Media Storage Policy

Overview
The quality and integrity of Switch’s media protection mechanisms allow information to be provided at a greater level of security than can be achieved with system-based protection mechanisms alone. Without media protection mechanisms, the potential exists that Switch’s, or Switch’s clients, information assets could be exposed to an unnecessarily high level of risk, particularly in circumstances where that information is taken out of the information system.

Purpose
The purpose of this policy is to put safeguards in place to protect sensitive/critical information, intellectual property, systems and network of Switch and Switch’s clients.

Scope

This policy applies to employees, contractors, consultants, temporary, and other workers at Switch, including all personnel affiliated with third parties, who use the network or equipment that is owned or leased by Switch, and to all said network components and equipment. This includes but is not limited to:

• Removable magnetic media including external hard disk drives, external devices containing hard disk drives, floppy disks, and magnetic tape.
• Removable flash-based media including thumb drives, digital media players, digital cameras, smart phones, etc.
• Optical media including DVDs and CDs.

Policy

All media will be protected with the following practices

• All privileged information when stored out of system (via information media) will be protected by media protection mechanisms to ensure the highest levels of security. Non-privileged information will be protected to ensure the highest levels of integrity and availability.
• Protect (i.e. physically control and securely store) information system media containing NPI, both paper and digital.
• Removable media should be physically secure when not in use.
• Removable media should only be used when no alternative security method (e.g., cloud storage, encrypted network transfers) is available.
• PHI data is stored strictly inside of Switch’s database/applications and is not to be stored on computer workstations or removable media storage.
• Removable media should not be used for long-term storage of any client data.
• Switch will limit access to sensitive data on removable media to authorized users, only when required for business purposes.

Procedure

• The Project Manager, Producer, or Production Assistant will be responsible for the distribution of any removable media before any business meeting or event to authorized users.
• The Project Manager, Producer, or Production Assistant will be responsible for the collection of all removable media following the business meeting or event, within 5 business days.
• Removable media will be delivered to IT within 5 business days of the end of the event.
• Removable media, upon its return to IT, will be formatted & overwritten with sanitizing data to prevent restoration at the conclusion of its use.