Cybersecurity Awareness Month is a good time to review passwords, phishing defenses, multifactor authentication, software updates—and what happens to technology when it leaves your organization.
Retired laptops, servers, hard drives, SSDs, smartphones, network appliances, and multifunction printers can still contain sensitive information. If those assets leave your control without a documented disposition process, an otherwise strong cybersecurity program can develop a serious gap.
That is why IT asset disposition (ITAD)should be treated as part of information security, not simply as an equipment-recycling task.
NIST’s current media sanitization guidance, SP 800-88 Rev. 2, published in September 2025, takes a program-level approach to sanitization and disposal based on the sensitivity of the information involved. NIST specifically frames media sanitization as part of protecting information confidentiality when media is reused or disposed of.
Cybersecurity Does Not End When a Device Is Retired
Security teams spend years protecting systems while they are active. They manage access controls, endpoint protection, encryption, patches, monitoring, backups, and incident response.
But eventually every device reaches the end of its useful life.
At that point, the security question changes from “Who can access this system?” to “What happens to the information stored on it after the device leaves us?”
Simply deleting files, resetting a computer, removing an asset from Active Directory, or placing equipment in a storage room does not automatically satisfy an organization’s data-security requirements.
NIST defines media sanitization as a process that makes access to target data infeasible for a given level of effort. Its guidance encourages organizations to establish a media sanitization program rather than treating sanitization as an improvised task performed only when equipment is discarded.
ITAD provides the operational framework for carrying that responsibility through the final stage of the asset lifecycle.
Where ITAD Fits Into a Security Program
A mature ITAD process connects cybersecurity, IT operations, compliance, procurement, facilities, and asset management.
For a typical equipment retirement project, that means answering several questions before anything leaves the building:
What assets are being retired?
Which devices contain or may contain data?
What sensitivity does that information have?
Should each device be reused, sanitized, physically destroyed, or recycled?
Who is authorized to handle the equipment?
How will custody be documented?
What records will be provided after processing?
These controls matter because equipment disposition can involve multiple stages: internal collection, staging, transportation, processing, data sanitization, reuse, resale, component recovery, or recycling.
Every handoff deserves the same risk-based thinking organizations apply to other parts of their cybersecurity program.
Data Sanitization Should Be Based on Risk
There is no single disposal method appropriate for every device.
A reusable laptop may have a different disposition path from a failed server drive containing highly sensitive information. An SSD also requires different technical considerations from some traditional magnetic media.
NIST SP 800-88 Rev. 2 emphasizes choosing appropriate sanitization techniques and controls according to information sensitivity and organizational requirements. The revision also places greater emphasis on maintaining an enterprise sanitization program, validating sanitization, and establishing trust when vendors perform sanitization activities.
The important lesson for security leaders is simple: do not create one blanket instruction such as “wipe everything” and assume the problem is solved.
Your policy should define approved sanitization or destruction requirements for different categories of media and information.
Chain of Custody Is a Cybersecurity Control
Data protection does not begin only when a hard drive reaches a sanitization station.
Organizations should also understand what happens between the moment equipment is removed from service and the moment its data has been successfully addressed.
A useful chain-of-custody process can document asset identifiers, collection points, transfers, transportation, processing status, and final disposition.
This level of accountability is reflected in industry standards. SERI’s R2v3 framework includes data-security requirements, while Appendix B contains enhanced requirements for facilities performing data sanitization, including device tracking and sanitization records.
For organizations evaluating secure destruction providers, i-SIGMA’s NAID AAA Certification is another relevant credential. Its certification programs cover physical media destruction and electronic media erasure and include ongoing auditing requirements.
Vendor Due Diligence Matters
Outsourcing ITAD does not mean outsourcing responsibility for choosing an appropriate provider.
The Federal Trade Commission’s Disposal Rule, for example, applies to organizations covered by the rule that possess consumer-report information. FTC guidance specifically identifies due diligence when selecting disposal contractors as a reasonable measure and mentions evaluating audits, references, certifications, and information-security practices.
Even when that particular rule does not apply to your organization, the vendor-management principle is useful.
Before sending data-bearing equipment to an ITAD or recycling provider, ask:
How are assets tracked after pickup?
How is data sanitization validated?
What happens when a device cannot be successfully sanitized?
Can specific drives be physically destroyed when required?
What documentation will we receive?
Which certifications apply to the facility actually processing our equipment?
How are downstream vendors evaluated?
How are reusable assets handled before resale or redeployment?
EPA recommends that businesses, governments, and large purchasers use certified electronics recyclers and identifies R2 and e-Stewards as the two accredited electronics-recycling certification standards in the United States.
Build ITAD Into the Asset Lifecycle
Cybersecurity teams should not first hear about retired equipment when pallets of computers are already waiting for pickup.
Instead, create a documented process that begins when assets are acquired and continues through retirement.
At minimum, your organization should inventory assets, identify data-bearing equipment, classify information sensitivity, define sanitization requirements, establish authorized disposition paths, maintain custody records, verify processing, and retain appropriate documentation.
For larger environments, ITAD requirements can also become part of vendor contracts, technology-refresh plans, office relocations, data-center projects, mergers, and employee offboarding procedures.
Frequently Asked Questions
Is deleting files enough before recycling a computer?
Not necessarily. Organizations should use an approved sanitization process appropriate to the storage technology, information sensitivity, and intended disposition rather than relying on ordinary file deletion.
Should every hard drive be physically destroyed?
No. The appropriate approach depends on organizational policy, data sensitivity, media type, reuse plans, and applicable requirements. Some media may be securely sanitized and reused; other situations may justify physical destruction.
What documentation should businesses request after ITAD?
Depending on the project, useful records can include asset inventories, serial numbers, chain-of-custody documentation, processing reports, and certificates documenting data sanitization or destruction.
Make Asset Retirement Part of Cybersecurity
Cybersecurity Awareness Month should encourage organizations to examine the entire information lifecycle—including the point when technology leaves service.
A strong ITAD program helps close the gap between cybersecurity and equipment disposal by combining asset tracking, appropriate data sanitization, accountable custody, responsible recycling, vendor due diligence, and documentation.
For Houston organizations retiring computers, servers, storage devices, networking equipment, or other business electronics, LoneStar e-Waste helps connect businesses with appropriate local electronics recycling and ITAD solutions. Provide details about your equipment, quantity, data-security requirements, and timeline when requesting a quote so the right solution can be identified.
