At some point, a data center will need to be partially or fully decommissioned for one reason or another. For example, you may decide to replace the physical hard drives with newer SSDs for improved speed and reliability, or even more radically, you may decide to fully transition into cloud storage.
In a case like this example, the unused hard drives must be decommissioned, not only to ensure a smooth transition to the new system but also to protect the security and integrity of data contained within the unused hard drives.
There are also various other situations that may demand an appropriate decommissioning process. A data center often involves the storage and transportations of sensitive data, which is stored within a potentially massive amount of storage devices. Without a proper decommissioning process, unsecured sensitive data can expose your company to potential financial and legal risks.
With that being said, here we’ve compiled a checklist to help you develop a comprehensive data center decommissioning plan. You can use this checklist to ensure your decommissioning project stays on track and you can finish the project securely and timely.
Data Center Decommissioning Checklist
Phase 1: Defining the scope of work
The first phase is about outlining all the details of the decommissioning process, and we should begin by defining the scope of work:
- The purpose(s) of the decommissioning project
- KPIs to measure the success of the project
- Timeline of the project (when the project must be done)
- Budget estimation
- Establish a decommissioning project team
- Assign a project manager
- List all the stakeholders that are going to be involved in the project
- The total size of the data center
Phase 2: Item audit
- How much equipment needs to be removed?
- Use network discovery tools to identify assets, follow up with physical reviews.
- List of all hardware and software assets that need to be decommissioned
- Servers
- Racks
- Storage equipment
- Hard drives
- SSDs
- Networking equipment
- Software assets
- …..
- ….
- Etc. (add as needed)
- Compare list of assets to pre-existing Configuration Management Databases (CMDBs)
- Identify pieces of equipment that need special considerations/technical expertise to move them
- Develop a detailed asset map listing equipment and location of items to be decommissioned. Compare with your CMDBs if necessary.
- Contact a Data Center Decommission provider to determine what you are going to do with each piece of asset: reuse, sell, destruction/recycle, etc.
Phase 3: Planning the decommissioning project
Based on the itemization you’ve done in the previous phase, in this phase, you can start planning the execution of the decommissioning project.
- Develop an execution plan
- List of all the activities to be performed
- PIC for each task
- Roles and responsibilities of different stakeholders
- Develop a schedule/timeline for the decommissioning project.
- Identify whether the decommissioning project will coincide with work hours (especially peak hours) and whether you’ll need to issue notifications about potential service downtime
- Establish backup systems and workflows to make sure there is not going to be a critical loss of power or data
- Identify and cancel vendor maintenance contracts for affected equipment
- Prepare tracking numbers for assets that are going to be decommissioned
- Prepare contact list for potentially affected stakeholders and the preferred method of communication for each
- Reconfirm the asset list
- Removal instructions for emergency generators and auxiliary equipment
- Removal instructions for cooling systems, including cabling, piping, ductwork, and additional tools
Phase 4: Preparing equipment, supplies, and labor requirements
Consider the tools and labor requirements at each step of the decommissioning project:
- Device shredders
- Degaussers
- Forklifts
- Hoists
- Pallet
- Packing foam
- Hand tools
- Boxes
- Crates
- Labels
- Packing materials (bubble wrap, tape, poly bags, etc. )
- Who will oversee and execute each task (if you are using external vendors, make sure to perform the necessary background/security check ahead of time)
Phase 5: Data eradication and destruction of storage devices
- Gather relevant stakeholders ahead of the actual decommissioning process, discuss the details and gather input
- Identify the types of data your organization routinely transports and/or generates, decide how you should deal with each category of data
- Establish clear data eradication protocols. Define whether there are any critical steps that will require human supervision and authorization before proceeding
- Decide on appropriate data eradication method for each storage device and/or each type of data: physically destroying the drive (shredding/incineration), degaussing, using software tools to securely wipe data, etc.
- Be clear and comprehensive in your organization’s expectations around the process of secure data eradication and/or physical destruction
- Identify which devices will be transported offsite for eradication/destruction, and which will be sanitized on-site
- During the actual decommission, safely disconnect the equipment from the network and tag assets for decommissioning.
Phase 6: Packing and clearing up
- Label each piece of decommissioned equipment to indicate where it is going and the owner of the device (for assets destined for recycling/refurbishing)
- Attach printouts to the equipment with instructions for where the equipment would be moved
- Prepare a dedicated space for packing assets depending on the number of decommissioned equipment and/or required size.
- Use the appropriate packing materials for each asset, as you’ve planned in the previous steps
- Use appropriate asset management software to track all assets
- For on-site decommissioning, make sure to follow the steps laid out in the project plan for clearing the teardown space
Phase 7: Finalizing and evaluation
- Re-check with the IT and accounting teams whether decommissioned assets have been recorded properly
- Coordinate with your chosen IT Asset Decommissioning (ITAD) provider to confirm secure eradication of data.
- Get Certification of Destruction (CoD) for relevant assets/data
- Calculate the total value recovered and returned to your IT budget (with sales of used equipment, etc. ). Appropriate ITAD providers will assist you with each stage of the decommissioning process to ensure you are maximizing your return from unused assets
- Review all relevant documentation before and after the process to ensure compliance
Conclusion
To recap, your data center decommissioning plan should consider seven different phases:
- Defining the scope of work
- Item audit
- Planning the decommissioning project
- Preparing equipment, supplies, and labor requirements
- Data eradication and destruction of physical storage
- Packing and clearing up
- Finalizing and evaluation
It’s also crucial to document the entire decommissioning planning and the actual process so you’ll have a recorded paper trail for identifying errors, evaluate process improvements, and measure the success of the decommissioning process.