What is risk management and why does it matter? Risk is the net negative impact of the exercise of vulnerability, considering both the probability and the impact of occurrence. Risk management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. Ð National Institute of Science and Technology.

Disposal of surplus information technology (IT) equipment without taking appropriate measures to erase the information stored on the system's media can lead to the disclosure of sensitive information, embarrassment to the agency, costly investigations, and other consequences. Sharing of media within the government or between government and contractors also presents security issues. Federal agencies must establish policies and procedures to ensure the proper disposition of sensitive automated information. Sanitization of magnetic media means the removal of data from storage media so that, for all practical purposes, the data cannot be retrieved. The three techniques are commonly used for media sanitization, overwriting, degaussing, and destruction.

Applicable laws • The Privacy Act of 1974 • The Computer Security Act of 1987 • The Computer Matching and Privacy Protection Act of 1988 • The Electronic Communications Privacy Act • The Gramm-Leach-Bliley Act • The Health Insurance Portability & Accountability Act (HIPAA)

Stakeholders • Federal/State/Local government The Department of Defense 5220-22M Standard States: Non-Removable Rigid Disks" or hard drives must be sanitized for reuse by "Overwriting all addressable locations with a character, its complement, then a random character and verify."

Environmental Liability The rise of technology may have consequences for the environment. There are many materials within technology products that pose a threat to the environment, including mercury, beryllium and plastics. Left to stand in an open landfill, these materials can pollute the land and immediate ground water supply. However, the greater threat is may be from the most common pieces of your infrastructure. The Environmental Protection Agency has determined that Monitors and Battery Back-Up Systems are classified as hazardous waste because of the presence of Lead, Nickel/Cadmium and other materials. With this designation comes the ability to levy fines and penalties against organizations that are found to be disposing of these types of assets in an improper manner.