12. Electronic and physical records containing Harvard confidential information must be properly disposed of so that the information cannot be retrieved or reassembled when no longer needed or required to be kept.

Disposing of Devices

D5: The information stored on the device must be protected against access when the device is disposed of.

Secure disposal

SB11: Information designated level 3 or 4 must be properly disposed of by securely overwriting the information or physically destroying the media when no longer needed, whether the system is managed directly by Harvard or via contract with a third-party service provider for Harvard's use (e.g. IaaS, SaaS).