Page 262

EAP Policy Manual FFY24 Chapter 13 Program Fiscal Management Page 16 • Adequate maintenance procedures must be developed to keep the property in good condition. • If the Service Provider is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return. • EAP-funded sensitive equipment must remain recorded in the Service Provider’s inventory records while retained in the Service Provider’s possession for the reasonable estimated life of the item. See the table below for the estimated useful life of possible EAP-related sensitive equipment. Reporting Requirements A copy of the EAP-related equipment inventory (including equipment covered by the relevant federal requirements noted above) must be provided upon request. Access to retained equipment for inventory reconciliation must also be provided upon request. Disposition When original or replacement sensitive equipment acquired under a grant is no longer needed for EAP-related activities, disposition of the sensitive equipment will be made as follows: • Sensitive equipment may be retained or sold, but any information stored in the equipment that is subject to data practices requirements must be completely removed prior to disposition. Removal must be done by overwriting. Overwriting, also called sanitizing or scrubbing, is the accepted method for preventing the recovery of data from computer hard drives. Overwriting of data means replacing previously stored data on a drive or disk with a predetermined pattern of meaningless information. Overwriting software must have the ability to purge all data or information from the physical or virtual drives, thereby making it impossible to recover any meaningful data by keyboard or laboratory attack. Equipment capable of holding sensitive data must be overwritten at least six times before their disposal or transfer will be approved. • Approval must be obtained for disposition of sensitive equipment as defined in this section. • In cases where a Service Provider fails to take appropriate disposition actions, Commerce may direct the Service Provider to take disposition actions. Right to Transfer Title Commerce reserves the right to transfer title of sensitive equipment to Commerce or a third party named by Commerce. Such transfers shall be subject to the following standards: • The property shall include sensitive equipment as defined in this chapter or be identified in the grant contract or otherwise made known to the Service Provider in writing.