(U) NGAI 8120.1_Electronic Waste Mgmt_1SEPT2020.pdf

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 8120.1

1 September 2020

CIO-T

SUBJECT: Electronic Waste Management

References: See Enclosure 1.

1. PURPOSE. This Instruction:

a. Establishes policy, assigns responsibilities, delegates authorities, and provides procedures for Electronic Waste (E-Waste) management.

b. Rescinds NGA Directive 8120, “Electronic Waste (E-Waste) Management

Program,” 12 May 2017.

2. APPLICABILITY. This Instruction applies to all NGA civilian employees, military service members, other Government agency personnel assigned to NGA, and contractors, hereinafter referred to as personnel.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy to:

a. Decommission, sanitize, dispose of, and destroy E-Waste in accordance with

(IAW) References (a), (b), (e), (k), (m), (n), (s), and (u).

b. Provide training and guidance for personnel involved in the sanitization and disposal of E-Waste IAW References (k), (l), and (s).

c. Reuse E-Waste to the maximum extent possible.

5. RESPONSIBILITIES. See Enclosure 2.

6. PROCEDURES. See Enclosure 3.

NGAI 8120.1

7. EFFECTIVE DATE. This Instruction is effective on the date of signature.

Mark Chatelain Associate Chief Information Officer

Enclosures

1. References

2. Responsibilities

3. Procedures

Glossary

UNCLASSIFIED

TABLE OF CONTENTS

CHANGE LOG

ENCLOSURE 1: REFERENCES

ENCLOSURE 2: RESPONSIBILITIES

Director, NGA Chief Information Officer Chief Information Security Officer E-Waste Mission Manager Director, Security and Installations Program Managers and Information System Owners

ENCLOSURE 3: PROCEDURES

GLOSSARY

CHANGE LOG

Change Change

Date Revised

By Pages

Affected Change Description

ENCLOSURE 1

REFERENCES

(a) General Services Administration Bulletin FMR B-34, “Disposal of Federal Electronic

Assets,” 29 February 2012

(b) Committee on National Security Systems (CNSS) Directive 504, “Directive on

Protecting National Security Systems from Insider Threat,” September 2016

(U//FOUO)

(c) CNSS Instruction No. 4009, “Committee on National Security Systems (CNSS) Glossary,” 06 April 2015

(d) CNSS Policy 22, “Cybersecurity Risk Management,” August 2016

(e) CNSS Advisory Memorandum Information Assurance 01-10, “Reducing the Risk of

Removable Media in National Security Systems,” December 2010

(f) National Institute of Standards and Technology (NIST) Special Publication (SP)

800-53 Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations,” April 2013, Updated 22 January 2015

(g) NIST SP 800-88 Revision 1, “Guidelines for Media Sanitization,” December 2014

(h) NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations,” September 2011

(i) Federal Acquisition Regulation, Part 45, “Government Property,” Issued June 2020

(j) Intelligence Community Directive (ICD) 503, “Intelligence Community Information

Technology Systems Security Risk Management,” 15 September 2008, Technical Amendment, 21 July 2015

(k) IC Standard 500-34, “Electronic Waste (E-Waste) Management and Disposal,” 24 September 2015

(l) IC Chief Information Officer, “ICD 503 Practitioner Manual,” 29 January 2013

(m) National Security Agency/Central Security Service (NSA/CSS), Information

Assurance Directorate, “The Community Gold Standard Framework,” Version 2.0, 14 October 2014

(n) NSA/CSS Policy Manual 9-12, “NSA/CSS Storage Device Sanitization Manual,” 15 December 2014, Revised 19 December 2017

(o) NGA Directive (NGAD) 8000, “Information Management and the Chief Information Officer,” 12 June 2013, Administrative Update 2, 28 October 2015

(p) NGAD 8010, “Information Systems Risk Management Framework (RMF),” 27 August 2015, Administrative Update 1, 16 November 2015

(q) NGA Instruction (NGAI) 5200.1, “Information Security,” 30 May 2017

(r) NGAI 8010.3, “Removable Media Management and Protection,” 30 August 2018

(s) NGA Manual (NGAM) 4160.1, “Accountability and Management of Property, Plant, Equipment, and Other Accountable Property,” 16 May 2017

(t) NGAM 8010.1, “Information Systems (IS) Risk Management Framework (RMF)

Guide,” 24 July 2015, Administrative Update 1, 06 December 2018

(u) NGA Work Instruction, “Sanitization and Disposal,” 08 February 2019 (located at:

https://www.intranet.nga.ic.gov/org/CIO- T_TO/TOP/TOPC/TOPCA/_layouts/15/WopiFrame2.aspx?sourcedoc=/org/CIO- T_TO/TOP/TOPC/TOPCA/Shared%20Documents/Guidance/NGA%20Manuals/Sanitization %20and%20Disposal%20WI%20v6%203_updated%20FEB%202019.docx&action=default) https://www.intranet.nga.ic.gov/org/CIO-T_TO/TOP/TOPC/TOPCA/_layouts/15/WopiFrame2.aspx?sourcedoc=/org/CIO-T_TO/TOP/TOPC/TOPCA/Shared%20Documents/Guidance/NGA%20Manuals/Sanitization%20and%20Disposal%20WI%20v6%203_updated%20FEB%202019.docx&action=default https://www.intranet.nga.ic.gov/org/CIO-T_TO/TOP/TOPC/TOPCA/_layouts/15/WopiFrame2.aspx?sourcedoc=/org/CIO-T_TO/TOP/TOPC/TOPCA/Shared%20Documents/Guidance/NGA%20Manuals/Sanitization%20and%20Disposal%20WI%20v6%203_updated%20FEB%202019.docx&action=default https://www.intranet.nga.ic.gov/org/CIO-T_TO/TOP/TOPC/TOPCA/_layouts/15/WopiFrame2.aspx?sourcedoc=/org/CIO-T_TO/TOP/TOPC/TOPCA/Shared%20Documents/Guidance/NGA%20Manuals/Sanitization%20and%20Disposal%20WI%20v6%203_updated%20FEB%202019.docx&action=default https://www.intranet.nga.ic.gov/org/CIO-T_TO/TOP/TOPC/TOPCA/_layouts/15/WopiFrame2.aspx?sourcedoc=/org/CIO-T_TO/TOP/TOPC/TOPCA/Shared%20Documents/Guidance/NGA%20Manuals/Sanitization%20and%20Disposal%20WI%20v6%203_updated%20FEB%202019.docx&action=default

