Most small businesses have the same quiet problem. There’s a closet, a back room, or a shelf full of old laptops, a retired server, a copier, and a box of backup tapes. Nobody owns the pile, and nobody’s sure what’s on those devices.
That pile is a risk. IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million, and $10.22 million in the United States. Retired hardware that still holds data is an easy way to end up in those statistics. It’s also money sitting unused.
So here’s how to handle it. These eight practices work for small and medium-sized businesses, and none of them needs a big IT team.
What Is ITAD?
ITAD stands for IT asset disposition. It means retiring technology securely and responsibly. A complete ITAD process usually includes:
- Inventory: Listing what you’re retiring, by serial number.
- Collection and transport: Moving equipment from your locations to a secure facility.
- Data removal: Sanitizing or destroying data to a recognized standard.
- Disposition: Reselling, refurbishing, or recycling each item.
- Reporting: Documenting what happened to every asset.
You can do this internally or hire a provider. Either way, the same practices apply. For a deeper look at the options, see our guide to recycling, resale, and more.
Practice 1: Write a One-Page Policy and Name an Owner
Nobody handles a job that nobody owns. Start with one page that answers four questions:
- Who is responsible for retiring equipment?
- What happens to a device when someone stops using it?
- Which vendors or methods are approved?
- Where do records get stored?
For a small business, the owner might be the office manager or an outside IT contact. For a medium-sized one, it’s often IT plus a compliance or finance lead. What matters is that a name is on it.
Practice 2: Inventory Everything That Holds Data
You can’t protect what you haven’t counted. Walk through your space and list every device that might store information:
- Laptops, desktops, and tablets
- Servers and external drives
- Phones
- Printers and copiers, which often have internal drives that keep scanned documents
- Routers, switches, and firewalls, which store configurations and credentials
- Backup tapes and other removable media
- Security cameras and DVRs
Record serial numbers where you can. Our guide to security camera storage explains why recorders deserve a spot on the list.
Practice 3: Check Retention and Legal Holds First
Before anything leaves your building, confirm it’s allowed to go. Some records must be kept for set periods. Others may be under a legal hold because of a dispute or investigation. Deleting or destroying them early can create real trouble.
Ask your legal or compliance contact, or your accountant, which records you must keep and for how long. Then match your retired devices against that list.
Practice 4: Match the Data Removal Method to the Device
People use several terms for removing data, and they overlap. Here’s how they fit together:
- Data sanitization is the umbrella term. It means making data inaccessible to a required level of assurance.
- Data erasure is one method. Software overwrites the data, and the device stays usable.
- Data destruction means physically destroying the device, which guarantees the data is gone but ends the device’s life.
Which one you need depends on how sensitive the data is and whether you want to resell the device. Resale-ready equipment is usually erased. Highly sensitive or damaged media is often destroyed.
Follow a recognized standard. The current one is NIST SP 800-88 Revision 2 (you can read the full NIST publication), published in September 2025. It replaced Revision 1. Our partner DES Technologies offers certified data erasure and physical data destruction.
Don’t count on deleting files or a factory reset alone. They often leave recoverable data behind. Our guide to erasing data before you recycle explains why.
Practice 5: Vet Your Vendor
Not every ITAD provider works the same way. Before you hand over equipment, check these:
- Certifications. Look for R2v3 certification and ask for current documentation.
- Chain of custody. Ask how they track each device from pickup to final disposition. DES’s chain of custody process is an example.
- Documentation. You should receive a Certificate of Destruction with serial numbers.
- Experience. Do they handle your type of equipment, and your volume?
- Downstream transparency. If they subcontract recycling, can they tell you where the equipment ends up?
- Fair pricing. Get more than one quote.
For a full list, see our partner’s ITAD vendor checklist. To understand what drives cost, read the ITAD pricing guide.
Practice 6: Plan for Remote and Departing Employees’ Devices
Equipment doesn’t only sit in closets. Laptops go home with employees, and some never come back. In a Capterra survey of HR professionals, 71% said at least one departing employee had failed to return company equipment, with an average value of roughly $1,963 per device.
