Disposal
The laptop in the storage closet still has everything on it.
Media sanitization following the NIST SP 800-88 guidelines, a serialized certificate for every device, documented chain of custody, and certified recycling for whatever is left.
Retired hardware is one of the most common places where company and client data quietly outlives the decision to stop using it. The machines come out of service, go into a closet or onto a shelf, and stay there because nobody is sure what to do with them and nobody wants to be the person who threw away a drive with client records on it.
That instinct is right. Deleting files does not remove them, formatting a drive does not either, and a machine sold, donated or scrapped without proper sanitization is a disclosure waiting to be discovered by someone else. The exposure also does not stop at laptops: servers, switches, firewalls and multifunction copiers all retain configuration, credentials or scanned documents.
We take custody of end-of-life equipment, sanitize the media following the NIST SP 800-88 guidelines, document what was done to each device by serial number, and route whatever cannot be reused to a certified e-waste recycling partner. You end up with a defensible record instead of a closet.
Talk through what you need →- Any business that has accumulated retired equipment and has been putting off dealing with it. The closet is extremely common and the data in it is real.
- Medical, dental and financial practices, where disposal of media holding protected or regulated information is an explicit obligation rather than good practice.
- Businesses going through a refresh, a move, a downsizing or an acquisition, all of which produce a large volume of equipment at once.
- Anyone who has been asked in a questionnaire how retired media is disposed of and did not have a documented answer.
Scope
What the process covers
Sanitization following NIST SP 800-88
Verified overwrite, degaussing or physical destruction, chosen to match the media rather than applied uniformly. The guidelines exist because the right method depends on what the drive actually is.
Solid-state drives handled on their own path
Overwrite and degaussing do not behave on flash the way they do on spinning disks. SSDs require a different approach, and a vendor who treats them identically is not doing the job.
A serialized certificate of sanitization
Every device recorded by make, model and serial number, with the method used. This is the document you produce when an auditor, an insurer or a client asks what happened to the old equipment.
Documented chain of custody
From collection through final disposition, so there is no gap in the record between your closet and the recycler.
More than workstations
Servers, switches, firewalls and multifunction copiers. Copiers in particular surprise people: many store scanned documents on an internal drive for years.
Certified recycling for the remainder
What cannot be reused goes to a certified e-waste recycling partner instead of a landfill.
Process
How disposal works
The point of the process is the documentation. Without it, you have a disposal you cannot prove.
- 01
Inventory and collection
Equipment identified and recorded by make, model and serial number at the point of collection, which is where the chain of custody starts.
- 02
Method selected per device
Overwrite, degauss or physically destroy, matched to the media type and to the sensitivity of what was on it.
- 03
Sanitization and verification
The method applied and verified, with the result recorded against that specific serial number.
- 04
Certificates and final disposition
You receive the serialized certificates, and equipment that cannot be reused goes to a certified recycling partner with the chain of custody intact.
Common questions
Data Destruction & E‑Waste
Is deleting the files or formatting the drive not enough?
No. Deleting removes the pointer to the data, not the data, and a standard format is not a sanitization method either. Both leave content recoverable with freely available tools. That is the entire reason a published sanitization standard exists.
What is NIST SP 800-88?
It is the National Institute of Standards and Technology publication Guidelines for Media Sanitization. It defines how media should be cleared, purged or destroyed depending on the type of media and the sensitivity of the data, which is why the method varies by device rather than being one procedure applied to everything.
What documentation do we get?
A serialized certificate of sanitization for every device, recorded by make, model and serial number with the method used, plus chain of custody documentation from collection through final disposition.
Do you handle more than computers?
Yes. Servers, switches, firewalls and multifunction copiers are all included. Copiers are the one most often forgotten, and many of them have been storing scanned documents on an internal drive since the day they were installed.
Can we watch the destruction happen?
Talk to us about what your obligation requires. Some regulated clients need witnessed destruction, and the process should be built around the standard you have to meet rather than the other way round.
Related
Often paired with
PC Repair & Builds
Diagnostics and repair, custom builds specified to the work, data recovery, and clean workstation rollouts with your image and security agents already in place before the box reaches the desk.
Read more →Managed IT & Helpdesk
Helpdesk, patching, monitoring, backups, onboarding and offboarding for small and medium businesses across Central Kentucky. Not a break-fix number you call after something has already gone wrong.
Read more →Consulting & Assessments
Assessments with a written report, NIST CSF 2.0 posture scoring, cyber insurance and compliance questionnaire support, and a roadmap you can actually budget against.
Read more →Not sure where to start? Start with the assessment.
It is free, it takes about an hour of your time, and you walk away with a scored report either way.