ENCLOSURE 2

RESPONSIBILITIES

1. Director, NGA.

a. Establishes and implements an E-Waste program IAW Reference (k).

b. Delegates authority to execute and manage the E-Waste program to the Chief

Information Officer (CIO) IAW Reference (k).

2. CIO.

a. Executes and manages the E-Waste program.

b. Assigns the responsibility to implement and manage the E-Waste program to the

E-Waste Mission Manager (EMM) IAW References (k) and (o).

3. Chief Information Security Officer (CISO).

a. Enforces security controls for media sanitization IAW References (f), (k), and (p).

b. Collaborates with EMM to include E-Waste management and disposal procedures in the NGA information technology (IT) risk management framework IAW References

(h) and (k).

4. EMM.

a. Implements and manages the E-Waste program.

b. Collaborates with Director, Security and Installations (D/SI), to develop and manage processes and procedures to support E-Waste decommissioning, sanitization, disposal, and destruction IAW Reference (k).

c. Develops training materials, conducts E-Waste training, and ensures compliance with E-Waste policy IAW Reference (k).

d. Manages storage areas for IT equipment receipt and sanitization that are allocated by D/SI IAW Reference (s).

e. Ensures that E-Waste sanitization and disposal are conducted IAW References

(g), (k), (s), and (u).

f. Develops, collects, and monitors E-Waste disposal metrics describing what, when, and how E-Waste is sanitized, and the final disposition of the E-Waste IAW Reference (k).

g. Reviews and approves/disapproves E-Waste plans, and informs Program

Managers (PMs) or Information System Owners (ISOs) in writing IAW References (d) and (m).

h. Collaborates with the CISO to include E-Waste management and disposal procedures in the NGA IT risk management framework IAW References (j) and (k).

i. Protects and secures E-Waste during the disposal phase of the System

Development Life Cycle (SDLC) to maximize reuse IAW References (a), (i), (q), and (r).

5. D/SI.

a. Manages E-Waste disposal IAW Reference (s).

b. Prepares and maintains destruction certificates for all IT equipment destroyed

IAW Reference (s).

c. Collaborates with the EMM to develop and manage processes and procedures to support E-Waste decommissioning, sanitization, disposal, and destruction IAW Reference (k).

d. Ensures E-Waste destruction is processed IAW Reference (s).

6. PMs and ISOs.

a. Plan, program, budget, and execute funding for E-Waste decommissioning, sanitization, disposal, and destruction IAW References (a), (k), and (p).

b. Ensure that E-Waste decommissioning, sanitization, disposal, and destruction are integrated into the SDLC IAW Reference (t).

c. Develop E-Waste plans and submit plans to EMM IAW References (d) and (m).

d. Oversee and manage media sanitization and disposal actions IAW References (f), (q), (s), and (u).

ENCLOSURE 3

PROCEDURES

1. Personnel who identify excess or unwanted IT equipment should contact the appropriate PM or ISO and request the IT equipment's removal. The PM or ISO will inform the requestor of any required additional actions.

2. If the PM or ISO is unknown, personnel should submit an excess equipment service request through the IT Service Manager tool, Service+. The service request will then be routed to the appropriate PM or ISO based on the barcode of the equipment. If the equipment does not have a barcode, the service request will be processed as found equipment.

3. Detailed sanitization and disposition procedures for PMs and ISOs can be found in NGAM 4160.1, “Accountability and Management of Property, Plant, Equipment, and Other Accountable Property,” and NGA Work Instruction, “Sanitization and Disposal.”

(References (s) and (u))

GLOSSARY

Asset A major application, general support system, high impact program, physical plant, mission critical system, personnel, equipment, or a logically related group of systems.

(Reference (c))

Decommission

Remove an information system from service. (Definition created by NGA for NGA purposes only.)

Destroy, destroyed, or destruction

A method of sanitization that renders Target Data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the media for storage of data. (Reference (c))

Disposal A release outcome following the decision that media does not contain sensitive data. This occurs either because the media never contained sensitive data or because sanitization techniques were applied and the media no longer contains sensitive data. (Reference (k))

Electronic Waste (E-Waste)

Obsolete or discarded electronic media, memory, or equipment near or at the end of its useful life that is no longer usable or required by an information system.

(Reference (k))

Information System

(IS)

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (Reference (c))

Information System Owner (ISO)

Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system. (Reference (c))

Media Physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts (but not including display media) onto which information is recorded, stored, or printed within an information system. (Reference (c))

Program Manager Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system. (Reference (c))

Risk Management Framework (RMF)

A structured approach used to oversee and manage risk for an enterprise. (Reference (k))

Sanitize Process to remove information from media such that data recovery is not possible. It includes removing all classified labels, markings, and activity logs. (Reference (u))

System Development Life Cycle

The scope of activities associated with a system, encompassing the system’s initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation. (Reference (c))

Total Asset Management (TAM)

A group of federated systems to produce an enterprise-level asset management capability and supporting processes associated with asset management. (Reference (s))