Retiring hardware: IT asset disposition done properly
When the answer to an EOSL date is "retire it", the work is mostly paperwork and custody, not hauling. Here is what a defensible decommission looks like and what to require in writing.
The five steps
1Asset capture
Serial numbers, rack location, and data classification for every unit before anything is unracked. This list is what every later certificate is matched against.
2Data sanitization to NIST 800-88
Clear, purge, or destroy according to media type. Per-serial erasure reports, not a summary letter. Drives that fail sanitization get physically destroyed and documented as such.
3Chain of custody
A signed, time-stamped record of every transfer from rack to processing facility, including sealed-transport details for regulated data.
4Certificates of destruction
Issued per serial, referencing the sanitization method used. These are the artifacts an auditor asks for.
5Reuse, recycling, and settlement
Resellable assets are remarketed with value returned to you; the remainder is recycled through an R2 or e-Stewards certified downstream with documentation.
Ask every ITAD vendor for these
- Current R2 or e-Stewards certificate, plus their downstream vendors' certificates.
- Sample per-serial certificate of destruction and erasure report.
- Written sanitization method per media type, mapped to NIST SP 800-88 Rev. 1.
- Insurance coverage and liability position for a data incident in their custody.
- Settlement model: fixed fee, revenue share, or net-zero, stated up front.
Frequently asked
- What does NIST 800-88 actually require?
- NIST SP 800-88 Rev. 1 defines three sanitization levels (clear, purge, and destroy) chosen by media type and data sensitivity. For SSDs, a cryptographic erase or vendor sanitize command is the purge method; overwriting alone is not sufficient.
- What is chain of custody and why does it matter?
- A documented record of who held each asset, when, and where it moved. Auditors treat a gap in custody as a potential data exposure regardless of what the erasure certificate says.
- What is the difference between R2 and e-Stewards?
- Both are third-party certifications for responsible electronics recycling. R2 (Responsible Recycling) focuses on reuse and downstream accountability; e-Stewards adds stricter prohibitions on exporting hazardous material to developing countries.
- Can retired hardware offset the project cost?
- Often, yes. Recent-generation servers, switches, and drives still carry resale value. A settlement-based engagement returns a share of that value against the removal and erasure cost.