Device and Media Controls Policy

The purpose of this policy is to establish requirements for the protection, handling, transportation, storage, reuse, and disposal of SUNY Plattsburgh information technology devices and electronic media. These controls are intended to safeguard University-owned hardware, electronic media, and institutional information against unauthorized access, theft, loss, damage, disclosure, or destruction.

This policy supports the confidentiality, integrity, and availability of University information assets while ensuring compliance with applicable laws, regulations, SUNY policies, and New York State information security requirements.

 Review Process / Approval

This policy applies to:

• Information Technology Services (ITS)
• All faculty, staff, and students using University-owned devices
• Temporary employees
• Student employees
• Contractors and consultants
• Third-party service providers
• Departments responsible for University-owned technology assets
• Any individual authorized to possess, transport, maintain, or dispose of University-owned information technology devices or electronic media

Device — Any University-owned computer, server, laptop, tablet, smartphone, network appliance, peripheral, or other information technology hardware.

Electronic Media — Any physical or removable media capable of storing electronic information, including hard drives, SSDs, USB storage devices, optical media, backup tapes, and memory cards.

Media Sanitization — The process of permanently removing or destroying information from electronic media to prevent recovery.

University Information — Any electronic information created, received, maintained, or stored by SUNY Plattsburgh in support of its educational, research, administrative, or operational functions.

University-Owned Device — Any computing or electronic device purchased, leased, or otherwise owned by SUNY Plattsburgh.

Information Technology Services shall:

• Establish standards for device and media protection.
• Maintain procedures for media sanitization and disposal.
• Coordinate equipment surplus and electronic media destruction.
• Maintain asset management practices where applicable.
• Investigate reports of lost or stolen devices.
• Implement technical safeguards such as encryption where appropriate.
• Coordinate secure disposition of retired equipment.

Department heads shall:

• Ensure University-owned devices are used appropriately.
• Notify ITS of lost, stolen, transferred, or retired equipment.
• Support periodic inventory activities.
• Ensure departing employees return University-owned technology assets.

Supervisors shall:

• Ensure employees understand their responsibilities for protecting
  University-owned equipment.
• Coordinate return of devices during employee offboarding.
• Notify ITS when devices should be reassigned or retired.

Individuals assigned University-owned devices shall:

• Exercise reasonable care in protecting assigned equipment.
• Prevent unauthorized access to devices and electronic media.
• Report lost or stolen devices immediately.
• Return all University-owned devices upon request or separation from the
  University.
• Not dispose of or transfer University-owned devices without ITS authorization.

7.1 Device Issuance

ITS or authorized departments shall issue University-owned devices according to established asset management procedures.

Assigned devices remain the property of SUNY Plattsburgh.

7.2 Transportation

Users transporting University-owned devices shall:

• Maintain physical possession whenever practical.
• Avoid leaving devices unattended in public locations or unsecured vehicles.
• Protect devices from environmental damage.
• Use secure carrying cases when appropriate.

7.3 Secure Storage

University-owned devices and electronic media shall be secured when not in use.

Devices containing confidential or restricted information shall receive additional physical protection appropriate to the sensitivity of the information.

7.4 Media Sanitization

Prior to reassignment, surplus, repair, or disposal, ITS shall sanitize electronic media using approved methods appropriate for the media type.

Media that cannot be effectively sanitized shall be physically destroyed.

7.5 Disposal

Electronic devices and storage media shall be disposed of through ITS-approved surplus, recycling, or destruction processes.

Departments shall not independently dispose of University-owned electronic equipment.

7.6 Lost or Stolen Equipment

Users shall immediately report lost or stolen devices to ITS and their supervisor.

Where appropriate, ITS may:

• Disable access credentials.
• Initiate remote device management actions.
• Assess potential exposure of University information.
• Coordinate incident response activities.

7.7 Offboarding

Upon separation from the University or transfer to another position, employees shall return all University-owned devices, storage media, and related equipment before their final day of employment or as otherwise directed by the University.

ITS shall verify the return of assigned technology assets, preserve University-owned information as necessary, and prepare returned equipment for reassignment or secure disposal in accordance with established procedures.

7.8 Exceptions

Exceptions to this policy require the written approval of the Chief Information Officer (CIO) or designee in consultation with the Information Security Officer (ISO). Approved exceptions shall document the business justification, compensating controls, scope, duration, and associated risks, and shall be reviewed periodically.

None

State University of New York

• SUNY Information Security Policy
• SUNY Records Retention and Disposition Schedule

Related SUNY Plattsburgh Policies

• SUNY Information Security Policy 6900
• Responsible Use of Technology Resources Policy
• NetID Policy
• Vendor Access to College Networks Policy
• Information Security Incident Response Policy

There are no specific trainings identified with this policy.