This article originally appeared in the Spring 2020 issue of E-Scrap News. Subscribe today for access to all print content.

 

In a April 2018 publication, “The Data Center is Dead and Digital Infrastructures Emerge,” Gartner estimates that, 80% of enterprises will have shut down their traditional data centers by 2025.

As enterprises move toward the public cloud, there will be an increase in data center decommissioning projects as companies implement cloud, hybrid and edge data center solutions. Also, data center profiles will change, be it cloud, hybrid or edge, and data center managers will be focused on getting new equipment installed and managing day-to-day operations with a need to work with data center decommissioning companies to remove and manage the disposition of retired equipment.

Companies such as Sims Lifecycle Services specialize in providing data center decommissioning services and have introduced disciplined approaches to removing retired equipment, ensuring data protection and accurate inventory counts.

As shown in the diagram below, these companies provide the following services to data center clients:

  • Decommissioning assets, racks and cables.
  • Destruction of data on data-bearing assets.
  • Performing a physical inventory reconciliation against a master list of materials to ensure all equipment is accurately tracked.
  • Refurbishing and/or resale of equipment.
  • Redeploying of internal equipment.
  • Recycling of IT assets that have reached their end-of-life.

Data center services

A successful decommissioning project requires effective planned and coordinated efforts to assure that a live environment will not be disrupted. Defined processes and project management ensures the following:

  • Proper equipment is removed.
  • Data is destroyed consistent with client requirements.
  • Inventory is accurately audited and tracked.
  • Equipment is efficiently staged, packed and prepared for shipping.
  • Maximum value is recovered.

Initial planning

The data center manager will be focused on operational considerations during the removal of retired equipment. Initial tasks might include:

  • Identifying which servers, blades, racks, networking equipment, data storage media and cabling need to be removed.
  • Confirming if there are any maintenance contracts in place that need to be canceled or adjusted.
  • Finding room on-site to manage handling and processing of old equipment while new equipment is being installed.
  • Assessing the final disposition of material: redeploy, reuse or recycle.

The following sections will lay out the specific steps to ensure a smooth and successful decommissioning project.

Inventory and data destruction

Create a master list of all inventory moved from the data center and ensure all data is destroyed.

Today’s existing data threats force data center managers to evaluate the data destruction capabilities of their decommissioning vendor. Risks and consequences of misplacing or mishandling even a single hard drive can cause data privacy and compliance penalties. Data center decommissioning vendors should be able to:

  • Confirm what assets are data bearing.
  • Determine if drives should be removed and handled separately from servers.
  • Provide a certificate of data destruction for all storage media (SSD, HDD and backup tapes).

Data center managers in need of worldwide services should select vendors who follow strict data security standards for personal data protection. Some of the data destruction standards that can be utilized are:

  • NIST 800-88 r1 (United States).
  • DoD 5220.22-M (United States).
  • HMG IA Standard No. 5 (United Kingdom).
  • DIN-66399 (Germany).
  • ISM 6.2.92 Method (Australia).

Secure transportation

Chain-of-custody considerations are critical, especially when data-bearing equipment is shipped. Most companies require secured and tracked shipping via point-to-point transport when moving data bearing assets. GPS tracking or a cargo transponders can provide real-time tracking of sensitive equipment.

There should be a systematic receiving process in place when point-to-point shipments arrive at a processing facility. A good receiving process begins with weighing pallets as they are unloaded, confirming pallet and/or item counts, and noting the received condition of the equipment. The best vendors will photograph pallets as they are unloaded. These steps provide a documented unbroken chain of custody while assets are processed.

Equipment reuse

Decommissioned equipment is tested, refurbished and resold. The value of these materials offset any costs to the company generating the material. Resale revenue is usually divided between the data center and the vendor handling the equipment.

In addition to financial settlements, most data centers require an audit trail detailing final disposition of equipment. These reports will document:

  • Dates of when assets are retired.
  • Serial numbers.
  • Dates of when assets are sold.
  • Sale price of equipment.
  • Items sent for recycling.

This type of documentation is important to provide companies with proof of data destruction and equipment disposal, in compliance with their corporate compliance requirements.

E-waste recycling

Any obsolete or broken equipment should be recycled in a manner compliant with local regulations. Retired electronic equipment can contain hazardous waste that needs to be managed in an environmentally compliant manner.

Behind the scenes – Capabilities and capacity matters

Data center clients require strict vetting of decommissioning vendors. Corporate compliance teams need clear audit trails that show how equipment is handled after pick-up, and how and when equipment is resold or recycled as part of their due diligence requirements. They will take a closer look at the decommissioning vendor to ensure they:

  • Provide proof that equipment will be securely transported from the data center to the processing facility.
  • Have safeguards in place to manage data-bearing assets.
  • Will responsibly recycle all obsolete equipment and hazardous items.
  • Carry adequate business insurance (including cyber and pollution insurance).

The sections below outline the key concerns when it comes to due diligence.

Environmental risk of e-waste

It is important that data center clients consider the following when choosing end-of-life recycling vendors:

  • Verification that no hazardous material will be sent to landfill.
  • Confirmation of industry certifications, indicating your recycling facilities are secure, safe and operate in adherence to minimum environmental standards (certifications to reference should include R2:2013, ISO 14001, ISO 45001, ISO 9001, WEEELABEX).
  • Environmental compliance documentation to prove no e-waste was landfilled or illegally exported.
  • Audit trails showing disposition routes/paths, mass balance reporting, and certificates of recycling have become common requirements of large companies.

Insurance and indemnification

Risk managers at enterprises will want to ensure that vendors have insurance to cover errors and negligence on the vendor’s part. In addition to standard commercial insurance, companies handling IT assets and e-waste should carry specialized cyber and pollution insurance to cover the unique risks associated with handling these types of equipment.

Offering full accountability and an integrated solution

Final retirement of technology assets touches several departments within an organization, each with unique requirements. When data centers partner with the right data center decommissioning vendor they can reduce their administrative overhead, simplify their vendor relations, and improve their overall accountability.

Internal stakeholders may include the information security officer, IT procurement team, risk and compliance officers, and accounting teams. Each of these stakeholders will evaluate the decommissioning process through a different lens. Making sure the unique needs of these stakeholders are addressed results in a seamless process.

Any professional data center decommissioning vendor will need to provide guidance to ensure these companies receive a comprehensive solution, covering all these needs.

Sean Magann is the global vice president of Sims Lifecycle Services, formerly Sims Recycling Solutions, the global leader in IT asset disposition and data center recycling. Find more about the company’s data center decommissioning processes at simsrecycling.com/reuse/decommissioning. Magann can be contacted at [email protected].