CCTV and Access Control on Your Business Network

A security installer will ask for a spare port on your office switch, and it is almost always a mistake to give them one. Cameras and door controllers are internet-connected computers running vendor firmware that is rarely patched, frequently shipped with default credentials, and often configured to reach outward to a manufacturer’s cloud. Put them on the same network as your file server and you have handed an attacker a route in through a device your IT provider does not manage and your installer does not monitor.

Network segmentation means placing physical security devices on their own VLAN, with firewall rules that define exactly what they may talk to, rather than on the same flat network as workstations and servers. It is the single control that makes everything else on this page survivable.

Cameras are computers, and they are the worst-maintained computers in the building

An IP camera runs an embedded Linux build, a web server, a streaming stack and often an RTSP service. It has an administrator account, a firmware version, and a set of open ports. That is a server, sold as a fitting.

The difference is that nobody owns it. Your MSP does not know it exists because it was installed by the security contractor during the fit-out. The security contractor commissioned it three years ago and has not touched it since. The firmware has not been updated because updating it requires someone to log into a controller that nobody has the password for. Meanwhile the device sits on the same subnet as your accounting system.

The ACSC’s Information Security Manual builds its media, patching and procurement guidance around the assumption that someone is accountable for each device. For physical security hardware in an SMB, usually nobody is. Naming an owner is step zero.

Segment first, argue about brands later

The design is not complicated and it does not require expensive hardware.

Put cameras, recorders, door controllers and intercoms on a dedicated VLAN, separate from staff, servers, guest wi-fi and printers. Deny that VLAN any access to your production network by default. Then open only what is genuinely required: the recorder needs to reach the cameras, an administrator workstation or a jump host needs to reach the recorder’s management interface, and time sync needs to work.

Block outbound internet access from the camera VLAN unless a specific device needs it for a specific reason. Many cameras will happily phone home to a manufacturer’s cloud relay by default, which is how “we never opened a port” turns into a device reachable from outside. If a cloud-managed platform genuinely requires outbound access, allow it to named destinations rather than to the whole internet.

Never port forward to a recorder or camera. If someone needs remote viewing, put it behind a VPN or use the vendor’s authenticated cloud relay with multi-factor authentication on the account. Port forwarding a network video recorder to the internet is the specific configuration behind most publicly indexed camera feeds.

This is a normal capability on any competent SME network gear. It is worth deciding the switching and firewall platform you choose before the security tender goes out, so the installer is designing into your network rather than around it.

Default credentials and remote access are the two failure modes

Two configuration failures account for most compromises of physical security systems.

The first is credentials. Devices ship with a documented default login, and installers routinely set one shared password across a whole site so any technician can get in. That password ends up on a label inside the recorder, in the installer’s job notes, or in a text message. Require unique credentials per device, stored in your password manager, and require the installer to hand over the administrator accounts at practical completion rather than retaining sole possession of them. If an installer will not give you the admin account for equipment you own, that is the answer to whether you should engage them.

The second is remote access. Many systems include a vendor remote support capability enabled by default, sometimes as a peer-to-peer tunnel that traverses NAT without any firewall rule. Turn it off unless you have consciously decided to use it. Ask specifically: does this system establish any outbound connection to the vendor, and can the vendor access my footage.

Multi-factor authentication belongs on every management portal in this stack. If the platform does not support it, that is a procurement signal.

Supply chain and firmware risk is real, and it is not evenly distributed

Cheap IP cameras are cheap for reasons that matter. Many are white-labelled from a small number of original manufacturers, which means a vulnerability in one brand’s firmware often affects a dozen brands you have never heard of. Support lifecycles are short or undefined. Security advisories may not be published in English, or at all. Some governments have restricted particular manufacturers from their own networks on national security grounds, and while those restrictions do not bind a private Australian business, they are a signal about the vendor’s engineering and disclosure practices.

The ISM’s guidance on cyber supply chain risk management is the right frame. Before purchase, ask: who actually manufactures this, how long will firmware updates be published, where are security advisories posted, and what is the process for applying an update. A vendor who cannot answer the second and third questions is selling you an unpatchable device.

The trade-off is honest: reputable brands with published support lifecycles cost more per camera, sometimes considerably. Segmentation reduces the blast radius of the cheap option but does not eliminate it, because the recorder still holds your footage and the cameras still see your premises.

PoE and cabling: specify it before the walls close

Power over Ethernet is the reason camera installs look simple and then are not.

