Auditors are becoming increasingly stringent, prompting enterprises to tighten IT asset disposition processes and protocols. One area in particular is the chain of custody, a crucial audit facet. Chain-of-custody gaps are becoming more prevalent due to remote sites, data center scale, and audit pressure, all of which are more difficult to manage across multiple sites. Data breaches tied to lost or mishandled assets cost companies time and trust and can significantly damage enterprise credit and reputation. Proper IT asset management is a proactive solution to chain-of-custody gaps, and we’ve created a practical guide for multisite enterprises to help strengthen the chain of custody ahead of audits. This guide includes steps, controls, and guidance on choosing a partner for multisite ITAD.
Secure Chain of Custody
Chain of custody is verified control of an asset from pickup to final disposition. From end-user devices and network gear to data center hardware, spare parts, and assets, knowing their location at all times reduces risk and chain-of-custody gaps. Compliance is a critical factor for chain-of-custody audits, including NIST 800-88 methods, and R2v3 process expectations. Documentation of the entire ITAD process creates a clean audit trail and leaves no compliance questions. There are multiple roles involved in a secure chain of custody, including asset owner, site contact, carrier, ITAD provider, and auditor. Clear communication tightens the chain of custody and prevents delays and gaps. This becomes more difficult for larger enterprises with multiple sites. Multisite ITAD provides IT asset disposition solutions for each site and helps maintain compliance by ensuring a secure chain of custody.
Core Principles to Apply at Every Site
Multisite projects function the same way as single-site projects, with the same core principles applied to a larger scale.
- Identification – Unique ID tied to asset, user, and specific site. This helps identify and locate assets easily, reducing delays and tightening the chain of custody by linking an asset to a user and site.
- Verification – Two-person check at handoff, photo proof, and seal log to verify chain of custody and device condition.
- Traceability – Transparency starts with traceability and providing clients with time stamps, GPS logs, and signatures at each custody exchange.
- Least-Touch Handling – Packing assets once and tracking them 24/7 for minimal handling.
- Exception Control – Exceptions can cause delays or breaches, and variances should be documented in minutes, not days.
The Multisite Challenge
Multiple sites present many challenges from pickup and ownership to carrier variations and subcontractors, and each may have different rules and regulations.
- Multiple pickup types – Multisite means multiple pickup types, including offices, depots, data centers, and third-party warehouses, which can make logistics a nightmare.
- Mixed ownership – For multiple sites, there are usually a plethora of assets with different ownership structures, such as corporate, leased, and client-owned equipment, and often different rules and regulations for each.
- Carrier variation – Carriers often have different regulations or operations, such as line-haul, white-glove, or regional courier services.
- Subcontractors – Notable challenges for multisite subcontracting include inconsistent operational standards, data security risks, and regulatory compliance, depending on who they are, how they are vetted, and how they are monitored.
Step-by-Step Workflow, Office or Depot
A step-by-step workflow process for offices or depots includes:
Pre-pickup
- Involves a site survey, asset count, risk flags, and a lithium battery check.
- For logistics, include a packaging plan, pallet count, and seal IDs issued in advance to minimize delays.
- Chain of custody form prefilled with site and contact.
On-Site Intake
- Match serials to manifest, and add any found items as exceptions to minimize loss.
- Tag assets, photo each pallet, and record seal numbers.
- Handoff sign-off with time, names, and IDs.
Transport
- GPS route tracking is on at all times, a seal check is performed at each stop, and no ride-alongs are allowed to prevent a data breach.
- Direct to the processor when possible, and note any cross-dock.
Processing
- Reconcile serials to intake and log variances.
- Data sanitization per the selected NIST 800-88 method, and record tool logs.
- Final audit, weight tickets, and downstream vendor IDs if used.
Documentation and Close
- Ensure certificates are issued, deletion logs are attached, and invoice lines are tied to assets.
- Ensure records are stored and searchable by site, pickup date, and PO.
Step-by-Step Workflow, Data Centers, and Labs
Scope and Risks – Risk management and scope can be challenging for multisite enterprises. For example, there are many high-value parts, mixed SKUs, and customer gear on the premises, and data security is critical.
Extra Controls
Some steps to take for multisite data center and lab security include:
- To ensure asset security, secure the cage or room, access device lists, and keep cameras on.
