IT Asset Disposition Services: What They Include, What NIST Now Requires, and What They Cost

By The Uptime Report Team · Last reviewed: October 2026

IT asset disposition services retire old hardware through a recorded chain: inventory, secured transport, sanitization to NIST SP 800-88 Rev. 2, a certificate for every device, then resale or certified recycling. The certificate is your compliance evidence.

What do IT asset disposition services include?

IT asset disposition services cover five jobs: an asset inventory, secured pickup or onsite work, data sanitization, a per-device certificate, and a final route of reuse, resale or recycling. Each job maps to a written standard. NIST SP 800-88 Rev. 2 (September 2025) governs sanitization and records; the R2v3, e-Stewards and NAID AAA programs audit the provider doing the work.

The service menu below matches what provider pages such as Insight, CDW and Sycomp listed in October 2026. The right-hand columns name the clause that tells you what “done properly” means, so a quote can be checked line by line.

The difference between ITAD and plain e-waste recycling is the data and the paperwork. The US EPA recommends certified recyclers and names exactly two accredited US standards, R2 and e-Stewards, both of which “require destruction of all data on used electronics.” An ITAD contract adds the serial-level records a regulator or auditor will ask for.

How does the ITAD chain of custody work, step by step?

A defensible chain of custody records every device from the desk it leaves to the facility that sanitizes it, then proves the outcome per serial. NIST SP 800-88 Rev. 2 says records should be kept when a device enters the environment, when it leaves its last location and when it reaches the post-sanitization destination; a tracking gap before the post-sanitization destination means the records show that specific devices were sanitized, not that every device was.

1. 1. Inventory: record make, model, serial and property number for every device, including copiers and network gear. The OCC’s $60 million penalty against Morgan Stanley (October 8, 2020) cited a failure to “maintain appropriate inventory of customer data stored on the decommissioned hardware devices.”
2. 2. Back up: copy any data still needed before the equipment moves. HIPAA lists this as an addressable specification at 45 CFR 164.310(d)(2)(iv).
3. 3. Encrypt or CE: NIST’s own example is to apply cryptographic erase “at a user’s desktop before sending the ISM to a sanitization facility,” so a drive lost in transit holds only ciphertext.
4. 4. Secure transport: log every movement and the person responsible, which 45 CFR 164.310(d)(2)(iii) requires HIPAA entities to address. NAID AAA audits cover chain of custody, background screening and CCTV retention.
5. 5. Receive: reconcile serials received against serials shipped. A reconciliation during Morgan Stanley’s branch refresh found 42 servers missing, according to the SEC order announced September 20, 2022.
6. 6. Sanitize: apply the clear, purge or destroy method your policy assigns to that data category and record the technique and tool version.
7. 7. Verify and validate: verification checks the tool’s completion status or inspects destruction remnants; validation is the decision to approve or reject the result, per NIST Sec. 4.5.
8. 8. Certificate: one certificate of sanitization per device, with the NIST Sec. 4.6 fields listed under the next heading.
9. 9. Final disposition: internal reuse, external reuse, a recycling facility or the manufacturer, the four named destinations on NIST’s sample certificate, which also has an ‘Other’ box. Downstream vendors must be vetted under R2v3 Appendix A or the e-Stewards Standard.

What should a certificate of data destruction contain?

A certificate of sanitization should be completed for each device, not each job, and NIST SP 800-88 Rev. 2 Sec. 4.6 lists the minimum fields. A batch letter saying “all media was destroyed” lacks the serial number, technique and tool version an auditor needs to match a specific drive to a specific outcome.

• Media identity: manufacturer, model, serial number, and organization property number if one exists.
• Media details: media type (hard copy or ISM), media source such as the user or computer, and optionally the pre-sanitization confidentiality category.
• What was done: sanitization method (clear, purge or destroy), technique (for example degauss, overwrite, block erase or cryptographic erase), and the tool used, including its version.
• Proof: the verification method.
• Who signed: name, title, date, location, contact details and signature of the people performing verification and validation.

NIST’s sample form in Appendix C adds the destination (internal reuse, external reuse, recycling facility, manufacturer or other) and a concurrence signature. For resale streams, R2v3 Appendix B requires records generated by the wiping software for each device and no longer allows manual processing, according to SERI.

Should a drive be cleared, purged or destroyed?

NIST SP 800-88 Rev. 2 decides by data sensitivity and control, not by device type. If the media will not be reused, destroy it. If it will be reused and stays under your control, clear low and moderate data and purge high data. If it will be reused outside your control through resale, donation or lease return, purge low and moderate data and destroy high data.