The IEEE 802.3 standards define the power classes: 802.3af (Type 1) delivers up to 15.4 W at the switch port, 802.3at (Type 2, commonly called PoE+) up to 30 W, and 802.3bt (Types 3 and 4) up to 60 W and 90 W. A fixed indoor dome will run happily on 802.3af. A pan-tilt-zoom camera, a camera with a heater or blower for outdoor use, or an intercom with a screen will need PoE+ or better.

The mistake is budgeting per port and not in total. A switch may support PoE+ on every port and have a total power budget that cannot sustain all of them at once. Add up the actual draw of every device plus headroom, and size the switch to that figure, not to the port count.

Cabling is the part you cannot change later. Run Cat6 as a minimum and Cat6A where you may want higher speeds or longer PoE runs, because heat rise in bundled cable under PoE load is a real constraint. Respect the 100 m channel limit, which includes patch leads at both ends, and plan a midspan cabinet where a run would exceed it. Terminate everything into the comms room on a patch panel and label both ends. Pull spare cable to every camera and reader position while the ceiling is open, because the second visit costs more than the cable.

Cabling that connects to the telecommunications network is regulated, and the instrument changed recently, so check what your installer is quoting against. The current rules are the Telecommunications (Cabling Provider) Rules 2025, made by ACMA under subsection 421(1) of the Telecommunications Act 1997, registered as F2025L00386 and in force from 31 March 2025. They repealed the Telecommunications Cabling Provider Rules 2014, so a quote or a compliance pack still citing the 2014 rules is out of date.

Three obligations matter to you as the customer. Under section 21, the cabling work must be performed by a registered cabling provider holding the class of registration that covers the work, or by someone who is directly supervised at all times by such a provider, and that supervisor accepts full responsibility for the work. Under section 23, the work must comply with the Wiring Rules, which the instrument defines as AS/CA S009:2020 Installation Requirements for Customer Cabling. Under section 25, the registered cabling provider who performed or supervised the work must, as soon as practicable after it is completed and whether or not they have been paid, prepare a statement that gives their name, contact details and proof of registration, identifies the cabling work, and states that it has been completed and complies fully with the Wiring Rules. They must give that statement to the customer who engaged them, keep a copy for at least one year, and produce it to ACMA on request. The only work excluded is the trivial kind, such as running or removing jumpers on a distribution frame or replacing a plug, socket or module.

The practical version: if your security installer cannot hand you that statement at handover, you have not been given the compliance evidence the rules require, and you have no documented basis for the cabling in a building you are responsible for. Ask for it in writing, and file it with the as-built.

Structured cabling, PoE loads, camera positions and door hardware all belong in the fit-out plan before the walls close, alongside the data and power design.

Door hardware has a further constraint that is not an IT decision. Electric locks on egress paths must fail in whichever direction the building surveyor and fire engineer require. Get that determination in writing before the hardware is ordered.

Sizing storage without guessing

Storage sizing is where vendor calculators produce confident numbers from invented assumptions. Do it in this order instead.

Decide the retention period first, from a policy position rather than a hardware position, driven by why you are recording: incident investigation, insurance claims, workplace safety, or a specific contractual requirement. Write down the reason, then set the period.

Then measure the bitrate rather than estimating it. Install one camera of the model you intend to buy, in a position representative of the busiest scene you will cover, and record its actual bitrate across a full working day and a full night. Bitrate varies enormously with resolution, frame rate, codec (H.265 is materially more efficient than H.264), scene complexity and motion, and infrared illumination at night. A camera pointed at a still car park and one pointed at a busy warehouse aisle behave nothing alike.

Then multiply measured average bitrate by the number of cameras of that class and by the retention period in seconds, repeat per camera class, and sum. Decide whether recording is continuous or event-triggered, because that assumption can change the total by an order of magnitude and it also changes what you can prove after an incident. Add headroom for RAID parity, operating system and database space, and the cameras you will add within the life of the recorder.

Finally, decide what happens to footage preserved beyond the retention window for an incident under investigation. Exported evidence needs a defined location, access control and its own retention rule, or it lives on a manager’s desktop forever.

Footage is personal information, and Victoria has surveillance law

Two separate legal regimes apply, and businesses tend to know about neither.

Victorian surveillance law. Under section 7 of the Surveillance Devices Act 1999 (Vic), a person must not knowingly install, use or maintain an optical surveillance device to record visually or observe a private activity to which the person is not a party, without the express or implied consent of each party to the activity. The penalties are substantial: for a natural person, up to two years imprisonment or a fine of up to 240 penalty units or both, and for a body corporate up to 1,200 penalty units.

