Standard:
YALE-MSS-7.4: Re-use or dispose of systems securely
YALE-MSS-7.4.1: Follow the University Chain of Custody process for devices being re-used or disposed of
Low Risk Endpoint
Not Required
Moderate Risk Endpoint
Not Required
High Risk Endpoint
Required for HIPAA
Low Risk Server
Not Required
Moderate Risk Server
Not Required
High Risk Server
Required for HIPAA
Low Risk Mobile Device
Not Required
Moderate Risk Mobile Device
Not Required
High Risk Mobile Device
Required for HIPAA
Low Risk Network Printer
Not Required
Moderate Risk Network Printer
Not Required
High Risk Network Printer
Required for HIPAA
Details
Chain of custody is a documented process that tracks the collection, handling, transfer, and disposition of IT assets.
If an IT system is leaving a Yale covered entity, a Chain of Custody form is required. Yale mandates this whether the system is being re-purposed for Yale business or personal use.