Quiero saber acerca de...

lotter on DSK11XQN23PROD with RULES1

Federal Register / Vol. 86, No. 205 / Wednesday, October 27, 2021 / Rules and Regulations covered communications equipment and services. These different categories may pose different security threats based on their individual capabilities, including processing and/or retaining sensitive network or customer identifiable information. Therefore, as part of the best practices, the Bureau identifies recommended practices for treating covered communications equipment based on the category of equipment. The Bureau understands that it may be more efficient for a destruction company to destroy and recycle a large amount of equipment at once, for example, by destroying all equipment in a box at one time that may include a combination of the categories of equipment described in the following, and the Bureau defers to both the provider and the destruction company as to the most efficient process to achieve the required disposal obligation.
7. The categories are organized by level of risk, starting with equipment posing the highest risk, based on whether the equipment retains or processes data. Category 1 equipment is equipment that processes and retains data. Category 2 equipment is equipment that processes but does not retain data. Category 3 equipment is equipment that does not retain or process data. For category 1 equipment, the Bureau recommends the provider sanitize any media, followed by physical destruction and then recycling.
For category 2 equipment, the Bureau recommends physical destruction and then recycling. For category 3
equipment, the Bureau recommends recycling this equipment. The Bureau will consider category 3 equipment as inoperable if permanently dismantled from other communications equipment and services and it is unable to be reconnected to any other communications equipment.
Reimbursement Program participants are encouraged to retain certain documentation, based on the categories of covered communications equipment, including certificates of media disposition and certificates of destruction, which will help participants and the Bureau verify compliance with their disposal and verification obligations.
8. Guidance is also provided on selecting certified disposal services and e-waste recyclers. If using a third party, the Bureau recommends using a company that provides complete asset management solutions, from removal to destruction, including transportation and chain of custody tracking to avoid the potential for misplaced or lost equipment containing sensitive
VerDate Sep<11>2014

18:39 Oct 26, 2021

Jkt 256001

information. Providers may utilize one company for the entire disposal and recycling process, or different companies for different aspects of the disposal and recycling process based upon the categories of covered communications equipment outlined in this document. Because the Commission in the 2020 Supply Chain Order, 86 FR
2904, January 13, 2021, prohibited the transfer of operable covered communications equipment or service to non-U.S. providers, the Bureau recommends providers use U.S.
disposal companies that conduct the disposal process on U.S. soil.
Equipment is still considered operable until it is properly disposed.
9. In particular, the Bureau recommends providers use a U.S.
disposal company registered with the U.S. Department of States Directorate of Defense Trade Controls pursuant to the International Traffic in Arms Regulations ITAR. The Bureau agrees with Advanced Technology Recycling that utilizing ITAR processing guidelines is an ideal mechanism to ensure sensitive electronics as outlined in the Secure Networks Act are properly disposed of in a manner that protects national security. While the covered communications equipment may not fall within the scope of ITAR, the Bureau finds that an ITAR-registered disposal company will likely have the procedures in place and the facilities necessary to effectively handle the safe and secure destruction of covered communications equipment, including the most sensitive equipment. The Bureau finds that, based on the record, ITAR-registered companies likely can provide complete asset management services, including tracking equipment, maintaining records, and documentation and certifying destruction. According to Advanced Technology Recycling, ITAR registered service providers must follow strict disposal guidelines to ensure scrap materials generated throughout the disposal process remain on U.S. soil and be processed exclusively by U.S.
persons. ITAR-registered companies are required to maintain records concerning manufacture, acquisition, and disposition of defense articles, including technical data, subject to ITAR, and are subject to civil and criminal penalties for violations.
According to Advanced Technology Recycling and Gannon & Scott, ITARregistered companies may also hold ewaste recycling or other certifications and provide media sanitization services, allowing for a one-stop disposal facility to handle the disposal of different
PO 00000

Frm 00027

Fmt 4700

Sfmt 4700

59305

categories of equipment according to the best practices outlined in the released document.
10. The Bureau agrees with Teltech Group that through the disposal process it should consider environmental issues so that the covered communications equipment do not create environmental problems.
Accordingly, the Bureau recommends for providers to recycle covered communications equipment to ensure the secure and environmentally responsible disposal of equipment as recommended by the Environmental Protection Agency EPA. Consistent with EPA guidelines, the Bureau recommends utilizing electronic waste e-waste recyclers that are certified by either the Responsible Recycling R2
Standard for Electronics Recyclers or the e-Stewards Standard for Responsible Recycling and Reuse of Electronic Equipment e-Stewards. As noted in this document, ITAR-registered companies may also hold R2 and eStewards certifications. For example, according to Advanced Technology Recycling, as an ITAR-registered disposal company, disposal processes are carried out . . . at R2 certified and ITAR registered facilities.
11. The best practices also provide guidance on disposal verification documentation. The Bureau recommends providers retain shipping or transportation documentation, including detailed inventories supported by an affidavit, dates, locations, transportation service provider name, and means of transportation. These may be kept individually or as part of a larger asset management solution. Reimbursement Program participants are encouraged to retain documentation, including certificates of media disposition and certificates of destruction, that will help participants and the Bureau verify compliance with their disposal and verification obligations. These recommendations reflect input received from the Rural Wireless Association, Teltech Group, and the Competitive Carriers Association on the importance of tracking the removal and destruction of covered equipment and on clarifying the level of detail any documentation will need to contain to be compliant.
12. In sum, these best practices will help ensure the security of sensitive data processed or retained by the covered equipment, including network and customer proprietary information, from unauthorized access. These best practices will also help participants comply with the requirements of 1.50004j of the Commissions rules, to ensure that covered communications
E:FRFM27OCR1.SGM

27OCR1