The definitions do the work here. An “optical surveillance device” is any device capable of being used to record visually or observe an activity. A “private activity” is an activity carried on in circumstances that may reasonably be taken to indicate the parties desire it to be observed only by themselves, and it expressly excludes an activity carried on outside a building, and any activity carried on in circumstances where the parties ought reasonably to expect it may be observed by someone else.

In practice that means a signed camera covering an open-plan office floor, a reception area or a car park is generally outside the prohibition. Cameras in toilets, change rooms, showers, first aid rooms, prayer rooms and parents’ rooms are where businesses get into trouble, and no signage cures it. The Act deals with listening devices and private conversations separately, which is why the microphone built into most IP cameras deserves a deliberate decision rather than a default. Most businesses should disable audio recording and document that they did.

Victoria does not have a standalone workplace surveillance Act in the way New South Wales does, so the Surveillance Devices Act and the Privacy Act do the work between them.

Privacy law. Footage of an identifiable person is personal information. That brings the Australian Privacy Principles into play for any business the Privacy Act covers: collect only what is reasonably necessary for a function or activity, notify people at or before the point of collection, keep it secure under APP 11, and destroy or de-identify it when it is no longer needed under APP 11.2. Do not assume the employee records exemption covers surveillance footage, because it is narrower than most employers think and it does nothing at all for customers, contractors and visitors.

If a recorder is stolen or a cloud video account is compromised, that is a data breach, and it may be a matter for the Notifiable Data Breaches scheme if it is likely to result in serious harm.

Practical steps: put clear signage at every entrance and in every monitored area, cover CCTV in your privacy policy, put a camera position plan in your documentation with the justification for each position, and angle cameras so they do not cover a neighbour’s property or a public footpath any more than necessary.

Where the system is cloud-hosted, the questions about where that footage is stored and who can reach it are exactly the same questions you should ask of any SaaS vendor.

Retention, access and who is allowed to look

Retention has to be a written rule, not a function of when the disk fills up. Set a period, document the reason, and configure the system to enforce it. Continuous retention “in case we ever need it” is an APP 11.2 problem, and it grows the consequences of any breach.

Access is where the real risk sits. Live viewing and recorded playback should be separate permissions. Playback should be limited to a small named group, ideally requiring a second person’s approval for anything beyond a defined operational purpose. Export must be logged, with the reason recorded. Review the access log periodically, because unmonitored access to footage of staff is a workplace issue long before it is a legal one.

Write down who may authorise release of footage to Victoria Police, an insurer or a lawyer, and what form of request is required. Deciding that during an incident, at the counter, is how it goes wrong.

When a recorder reaches end of life, remember it is a device full of personal information, so destroy the recorder’s drives properly rather than sending the unit back on a lease return.

Access control should be tied to identity, so offboarding closes the door too

Most SMB access control systems are islands. Cards are issued from a separate database with its own administrator, and when someone leaves, the person disabling their Microsoft 365 account has no visibility of the door system. The account is gone in minutes and the card still opens the back door six months later.

Fix it in one of two ways.

The better option is to buy an access control platform that integrates with your directory. If the system supports SAML or SCIM provisioning against Microsoft Entra ID, then disabling or deleting the user account revokes their door credential automatically, and group membership can drive which doors they can open. That makes one action, taken by one person, close both the login and the door. Mobile credentials on a phone are easier to revoke than a plastic card, and they cannot be lent to a mate at the pub as easily.

The realistic option, where integration is not available or not affordable, is to make credential revocation an explicit line item on your offboarding checklist, with a named owner, a required evidence step (a screenshot of the disabled credential), and a quarterly audit that reconciles active cards against active employees. That audit is dull and it is the only thing that catches contractors, casuals and the cards issued to people who left two employers ago.

Either way, run a quarterly reconciliation of the card list against your HR list. Every business that does this for the first time finds active credentials for people who no longer work there.

What to put in the installer’s scope

Write these into the tender rather than discovering them at commissioning.

