IT Asset Disposal: Wiping and Certifying Old Drives

Here's the scenario we see constantly: a Houston-area accounting firm refreshes forty laptops during a Microsoft 365 migration, boxes up the old ones in a storage closet "to deal with later," and six months later nobody remembers which drives had client tax data versus which were loaner machines for interns. IT asset disposal isn't glamorous, so it falls to the bottom of the list right after the new hardware gets racked. But those retired drives still hold client records, financial data, VPN credentials, and cached passwords long after the machine stops showing up on your network.

The fix isn't complicated. It just has to be a process with a paper trail, not an afterthought handled by whoever has a free afternoon.

NIST Special Publication 800-88 gives you three sanitization tiers. Most managed IT services providers build their decommissioning checklist around these three buckets because they map cleanly to risk level and media type.

• Clear: A single-pass software overwrite (think a full-disk wipe tool) that defeats basic data recovery attempts. Fine for internal reuse of a device within your own organization, not sufficient if the drive is leaving your control.
• Purge: Techniques like cryptographic erase or multiple-pass overwrite that defeat even lab-grade forensic recovery tools. This is the right call for drives headed to a reseller, a donation program, or a lease return.
• Destroy: Physical destruction — shredding, degaussing, or disintegration — so the media can never be reused. Required for drives that held regulated data (PHI, cardholder data, SSNs) or that failed verification during a purge attempt.

The method you pick should depend on where the data was stored and who touched it, not on what's cheapest or fastest. A front-desk machine that only ever ran a scheduling app is a different animal than a server drive that held patient records under HIPAA requirements.

SSDs Aren't Hard Drives — Don't Treat Them the Same

A lot of IT teams still run the old seven-pass overwrite method that worked fine on spinning hard drives and assume it works the same on solid-state drives. It doesn't, not reliably. SSDs use wear-leveling, which means a "deleted" sector on the drive the OS reports may not map to where the data actually lives on the physical chip. For SSDs, cryptographic erase (if the drive supports self-encryption) or physical destruction is the safer bet. If your disposal vendor can't explain the difference between wiping a spinning disk and an SSD, that's a red flag.

A certificate of destruction isn't just a nice-to-have for your files — it's your evidence during a breach investigation, a cyber insurance audit, or a compliance review under something like the FTC Safeguards Rule. A real certificate includes:

• Serial number and asset tag for every device, not a lump total ("42 laptops destroyed")
• Date and method of sanitization (clear, purge, or destroy) per device or per batch
• Name and signature of the technician or vendor who performed the work
• Chain-of-custody documentation if the drives left your facility before destruction

If a vendor hands you a generic one-page letter with no serial numbers, push back. That document won't hold up if you ever need to prove a specific drive was sanitized, and it won't satisfy an auditor asking pointed questions about your cybersecurity controls.

Choosing the Right Method by Device Type

Device / Media	Typical Risk Level	Recommended NIST Action
Employee laptop (general use)	Moderate	Purge (cryptographic erase or multi-pass wipe)
Server drive with PHI or financial data	High	Destroy (physical shred)
Network printer with internal storage	Low-Moderate	Clear, then factory reset
Leased laptop returning to vendor	Moderate	Purge + certificate before pickup
Mobile device (company phone)	Moderate	Clear via MDM remote wipe, then factory reset

Lease returns are where a lot of disposal programs quietly fail. The leasing company wants the hardware back fast, and the pressure to just ship it creates a shortcut where nobody wipes the drive first. Read the lease agreement closely — most leasing contracts put the sanitization obligation on you, the lessee, not the leasing company. If a drive with client data ships back unwiped and ends up resold, that liability traces to your business, not theirs.

Build wipe-and-certify into your return workflow before the box goes to the shipping dock. It takes an afternoon with the right tools and saves you from a very uncomfortable phone call later.

Wiping the drive is only half the job. The other half is removing that asset from every system that still thinks it's active: your inventory spreadsheet or asset management tool, your cyber insurance policy's covered-device list, your antivirus and endpoint detection console, and your backup software's client list. A retired laptop still showing up as "active" in your endpoint protection dashboard isn't just clutter — it's a phantom entry that muddies your next compliance audit and can mislead an incident responder trying to map your real attack surface during a breach.

This is exactly the kind of lifecycle gap that gets caught when a business works with an outside partner who treats hardware refresh and retirement as part of ongoing long-range technology budgeting and planning rather than a one-off project. Asset disposal should be a line item in your IT roadmap, not a surprise every three years when the lease renews.

For Texas businesses in the 20-99 employee range, there's an added incentive to document this properly: Texas SB 2610 shields companies that implement the CIS Controls IG1 safeguards from exemplary damages in a breach lawsuit. Asset disposal and media sanitization are part of that control set, and a clean certificate-of-destruction file is the kind of evidence that matters if you're ever asked to show you followed the standard.

Do I need a certificate of destruction for every single device, or can I batch them?

Batch certificates are fine as long as every serial number is individually listed within the batch document. A certificate that just says "50 units destroyed" with no serials attached won't hold up if you need to prove a specific device was sanitized.

Can I just reformat a drive and donate the laptop?

A standard reformat (Clear level) is not sufficient for drives that held business data, regulated or not. Use a verified purge method — cryptographic erase or a certified multi-pass wipe — before any device leaves your control, even for donation.

What happens if a leased laptop gets returned without being wiped?

Check your lease agreement, but in most cases the sanitization obligation sits with you, the lessee. If data later surfaces on a resold unit, your business bears the liability, not the leasing company.

Should IT asset disposal be handled in-house or outsourced?

Either can work if the process includes verified sanitization, documented certificates, and inventory removal. Many businesses outsource it as part of their broader managed IT services arrangement because the vendor already has the destruction equipment and documentation workflow in place.

How long should we keep certificates of destruction on file?

Retain them for as long as your data retention or compliance policy requires for the underlying data type — often several years for financial or healthcare records. Store them alongside your other compliance documentation, not in a random email thread.

If your retired hardware is sitting in a closet with no wipe log and no certificates, that's a gap worth closing before it becomes a liability. Request a free IT assessment and we'll walk through your current disposal process and where it needs tightening.