Counting just adults 25 or older, 24.1% of the U.S. workforce telecommutes. About 5.5% of workers aged 16 to 24 also work remotely. The corporate world is no longer within a building’s walls. Many workers use company-issued laptops and other office equipment from their home office.
When that worker decides to leave the role, the process becomes complex and must consider security measures and legal obligations. Reclaiming and securely logging their laptops and other hardware are priorities. If you fail to do it correctly, the financial impact is tremendous.
You risk the employee stealing private information. If items are not accounted for, you risk losing intellectual property. This leads to severe fines and legal costs for regulatory compliance violations, such as GLBA or HIPAA violations. ERI’s guide covers how to safely collect and log a remote employee’s company laptop.
Pre-Offboarding: The Legal and Operational Plan
When you allow employees to work from home, you need a legal and operational plan in action from that point forward. It should be part of onboarding.
A legally binding hardware agreement must accompany any company equipment assigned to an employee. It sets the rules for what happens when that employee resigns or is terminated. Make sure it covers:
- The names and items handed to the employee.
- Returning the laptop and any associated equipment.
- The condition the equipment is expected to be in.
- Consent that if the equipment isn’t returned in X days, the company will take legal action.
As some states have laws banning paycheck deductions for unrecovered company property, it’s not advisable to threaten to deduct the value of company equipment from the final paycheck. Stick to clauses about taking legal action to avoid potential labor law violations.
Verification: Regular Asset Inventory Audits
Once you have the signed and dated hardware agreement, make it known that regular asset audits are necessary. Your worker needs to bring equipment to the office for these audits or allow an IT professional to enter their home.
Make sure your IT department conducts regular audits of that equipment. Double-check the models and serial numbers to ensure the item the worker possesses matches your list.
You also want to make sure the software on the device matches the approved list, and that software updates are performed regularly. Verify that the worker’s address and contact information haven’t changed.
Final Work Hours: Lockout Steps
The final part of an operational plan concerns what happens during an employee’s final working hours. Security protocols are necessary to prevent employees from extracting unauthorized data or accessing the secure network.
You have to decide whether to wipe the data, lock the system, or send it back to the office without additional precautions. It may not be advisable to perform a factory reset before your IT team has a chance to inspect the device for breaches or theft.
Remote Lock/Firmware Lock options are ideal. They lock the exiting employee out of the system, suspend active sessions, and ensure the system is encrypted during transfer. If that’s not feasible, revoking the employee’s access keys and invalidating their credentials is another option.
Shipping: Safely Reclaim Devices
Now that the employee’s access is blocked, it’s time to start reclaiming the devices. You shouldn’t expect the employee to pay for this. Instead, use customized, prepaid electronic return boxes. Send that kit to the employee’s home with:
- A checklist of what’s to be returned.
- Packaging instructions detailing how to package items to prevent damage.
- Waterproof boxes and foam inserts to package everything, along with return ground shipping, to meet lithium-ion battery compliance.
Don’t ask the employee to drive to the office, post office, or shipping facility. Instead, provide a number to call for scheduling the carrier pickup.
Security: Know the Chain of Custody
As soon as the equipment leaves your former employee’s house, you need to know the chain of custody throughout its transfer and upon its arrival at your company. This must be documented to ensure nothing gets lost, misplaced, or mishandled. Tracking IDs help during transportation, but there’s more than that.
Once the package arrives at your office building, warehouse, or facility, you need a documented process that maintains the chain of custody. Having this proof of where items are and what process they are in is essential. It protects you against future lawsuits if there’s ever a question about your compliance with state and federal regulations.
- Logging Process: Your IT department needs to have a checklist to follow. It should include:
- Inspect the outer packaging for tampering or damage. Take photos of anything suspicious or concerning.
- Unboxing: Unbox the items and verify that the serial numbers match those in the IT asset management records. Check that all cables and peripherals are included.
- Inspection: Once the serial numbers are verified, inspect the item for any cosmetic or structural damage. Are there missing keys, cracks, or broken hinges? Take photos to document any concerns.
- Update HR and IT Asset Management Systems: Once the inspection is complete, update the asset’s status. If it’s being assigned to someone else, note that. If it’s too damaged for reuse, mark it as pending ITAD. Keep systems up to date with the current status to ensure you have an accurate inventory.
- Legal Obligations: If your employee was terminated or filed a complaint against your company, mark the system with a note about pending legal obligations. With a litigation hold, your legal team or HR department can preserve possible evidence. Once marked, move the item to a safe or locked storage area.
- Data Security: Before you reassign or recycle electronic devices, the hard drive needs to be sanitized. Factory resets are rarely sufficient to meet regulatory requirements. Instead, aim for media sanitization methods that meet the NIST Special Publication 800-99 Rev. 1 guidelines.
It’s often easier to partner with an ITAD specialist when recycling or decommissioning office electronics. This provides you with the Certificate of Destruction that verifies that the storage media was sanitized using overwriting techniques or shredded at an electronics recycling facility.
Choose the Best ITAD Partner
When offloading remote employees, you need a comprehensive action plan that involves your human resources, IT, legal, and security teams. If you plan to recycle those used electronics, partner with an ITAD provider who is certified and offers total transparency.
ERI provides secure transportation with real-time tracking. The chain of custody is the first step, and then we follow strict data sanitization standards before our recycling or refurbishing takes place. Reach us online to learn more about our electronics recycling and data destruction.