1. All devices to be placed on a dedicated VLAN nominated by the client’s IT provider, with no default gateway unless specifically approved
2. No port forwarding, and no vendor remote access enabled without written approval
3. Unique administrator credentials per device, handed to the client at practical completion, with no installer-retained shared password
4. Firmware versions recorded at handover, and a documented update procedure with the vendor’s published support lifecycle
5. Audio recording disabled unless specifically requested in writing
6. An as-built document listing every device, its IP address, MAC address, model, firmware version, cable run and patch panel port
7. Confirmed PoE class per device and a total switch power budget calculation
8. Camera position plan showing coverage and confirming no coverage of toilets, change rooms or similar spaces
9. Cabling installed by an appropriately registered cabler, tested and certified, with results provided
10. A commissioning handover session with the client’s IT provider present

Point ten costs an hour and prevents most of the problems above.

If you are fitting out, relocating, or you have inherited a camera system nobody can log into, we design the network segmentation, run the cabling and comms room work in-house, and hand you documentation you can actually use. Call 1300 028 324 or get in touch at https://techassist.au/contact/. Bring us in before the security tender closes, not after the ceiling goes back up.

Two things go wrong at the end of a device’s life, and they go wrong in different directions. The data does not get destroyed properly, which is a Privacy Act problem and potentially a notifiable breach. And the hardware ends up somewhere it is not allowed to be, which in Victoria has been illegal since 2019. A disposal process has to solve both, and most SMB processes solve neither.

Media sanitisation is the process of removing data from storage media so that it cannot be reconstructed. Destruction is physically rendering the media unusable. They are different controls, they suit different devices, and they produce different evidence.

A factory reset is a convenience feature, not a data destruction control

A factory reset is designed to make a device usable by the next person quickly. On most operating systems it removes the file system pointers and the user profile. Whether it removes the data depends entirely on the underlying storage and whether encryption was in play.

The Australian Signals Directorate’s Information Security Manual sets out why a straightforward overwrite is not sufficient on a spinning disk. Modern magnetic hard drives keep a host-protected area and a device configuration overlay table that are normally invisible to the firmware and the operating system, so sanitising the readable sectors leaves anything in those regions untouched. They also reallocate bad sectors into a growth defects table, and data written to a sector before it was reallocated will not be overwritten by ordinary software. The ISM’s answer is to reset the host-protected area and device configuration overlay first (control ISM-1065), and to use the ATA secure erase command in addition to block overwriting software so the growth defects table is covered (ISM-1067).

Flash memory has a different problem. Wear levelling deliberately spreads writes across memory blocks, so a single pass has no guarantee of touching every block. The ISM requires non-volatile flash memory media to be overwritten at least twice in its entirety with a random pattern, followed by a read back for verification (ISM-0359). For hybrid drives, it requires separating the magnetic media from the circuit board holding the flash and sanitising each separately.

The ISM is written for government systems, not for private businesses. The OAIC’s own APP 11 guidance points to the ISM’s media sanitisation section and notes that although it applies to Australian Government agencies, it may be of interest to organisations complying with APP 11.2. That is as close to a benchmark as an Australian SMB is going to get, and it is a good one to be measured against in an audit.

Three methods, and when each is defensible

Factory reset or an OS-level wipe. Acceptable only for a device that was fully encrypted from first use and is staying inside your organisation. Not acceptable as the sole control for a device leaving your custody.

Cryptographic erase. The drive is encrypted, and you destroy the key rather than the data. NIST SP 800-88 Rev. 1 recognises cryptographic erase as a purge technique. It is fast, it works at scale, and it is the mechanism behind Apple’s “Erase All Content and Settings” on Macs with Apple silicon or the T2 chip and on iPhones and iPads, where the volume key is held in dedicated hardware and destroyed on erase. Two conditions have to hold: encryption must have been enabled from the moment the device was first used, and you must trust the firmware implementation. If the device spent its first year unencrypted, cryptographic erase does not reach the data written during that year. Note also that the ISM’s sanitisation controls are built around overwriting and use ATA secure erase in addition to, not instead of, software overwriting.

Physical destruction. The only method that does not depend on trusting firmware. The ISM specifies destruction methods by media type (furnace or incinerator, hammer mill, disintegrator, grinder or sander, degausser, or cutting depending on the media) and requires resulting particles to be no larger than 9 mm. It requires the use of Security Construction and Equipment Committee-approved or ASIO-approved equipment, and where a degausser is used, it also requires the platters to be physically deformed afterwards. Destruction is the right answer for any drive that failed, that cannot be verified, or that held sensitive information. The ISM is explicit on this point: media that cannot be successfully sanitised is destroyed prior to disposal (ISM-1735).

The trade-off is straightforward. Destruction gives you certainty and destroys residual value. Sanitisation preserves the resale or redeployment value of the asset and puts the burden of proof on you. Decide per device class, write the decision down, and stop making it case by case at the loading dock.

