The risk in asset disposal is not the hardware value, it is the data. A device leaving the building with recoverable data is a breach you have voluntarily handed to a third party, and the only defence is per-device erasure evidence.
Match the erasure method to the data. Software overwrite is sufficient for most data on functioning drives. Failed drives that cannot be verified need physical destruction, because an unverifiable wipe is not a wipe.
Record serials at every handover. Chain of custody without serial-level detail is unprovable. If a device later surfaces with data on it, serial-level records are what demonstrate where your responsibility ended.
Reconcile certificates against what you sent. ITAD providers issue certificates, and the count does not always match. Reconcile the serials on the certificate against your dispatch list, and chase any difference.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Data classification | Device state | Required method | Verification | Evidence |
|---|---|---|---|---|
| Public / Internal | Functioning | Single-pass overwrite or cryptographic erase | Tool verification report | Erasure report per serial |
| Confidential | Functioning | Verified overwrite or cryptographic erase | Tool verification plus sample re-check | Erasure report per serial |
More free templates IT teams use alongside this one.
Most asset registers die of one disease: nothing in the organisation forces them to be updated. This one is built around the three events that actually change an asset's state (assignment, repair, and disposal), so the register is maintained by the work rather than by an annual audit.
The risk in decommissioning is rarely the shutdown; it is the dependency nobody knew about and the data nobody checked for. This checklist front-loads both, and ends with the licence and backup cleanup that pays for the exercise.
Most organisations keep everything forever, which is expensive, increases breach impact, and conflicts with data protection obligations. A retention schedule only works if it names a legal basis per record type and records that deletion actually happened.
A verified single-pass overwrite or cryptographic erase is sufficient for functioning modern drives. Drives that have failed and cannot be verified require physical destruction, because an unverifiable wipe provides no assurance.
Per-serial erasure or destruction certificates, a signed chain of custody showing when custody transferred, and a reconciliation between what you dispatched and what the provider certified. Counts alone are not sufficient for audit.
Current certification such as R2 or equivalent, whether erasure happens on your site or theirs, whether certificates are issued per serial, their downstream disposal chain, and their insurance position if data is later recovered from a device.