Every path ends at the same gate: validate, then document. A rejected result means repeating the work with a different technique or escalating to a stronger method. NIST lists lease returns, donation, resale and recycling as changes of control, and treats a device exchanged for warranty or a rebate as out of your control, so ITAD resale streams fall in the bottom three rows.

What NIST means by clear, purge and destroy

The three methods differ by the attacker they defeat. Clear protects against “simple, non-invasive data recovery techniques” through the normal interface; purge and destroy both make recovery “infeasible using state-of-the-art laboratory techniques,” and only destroy leaves the media unusable. The wording below is quoted from Sec. 3.1 of the September 2025 publication.

How should SSDs, phones, copiers and cloud storage be handled?

Media type changes the technique, not the method. NIST SP 800-88 Rev. 2 now points to IEEE 2883 for device-level techniques and keeps only cryptographic erase in its own text. The practical splits: overwriting fails on flash, degaussing fails on SSDs, and for cloud storage cryptographic erase is often the only viable purge option.

Cloud workloads change the ITAD scope. After a cloud migration, the old servers still go through the table above, while the data now in the provider’s storage can often be purged only by cryptographic erase, so key handling belongs in the cloud contract before the move.

What do some ITAD pages still get wrong about data destruction?

Three long-standing data destruction assumptions conflict with NIST’s 2025 revision and its July 2026 FAQ: that a DoD 5220.22-M multi-pass wipe is the benchmark, that degaussing counts as destruction, and that shredding is the strongest option for sensitive drives. NIST now says the opposite on all three, and it removed the 2014 Rev. 1 device-by-device tables.

The DoD claim is still live. As of October 2026, Insight’s ITAD services page says legacy drives are erased “following a Department of Defense 5220.22M hard drive wipe,” alongside shredding or zero-filling. The vendor’s blank certificate template (a 2016 CompuCom form) attached to a 2019 Williamson County, Texas statement of work likewise described erasure “according to Department of Defense 5220.22M standards using at least a three pass data overwrite.” Ask any provider which Rev. 2 method and which IEEE 2883 technique its certificate records instead.

Which laws make secure IT asset disposition a legal requirement?

Four federal rules require disposal controls for the data most businesses hold: the HIPAA Security Rule for health data, the FTC Disposal Rule for consumer report data, the GLBA Safeguards Rule for FTC-regulated financial firms, and Regulation S-P for SEC-registered firms. The FTC rule counts selling, donating or transferring computer equipment as “disposal,” so resale through an ITAD provider is covered.

The FTC rule also tells you how to vet an ITAD provider. Its due-diligence examples at 16 CFR 682.3(b)(3) are reviewing an independent audit, checking references, requiring certification “by a recognized trade association or similar third party,” and reviewing the company’s security policies.

Penalties set the stakes. The median verified HHS OCR settlement or penalty was $240,000 for 2024 to 2026, according to our HIPAA enforcement tracker. Disposal failures at financial firms have cost far more: Morgan Stanley Smith Barney agreed to pay a $35 million SEC penalty in 2022 over lapses affecting the data of about 15 million customers, two years after the OCC’s $60 million penalty against two Morgan Stanley banks.

R2v3, e-Stewards or NAID AAA: what does each certification audit?

R2v3 and e-Stewards certify the environmental and reuse side of an ITAD provider; NAID AAA certifies data destruction. They are complementary: e-Stewards now requires NAID AAA as a prerequisite, while R2v3 builds data security into Core Requirement 7 and Appendix B. Check which appendices or endorsements a facility holds, because a certificate can cover only part of the work.

The EPA adds that the ANSI-ASQ National Accreditation Board (ANAB) accredits the certifying bodies for R2 and e-Stewards in the United States. That gives you a second check: a valid certificate names an ANAB-accredited body and appears in the owner’s facility directory.

Local coverage is thin for e-Stewards. Its public processor directory listed 90 certified US processor locations from 42 companies on October 26, 2026, spread over 28 states; 22 states and DC had none, and only 26 locations in 18 states listed on-site data destruction. If a client in one of the empty states specifies e-Stewards, budget for shipping drives under seal or for a mobile NAID AAA shred before transport. The R2 and NAID AAA directories load behind a browser check, so we could not count them the same way.

How much do IT asset disposition services cost?

Published per-drive destruction rates run from $1.00 to $11.22, and on small batches the add-ons cost more than the drive: individual tracking, onsite work and certified pickup. We found no commercial ITAD price list we could verify at the source, so the table below uses rate schedules that public institutions publish for their own departments, plus one public county contract. Remarketing credits for resold devices are quoted case by case and are not included.