SSDs, spinning disks, phones and the printer everyone forgets

Spinning disks. Sanitise with a tool that resets the host-protected area and device configuration overlay and issues ATA secure erase, then verify with a read back. If verification fails, destroy it. Old drives under 15 GB or manufactured before 2001 need three overwrite passes under the ISM rather than one.

SSDs and NVMe. Prefer cryptographic erase where the drive was encrypted from day one, or the manufacturer’s sanitise command. Software overwriting alone is unreliable because of wear levelling and over-provisioning. If the drive held anything sensitive and you cannot verify the erase, destroy it. SSDs shred easily and cheaply.

Phones and tablets. Remove them from your MDM and from Apple Business Manager or the Android enterprise equivalent before wiping, then perform the vendor erase. A device still enrolled or still tied to an activation lock is not disposable and is not resellable, and this is the single most common failure we see. Personal devices under a BYOD arrangement need a documented selective wipe that removes corporate data without touching the owner’s photos.

Multifunction devices. This is the one everyone forgets. Business photocopiers and multifunction printers commonly contain an internal hard drive or SSD that has retained images of everything scanned, printed, faxed and emailed through them, sometimes for years. When the lease ends the machine goes back to the finance company with that drive inside it. Before any MFD leaves the building, either have the vendor perform and certify a documented data removal, or buy the drive out of the lease and destroy it yourself. Put this in the lease negotiation, not in the exit conversation.

Everything else with storage. Network video recorders, backup appliances, firewalls with logging, VoIP handsets with local directories, USB sticks in the bottom drawer, and the old NAS in the comms room. If you do not have an asset register that actually tracks devices, you will miss several of these, and the ones you miss are the ones that turn up on a marketplace listing.

The Privacy Act requires you to destroy what you no longer need

APP 11.2 requires an APP entity to take such steps as are reasonable in the circumstances to destroy personal information or ensure it is de-identified once the information is no longer needed for any purpose for which it may be used or disclosed under the APPs, unless an Australian law or a court or tribunal order requires it to be retained. APP 11.3, introduced by the Privacy and Other Legislation Amendment Act 2024 and applying to personal information held from 11 December 2024, confirms that reasonable steps include both technical and organisational measures.

Three points from the OAIC’s guidance change how a disposal process should be built.

Destruction means the information can no longer be retrieved. The OAIC states that for hard copy, disposal through garbage or recycling is not reasonable steps unless the information has already been pulped, burnt, pulverised, disintegrated or shredded. For electronic information, reasonable steps vary with the hardware, and where hardware cannot be sanitised, the information must be irretrievably destroyed another way.

You must deal with all copies, including archives and backups. A wiped laptop does not help if the same personal information is sitting in a backup set you have kept for six years without a retention policy.

Where the information sits on a third party’s hardware, such as cloud storage, and you have instructed them to destroy it, reasonable steps include taking steps to verify that it happened. That is the same discipline as asking where your cloud data actually lives at the start of the relationship.

There is also a fallback the OAIC calls putting information beyond use, for the limited cases where irretrievable destruction is genuinely impossible. It requires that you will not use or disclose the information, cannot give any other entity access to it, surround it with technical, physical and organisational security including access logs and audit trails, and commit to destroying it when that becomes possible. It is a narrow exception, not a filing strategy.

Get this wrong and a lost or stolen device holding personal information is exactly the example the OAIC gives of a notifiable data breach. Knowing which machines held what makes that assessment survivable, which is the practical reason to know which devices held sensitive information before they reach end of life.

Certificates of destruction, and what a real one contains

Most certificates of destruction we see are marketing documents. A useful one is an evidence record. It should contain:

• The serial number of every item, matched to your asset register, not a count of items or a weight
• The media type and the method used for each item, not a generic statement covering the batch
• The date and physical address at which destruction or sanitisation occurred
• The name and signature of the person who performed it and the person who witnessed it
• For sanitisation, the tool and version used and confirmation that verification passed
• For destruction, the equipment used and the resulting particle size
• A statement of the standard the vendor worked to
• Confirmation that the residue was then handled as e-waste under Victorian law

If the certificate cannot be reconciled to serial numbers in your asset register, it proves nothing in an audit. The ISM’s own approach for government is instructive: destruction is supervised, the supervisor confirms it was completed successfully, and where destruction of sensitive media is outsourced it requires a National Association for Information Destruction AAA certified service. Asking a commercial vendor whether they hold NAID AAA certification is a fast way to sort the serious operators from the rest.