- Work through a live decommission checklist one rack at a time.
- Implement drive removal and bagging at the rack, sealed bins, and chain-link to rack ID for further data security.
- Implement tamper-evident seals, two signatures per move, and a photo at each stage for a clean audit trail.
- Asset slit tracking for parts harvesting, remarketing, and destruction to ensure all assets are where they are supposed to be throughout the process.
- Zero items left behind during exit check, with power and network verified.
Controls You Can Audit
Evidence set – Auditable documentation is crucial to the chain of custody, including photos, seal logs, GPS traces, signatures, tool erasure logs, weight tickets, and downstream certifications.
Sampling – To ensure each site is ready for surprise audits, conduct internal audits on 10 percent of pickups each quarter, and increase the rate if gaps appear.
Metrics
- Check the match rate, serials received vs. manifest, and ensure it is 99.5 percent or higher.
- Data security can make or break audit success. Target a 100 percent erasure success rate and eliminate any failures.
- Target under 0.5 percent for items without a serial match.
- Target 10 business days from pickup to the certificate.
- Document chain-of-custody gaps and target zero for missing hop data.
Policy and Documentation to Keep
Surprise audits are becoming more common as auditors crack down on regulatory compliance. Documentation is crucial to audit success, but it can become overwhelming trying to keep up with multisite paperwork. Each site should maintain a chain-of-custody policy, a list of signatories, version control, and site playbooks for offices, data centers, warehouses, and field swaps. During an audit, a minor mistake can lead to further investigation or legal fines, so it’s always best to keep final records for at least five years and ensure they align with legal requirements. Another significant document to keep on file is the incident process. This includes who to notify, timelines, and customer communication.
Technology Stack That Helps
A core element of managing a multisite chain of custody is building a strong tech foundation. This includes an asset system that stores serials and pickup records, supports barcode or RFID capture via a mobile app that works offline, and more. Digital signatures tied to user identity and timestamps help locate specific assets and their associated users more easily, without guesswork. Security matters even in transit, and logistics technology matters. GPS tracking from carriers or locking devices on high-risk loads adds another layer of transparency and protection on the road. Secure portals for certificates and reports, along with role-based access, provide secure, on-demand access to compliance documentation. Additionally, APIs to feed finance and ticketing tools help strengthen communication across multiple sites.
Third-Party Provider Checklist
Third-party providers can be the difference between audit success and failure, which is why it is essential to maintain strict standards when partnering with outside vendors.
Identity and audits
- Check current certifications, auditor names, and scope.
- Conduct background checks for staff with asset access.
Operations
- Request the names of subcontractors and how they are managed and measured.
- Check vehicle security, cameras, sealed controls, and chain-of-custody forms.
- Check processing controls, segregated cages, drive handling, and tool logs.
Data protection
- Ensure NIST 800-88 methods are in use. Check tools and versions.
- Ensure proof of erasure or destruction for each serial.
Risk and coverage
- Check cyber and cargo insurance coverage levels and ensure additional insureds are named.
- Create a breach response plan with timelines.
Reporting
- Create certificate format samples, and take sample portal screenshots.
- Set SLA targets for pickup, processing, and certificates.
References
- Request 2-3 customer references with multisite scope and contact details.
Common Failure Modes and How to Prevent Them
IT asset management with a multisite scope creates many inevitable failures, but there are proactive ways to prevent them. Mixed pallets are common and can be prevented by separating pallets by site and owner, and by allowing photos and models when there is no serial label. Missing serial numbers are another common occurrence, but requiring scans at pickup and allowing photos and models with missing serial numbers helps locate these assets and prevent delays down the road. For unlogged subcontractors, reject pickup until they are listed and approved to avoid compliance or legal issues. Having customs paperwork and HS codes prepared in advance helps prevent cross-border delays. Lastly, lithium batteries pose a challenge due to their hazardous nature, but following carrier guidance and adding UN-rated packaging can help minimize safety risks.
Multisite chain-of-custody management can feel overwhelming, which is why it’s crucial to find an ITAD partner that can provide IT asset management and disposition services at scale. Plan proactively and contact HOBI today at 877-814-2620 or sales@hobi.com to schedule a consultation for your multisite enterprise.