The Berkeley schedule shows what moves the price: fixed fees. Bulk destruction in a shared bin costs nothing, while individually certified destruction adds a $480 pickup for a NAID certified driver, $500 for the first hour of labor and $1 per drive for logging. Spread over a batch, those fixed fees fall fast, which is the number to know before quoting a client a per-drive price.

The floor assumes the job fits in Berkeley’s first hour; each extra hour adds $400, and fuel and a 3.5% card fee come on top, so real break-even batches are larger. The Williamson County statement of work priced its 833 contracted drives at $6.00 each, $4,998 in total. Treat all of these as reference points for destruction only: they leave out inventory, logical sanitization for resale and data center decommissioning labor. A per-pound rate, like IU’s $2.50 per pound for other media, does not by itself produce the per-device certificate NIST Sec. 4.6 describes.

What changes when your MSP collects the client’s hardware?

Once an MSP carries a client’s drives, it becomes a vendor in the client’s disposal chain, and regulators judge the client by how it chose and watched that vendor. The SEC’s 2022 Morgan Stanley order shows the failure pattern: a mover with no data destruction expertise, an unvetted sub-vendor, certificates nobody read, and wiping that was billed but never done.

The details in the SEC order (Release No. 95832, September 20, 2022) read like a checklist of what to prevent. In the 2016 data center job, the mover handled about 4,900 devices, including 53 RAID arrays holding about 1,000 hard drives, plus 8,000 backup tapes. It dropped the e-waste processor named in the contract early on and sold unwiped drives to a second company the firm had never vetted. That company issued “Certificates of Indemnification,” which the mover forwarded as certificates of destruction; the firm did not review them, and the mover kept invoicing for wiping that no longer happened. Thirteen of 14 drives later recovered held at least 140,000 pieces of customer PII.

The second lesson is the serial number. On a 2017 job covering 61 servers, the firm required a certificate naming each of the 244 hard drives, but the serials on the mover’s certificate did not match its records because the drives bore multiple serial numbers. With the drives already destroyed, the order says, the numbers “could not be readily reconciled.”

The HIPAA paperwork usually decides the contract for a medical or dental client. An MSP that maintains ePHI is a business associate, so 45 CFR 164.308(b)(1) requires the client to obtain its written assurances, and 164.308(b)(2) requires the same written assurances from any subcontractor that receives or maintains ePHI on its behalf, which is likely to cover an ITAD processor taking drives. Vendors are a bigger exposure than the dumpster: in 2025, 281 of 802 large breaches reported to HHS listed a business associate as present, against 1 caused by improper disposal, according to our healthcare data breach report.

Price the service per serial-tracked device with a pickup minimum. At UC Berkeley’s published fees, a 50-drive pickup works out to $20.60 per drive and a 500-drive pickup to at least $2.96 once extra hours are added, so one flat per-drive price set for a large refresh loses money on small jobs. In a co-managed IT arrangement, the contract should also say which side signs the manifest and reconciles the certificates, because the SEC found the 2017 server job was hired by an employee who “did not go through the required channels.” The certificate set then belongs in the client’s IT compliance evidence, next to the asset record it closes out.

Which IT asset disposition setup fits your situation?

Match the provider to the data and the destination. If drives leave your control holding high-sensitivity data, specify destruction and a per-device certificate. If you want resale value, require purge-grade sanitization at an R2v3 Appendix B and C facility. If an MSP will carry the drives, put the clause table from the MSP section into the contract first.

How we compiled this

We compiled this page from 25 primary documents accessed in October 2026: NIST SP 800-88 Rev. 2 and its July 2026 FAQ, seven eCFR sections, SEC and OCC enforcement records, SERI, e-Stewards and i-SIGMA requirements, the e-Stewards processor directory, EPA guidance, IEEE 2883, and five institutional rate schedules or contracts. We did not test any tool or audit any provider, and we dropped claims we could not confirm at a primary source.

Frequently asked questions

Can I wipe hard drives myself instead of hiring an ITAD company?

Yes. NIST SP 800-88 Rev. 2 Sec. 2.4 lists whether sanitization is done by the organization or a third party as a decision factor, and the FTC Disposal Rule asks for reasonable measures, not a vendor. You still need a per-device record of method, technique and tool version. Indiana University makes departments wipe drives and attest to it on a transfer form before surplus pickup.

Do printers and copiers need their hard drives removed before disposal?