Chain of custody is where it actually fails

The data is rarely lost during destruction. It is lost between the desk and the truck.

Devices sit in a store room for eight months. A staff member takes one home because it was “going to be thrown out anyway”. The pallet is collected by a subcontracted driver nobody recognises. A box goes missing between sites and nobody notices because there is no manifest.

Fix it with unglamorous controls. Log every device into a disposal batch at the moment it is decommissioned, with its serial number. Store the batch in a locked area, not the corridor. Do not release a batch without a signed manifest listing every serial. Require the vendor to acknowledge receipt against that manifest within an agreed window, and chase it when they do not. Reconcile the certificate to the manifest and close the batch in your asset register. That whole loop belongs in a documented disposal procedure so it survives the departure of whoever currently does it from memory.

Where devices held highly sensitive information, remove and destroy the drives on site before the hardware leaves, and let the vendor take the carcass. It is cheap and it eliminates the entire chain of custody argument.

Victoria banned e-waste from landfill in 2019

Since 2019 it has been illegal in Victoria to send e-waste to landfill or put it in general rubbish. E-waste is broadly defined: anything with a plug, a battery or a power cord. That includes computers, phones, monitors, whitegoods, batteries and photovoltaic panels.

For a business the obligations go further than “do not bin it”. EPA Victoria regulates the transport, storage and reprocessing of industrial waste, and most e-waste from business and industry is pre-classified as priority waste under Schedule 5 of the Environment Protection Regulations 2021. Duties under the Environment Protection Act 2017 apply to the generator, the transporter and the receiver, which means you carry a duty as the generator and cannot fully delegate it. The general environmental duty applies as well: you must eliminate or reduce the risk of harm from your e-waste so far as reasonably practicable. Used lead-acid and nickel-cadmium batteries are classified as reportable priority waste and attract additional requirements.

Lithium-ion batteries deserve a specific mention. EPA Victoria’s guidance is to manage all e-waste as if it has a battery, and e-waste is treated as a specified combustible recyclable and waste material. A crate of old laptops and vapes in a comms room is a fire load, not just a compliance item.

The relevant Australian Standard is AS 5377:2022, which covers the collection, storage, transport and treatment of end-of-life electrical and electronic equipment. Ask your vendor whether they work to it.

Who to contact now that Sustainability Victoria has closed

Sustainability Victoria closed on 30 June 2026 following the Independent Review of the Victorian Public Service, and its website is no longer updated. Programs that continued, including Detox Your Home and the recycling infrastructure funding streams, transferred to the Department of Energy, Environment and Climate Action (DEECA). For current Victorian information on recycling and waste, go to DEECA. For the rules themselves, and for enforcement of the e-waste landfill ban, go to EPA Victoria. Anything still citing Sustainability Victoria as the authority is out of date.

At Commonwealth level, the Product Stewardship Act 2011 was repealed and replaced by the Recycling and Waste Reduction Act 2020, with the repeal effected by the accompanying Consequential and Transitional Provisions Act. The National Television and Computer Recycling Scheme continues under that framework, administered by the Department of Climate Change, Energy, the Environment and Water, which has also committed to developing a mandatory product stewardship scheme covering small electrical products and solar photovoltaic systems. If a supplier quotes the Product Stewardship Act 2011 at you, they have not updated their paperwork since 2020.

What to require from a disposal vendor

Put these in the engagement, not in an email thread.

1. Which EPA Victoria permission they hold, or which permissioned facility their material goes to
2. Whether they work to AS 5377:2022, and whether they hold NAID AAA certification for data destruction
3. Whether destruction happens on your site, at their site, or at a third site, and who transports it
4. What the certificate of destruction contains, with a sample provided before you sign
5. Serial-level reconciliation against your manifest, with a stated turnaround
6. What happens to devices they on-sell rather than destroy, and what sanitisation they apply first
7. Whether any material is exported, and to where
8. Their insurance position if a device holding your data surfaces after they took custody of it

The last one is the question that separates a disposal partner from a scrap dealer.

We handle decommissioning, drive destruction and compliant e-waste disposal as part of asset lifecycle work for our managed clients, including the MFD lease exits that usually get missed. If you have a store room full of retired kit and no record of what is in it, call us on 1300 028 324 or get in touch at https://techassist.au/contact/. We will inventory it, tell you what is defensible to sanitise and what has to be destroyed, and give you your Privacy Act obligations in writing rather than in principle.