A simple fix is to build device return into your offboarding checklist. Trigger the return the moment someone gives notice. Send a prepaid return kit instead of asking the person to find a box. Track each device until it arrives.
Practice 7: Get Paid for What Still Has Value
The old version of this post said ITAD saves money by “disposing of unwanted assets.” The real savings come from resale. Servers, laptops, memory, drives, networking gear, and tape often have market value, even when your business is done with them.
Right now, that matters more than usual. According to industry benchmarks, resale values for servers have been running well above their long-term averages, and recent market reports show server memory prices roughly double year-ago levels. Equipment sitting in a closet loses value every month.
Here’s what we buy:
Our equipment buyback guide walks through the process.
Practice 8: Keep Records and Recycle Responsibly
When the job is done, keep proof. File the Certificate of Destruction, the chain-of-custody record, and any resale or recycling documentation. These matter if a regulator, auditor, insurer, or customer ever asks what happened to your data.
Equipment with no resale value should go to certified recycling, not a landfill. Our partner DES Technologies handles electronics recycling through R2v3-certified processes.
Small vs. Medium: What Changes?
The practices are the same. What changes is how you carry them out.
Small businesses usually have fewer devices and no dedicated IT staff. The priority is a simple policy, a quick inventory, and one trusted provider. Doing a cleanup once or twice a year is often enough.
Medium-sized businesses have more locations, more remote devices, and more compliance pressure. They benefit from a written policy with clear owners, ongoing inventory, a standing vendor relationship, and tracked offboarding. Regulated industries, such as healthcare and finance, should also confirm their compliance requirements before choosing a method.
What About Passwords, Encryption, and Backups?
The old version of this post covered those topics, and they matter. Strong passwords, multi-factor authentication, encryption, access monitoring, regular backups, and risk assessments all protect live systems.
But they’re a different job from ITAD. Think of them as protecting your data while a device is in use, and ITAD as protecting it once the device is retired. Full-disk encryption helps in both cases. An encrypted drive is much harder to read if it’s lost, and cryptographic erase is a recognized sanitization method for suitable media.
A Simple Starter Policy
Copy this outline and fill in your details:
- Owner: [Name and backup]
- Inventory: Updated every [quarter or six months]
- Before disposal: Check retention rules and legal holds
- Data removal: Follow NIST SP 800-88 Revision 2
- Vendor: Approved provider with R2v3 certification and documented chain of custody
- Records: Keep certificates and tracking for [number] years
Frequently Asked Questions
What is ITAD?
ITAD, or IT asset disposition, is the process of retiring technology securely and responsibly. It includes inventory, transport, data removal, resale or recycling, and documentation.
Do small businesses need ITAD?
Yes. Small businesses hold customer, employee, and financial data on devices too, and they face the same breach risks with fewer resources. A simple process and a trusted provider cover most needs.
Is deleting files or a factory reset enough?
Usually not. Deleting files only removes the file system’s reference to the data, and a factory reset may leave recoverable data behind. Use certified erasure or destruction that follows NIST SP 800-88 Revision 2.
What’s the difference between data erasure and data destruction?
Erasure overwrites data with software, so the device can be reused or resold. Destruction physically destroys the device. Destruction is more final, but it ends the device’s resale value.
How do I choose an ITAD provider?
Check for R2v3 certification, documented chain of custody, a Certificate of Destruction with serial numbers, experience with your equipment, and transparency about downstream recyclers. Get more than one quote.
Can I get paid for old IT equipment?
Often, yes. Servers, laptops, memory, drives, networking gear, and tape frequently have resale value. Getting equipment evaluated before you recycle it is the easiest way to find out.
Ready to Clear the Closet?
We keep the process simple:
- Send us your list. Include equipment type, quantity, and condition.
- Get a quote. We review your list and send an offer.
- We cover shipping. We handle labels and logistics. Our secure shipping details are on our site.
- We erase the data. Every device is processed securely, using our Phoenix Certified process.
- You get paid, with documentation. A Certificate of Data Destruction arrives with your payment.
Get a quote today, or see our FAQ for more answers. Want to see how ITAD fits larger organizations? Explore our partner’s ITAD services.