Often, yes. NIST SP 800-88 Rev. 2 says office equipment may offer only a factory reset, which counts as clear, not purge, so a copier going back to a lessor may need more. UNC-Chapel Hill policy says printers and copiers “should have the storage media removed and shredded,” at its $3.00 per drive departmental rate. Check the lease return terms first.

How long should I keep certificates of destruction?

No single federal rule sets one period for every certificate. HIPAA entities must keep required Security Rule documentation for 6 years from creation or last effective date under 45 CFR 164.316(b)(2)(i), and keeping disposal certificates on the same clock is the cautious choice. The SEC order against Morgan Stanley Smith Barney found the firm had no certificates for one 2016 data center decommissioning.

What is a statement of volatility?

A statement or letter of volatility is a manufacturer document listing every volatile and non-volatile memory component in a device, what data each holds, whether the user can reach it, and how to erase it, according to NIST SP 800-88 Rev. 2. Ask for one before buying network gear, printers and appliances, because NIST warns that vendors state volatility details differently.

Does BitLocker encryption count as data destruction when retiring a laptop?

Only if cryptographic erase conditions are met. The NIST July 2026 FAQ requires that no sensitive data was stored in plaintext before the keys were set, at least 128-bit strength, and zeroized keys. The SEC’s Morgan Stanley order shows why the first condition matters: branch devices whose encryption was switched on in 2018 encrypted only new data, leaving older data readable.

Is it legal to sell or donate old company computers?

Yes, but the FTC Disposal Rule treats the sale, donation or transfer of computer equipment holding consumer report information as disposal under 16 CFR 682.1(c), so reasonable measures apply first. Under NIST SP 800-88 Rev. 2, reuse outside your control means purge for low or moderate data and destroy for high data, so donate high-sensitivity machines without their drives.

Sources

1. NIST, SP 800-88 Rev. 2: Guidelines for Media Sanitization (September 2025). Accessed October 2026.
2. NIST CSRC, SP 800-88 Rev. 2 publication record. Accessed October 2026.
3. NIST, Frequently Asked Questions for SP 800-88r2 (July 16, 2026). Accessed October 2026.
4. IEEE Standards Association, IEEE 2883 Standard for Sanitizing Storage. Accessed October 2026.
5. eCFR, 45 CFR 164.308 Administrative safeguards (HIPAA). Accessed October 2026.
6. eCFR, 45 CFR 164.310 Physical safeguards (HIPAA). Accessed October 2026.
7. eCFR, 45 CFR 164.314 Organizational requirements (HIPAA). Accessed October 2026.
8. eCFR, 45 CFR 164.316 Policies and procedures and documentation requirements (HIPAA). Accessed October 2026.
9. eCFR, 16 CFR Part 682 Disposal of Consumer Report Information and Records. Accessed October 2026.
10. eCFR, 16 CFR 314.4 Elements of a safeguards program (GLBA). Accessed October 2026.
11. eCFR, 17 CFR 248.30 (Regulation S-P). Accessed October 2026.
12. SEC, Morgan Stanley Smith Barney to Pay $35 Million (Press Release 2022-168). Accessed October 2026.
13. SEC, Order Instituting Proceedings, In the Matter of Morgan Stanley Smith Barney LLC, Release No. 95832 (September 20, 2022). Accessed October 2026.
14. OCC, OCC Assesses $60 Million Civil Money Penalty Against Morgan Stanley (NR 2020-134). Accessed October 2026.
15. SERI, R2v3 overview. Accessed October 2026.
16. SERI, R2v3 Specialty Process Requirements. Accessed October 2026.
17. e-Stewards (Basel Action Network), The e-Stewards Standard. Accessed October 2026.
18. e-Stewards, Find a Processor directory (certified US processor locations). Accessed October 26, 2026.
19. i-SIGMA, NAID AAA Certification. Accessed October 2026.
20. US EPA, Certified Electronics Recyclers. Accessed October 2026.
21. Indiana University Surplus, Data Security. Accessed October 2026.
22. UNC Information Security, Secure Device Disposal. Accessed October 2026.
23. University of Pennsylvania Records Center, FY 2026-2027 Rate Schedule. Accessed October 2026.
24. UC Berkeley Surplus, Destruction of Hard Drives. Accessed October 2026.
25. Williamson County, Texas, statement of work filed with the Commissioners Court (July 9, 2019 agenda): hard drive shredding on site. Accessed October 2026.
26. Insight, IT Asset Disposition Services page (quoted claim). Accessed October 2026.