanitization of all confidential data on these devices prior to their return at the conclusion of the rental duration.