Short answer: Secure IT asset disposal is the process of retiring IT equipment without exposing your data or harming the environment. It means inventorying every device, erasing or destroying the data to NIST SP 800-88 Revision 2, tracking chain of custody, getting a Certificate of Data Destruction, and then reselling or recycling the equipment through certified channels.
Explore the full service: See everything included in our IT asset disposition services, or visit our partner’s ITAD hub.
In this guide: The six steps · Six myths · The cost of getting it wrong · Rules that may apply · Methods · Environment · Value recovery · Choosing a provider · FAQ
The Six Steps
- Inventory. List every device by serial number, including servers, laptops, drives, networking gear, tape, and phones.
- Check retention rules. Confirm nothing is under a legal hold or still needs to be kept.
- Sanitize or destroy the data. Use certified erasure, degaussing, or shredding, matched to the device.
- Track custody. Document every handoff from your door to final disposition.
- Get proof. Ask for a Certificate of Data Destruction with serial numbers.
- Resell or recycle. Equipment with value is resold, and the rest goes to certified recycling.
Six Myths About IT Asset Disposal
Myth 1: “Deleting files or reformatting is enough.”
Fact: Both leave data behind. In a 2019 University of Hertfordshire study commissioned by Comparitech, researchers bought 200 used drives and found that 59% had not been properly wiped. A 2016 Blancco study found recoverable data on 78% of resold drives. Our data sanitization guide explains why.
Myth 2: “If I recycle it, it’s secure.”
Fact: Recycling recovers materials. It doesn’t guarantee your data was destroyed first. Data security has to happen before equipment leaves your control, and you need proof it did.
Myth 3: “Smashing a drive myself is good enough.”
Fact: DIY destruction can miss data, and it creates sharp fragments and safety hazards. Certified shredding and erasure are repeatable and documented. See our guide to secure hard drive disposal.
Myth 4: “Only big companies need this.”
Fact: Small and midsize businesses hold customer, employee, and financial data too, often with fewer resources to spot a problem. Our ITAD best practices for small and medium-sized businesses show how to start small.
Myth 5: “Disposal only costs money.”
Fact: Many retired assets still have resale value. According to recent market reports, server memory prices roughly doubled this year, and industry benchmarks show server resale values running well above their long-term averages. Equipment sitting in a closet loses value.
Myth 6: “Once a vendor takes it, compliance is their problem.”
Fact: You stay accountable for your data. You need a vendor with documented processes, chain of custody, and certificates. See our vendor checklist.
The Cost of Getting It Wrong
IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million, and $10.22 million in the United States. Improperly retired equipment is one way sensitive data ends up in the wrong hands, along with the legal fees, notification costs, and lost trust that follow.
Rules That May Apply
Which rules apply depends on your industry, data, and location. Examples:
- HIPAA. The Security Rule requires policies for the final disposition of electronic protected health information and the media it’s stored on (45 CFR 164.310(d)(2)(i)). Civil penalties are tiered by level of negligence and adjusted for inflation each year.
- GLBA Safeguards Rule. Financial institutions must securely dispose of customer information.
- FTC Disposal Rule. It requires proper disposal of consumer report information, including electronic media.
- State data disposal laws. Many states require businesses to make personal information unreadable before disposal.
- GDPR. It applies if you handle personal data of people in the EU. Fines can reach €20 million or 4% of worldwide annual turnover for the most serious violations, and €10 million or 2% for others, including failures of security measures.
- Sarbanes-Oxley. SOX requires internal controls over financial reporting, and auditors may expect documented controls for media holding financial data.
If you’re not sure what applies, ask your legal or compliance contact.
Methods: What Works and When
NIST’s current guidance, SP 800-88 Revision 2 (published September 2025), replaced Revision 1. It describes three levels: Clear, Purge, and Destroy. In practice:
- Certified erasure. Software overwrites the data, and the device stays usable. Best for equipment you want to resell. See DES’s data erasure process.
- Degaussing. A strong magnetic field scrambles data on magnetic media like hard drives and tape. It usually leaves the device unusable, and it doesn’t work on SSDs. See degaussing.
- Physical destruction. Shredding destroys the media itself. Best for damaged devices and highly sensitive data. See physical data destruction.
For SSDs, overwrite tools built for hard drives don’t reliably sanitize flash storage. Use a verified cryptographic or manufacturer secure erase, or destroy the drive. Our data destruction services page covers the options.
The Environmental Side
The UN’s 2024 Global E-waste Monitor found that the world generated 62 million tonnes of e-waste in 2022, and only 22.3% was documented as properly collected and recycled. Responsible disposal keeps hazardous materials out of landfills and recovers metals and components. Look for R2v3-certified recycling, such as DES’s R2v3 certification, and see our electronics recycling services.
Value Recovery: What We Buy
We evaluate equipment before it’s processed, and make an offer upfront when there’s resale potential. We buy:
- Servers and full data center lots
- Laptops
- Storage and drives
- Networking equipment
- Memory and backup tape
Browse everything on our sell your equipment hub.
How to Choose a Provider
Before you hand over equipment, check these:
- Certifications, such as R2v3, and current documentation.
- Chain of custody from pickup to final disposition.
- A Certificate of Data Destruction with serial numbers, the method, the date, and the standard followed. See our Certificate of Data Destruction guide.
- Experience with your equipment type and volume.
- Downstream transparency. Where does recycled material end up?
- Fair pricing, from more than one quote.
Our Phoenix Certified process and secure shipping options are built around these points. See who we’ve worked with on our references page.
What customers say:
- Masons of California appreciated getting a quote within 24 hours and an efficient path from shipment to payment, and they recommended the service to colleagues.
- Texas First Bank had a mix of old and new tapes to dispose of. They received a timely offer and a shipping label, then a check, and they’ve used the service repeatedly.
One Process, Different Sizes
The steps stay the same, but the scale changes. Small and midsize businesses can often work from a simple policy and one trusted provider. Larger organizations, including enterprises, healthcare systems, financial institutions, and government agencies, typically need ongoing inventory, documented policies, and bulk logistics. See our government, healthcare, and enterprise pages for more.
Frequently Asked Questions
What is secure IT asset disposal?
It’s the process of retiring IT equipment securely. It includes inventory, data sanitization or destruction, chain of custody, documentation, and resale or recycling.
How is IT asset disposal different from recycling?
Recycling recovers materials from equipment. Secure IT asset disposal covers the whole process, including destroying data first and documenting that it happened.
What standard should I follow for data destruction?
NIST SP 800-88 Revision 2 is the current guidance. Revision 1 was withdrawn when Revision 2 was published in September 2025.
Do I need a Certificate of Data Destruction?
You should have one. It’s your evidence that data was properly destroyed. A strong certificate lists each device’s serial number, the method, the date, and the standard followed.
Can I get paid for old IT equipment?
Often, yes. Servers, laptops, memory, drives, networking gear, and tape frequently have resale value. Get equipment evaluated before you recycle it.
Is deleting files enough?
No. Deleting files, formatting, or a factory reset can leave recoverable data behind. Use certified erasure or destruction.
Who needs secure IT asset disposal?
Any organization that stores data on devices, from small businesses to enterprises, healthcare providers, financial institutions, and government agencies.
Ready to Retire Your Equipment?
Don’t let old equipment become a liability. Get a free quote to see what yours is worth and how we’ll protect your data. You can also contact us with questions, or return to our IT asset disposition services for the full picture. For more on the process, read our guide to secure IT equipment disposal.
