Choosing an IT asset disposition (ITAD) provider is a risk-management decision, not just a recycling purchase. The vendor may take custody of laptops, servers, drives, phones, networking equipment, and other assets that still contain sensitive data or retain resale value.
A strong ITAD vendor evaluation should verify five areas: data security, chain of custody, certifications and downstream controls, asset recovery and reporting, and operational fit. The U.S. Environmental Protection Agency recommends certified electronics recyclers for businesses and large purchasers, while NIST SP 800-88 Rev. 2 emphasizes a documented media-sanitization program built around appropriate methods, controls, and validation.
Use these 25 questions before approving a vendor.
1. Data Security and Sanitization
How do you identify every data-bearing device?
The vendor should account for more than obvious hard drives. SSDs, phones, servers, printers, and storage appliances may contain data.
Which sanitization methods do you use for each media type?
Ask for the actual process, not a vague promise that data will be “wiped.”
How do you verify that sanitization succeeded?
A defensible process includes validation and records showing what happened to each relevant device. NIST SP 800-88 Rev. 2 places additional emphasis on sanitization validation and establishing trust in vendor implementations.
When do you physically destroy media instead of sanitizing it for reuse?
The answer should reflect media type, condition, information sensitivity, contractual requirements, and your policy.
Can you provide certificates or serialized records of data destruction?
Clarify what the certificate includes, whether serial numbers are recorded, and when documentation is delivered.
2. Chain of Custody and Physical Security
How are assets tracked from pickup through final disposition?
Will you provide a serialized inventory at pickup or receiving?
Who transports the equipment, and are subcontractors used?
What physical security controls protect assets in vehicles, warehouses, and processing areas?
What is your incident-response process if an asset is lost, stolen, or involved in a security breach?
Chain of custody should show who controlled the equipment, where it moved, and when responsibility changed. This matters most before data-bearing devices are sanitized. Current ITAD vendor-selection guidance also treats transportation, custody tracking, inventory control, and data security as core evaluation areas.
3. Certifications and Downstream Accountability
Do you hold current R2v3 or e-Stewards certification at the facility that will handle our equipment?
EPA identifies R2 and e-Stewards as the two accredited certification standards for electronics recyclers in the United States.
What exactly is included in your certification scope?
Do not stop at a logo. R2 certification can cover different specialized processes, and SERI distinguishes core data-security requirements from Appendix B Data Sanitization.
If data sanitization is included, does your R2 scope cover logical sanitization, physical destruction, or both?
Which downstream vendors receive our equipment, components, or commodities?
How do you qualify, monitor, and audit those downstream vendors?
R2v3 includes requirements for managing downstream recycling chains, while e-Stewards requires downstream due diligence covering areas such as legality, data security, environmental processing, and hazardous-material management.
If secure destruction is central to the project, also ask whether the relevant operation holds i-SIGMA NAID AAA Certification, which uses third-party audits to evaluate secure information-destruction practices, including security controls, chain of custody, and employee screening.
4. Reuse, Remarketing, Recycling, and Reporting
How do you decide whether an asset is reused, remarketed, harvested for parts, or recycled?
How is customer data protected before any device enters a resale channel?
How do you calculate resale value and customer revenue share?
What fees can be deducted from recovered value?
Ask about pickup, processing, testing, data services, freight, storage, and other charges.
What final reports will we receive?
Useful reporting may include serial numbers, disposition status, sanitization results, certificates, weights, and value-recovery details.
A transparent vendor should explain both where value is created and where costs are incurred.
5. Service, Pricing, and Operational Fit
What equipment types, quantities, and locations can you support?
Can you handle office closures, data-center projects, or multi-site refreshes without changing the control process?
What are your pickup, processing, sanitization, and reporting timelines?
What insurance coverage do you carry for the services you perform?
Can you provide references or examples of projects similar to ours?
Pricing should be evaluated alongside risk, service scope, documentation, and value recovery. A low quote can become expensive if it excludes secure transportation, serialized reporting, data destruction, or downstream accountability.
How to Compare ITAD Vendors Fairly
Put every candidate through the same scorecard. Weight the criteria that matter most to your organization; for highly sensitive equipment, data security and chain of custody may deserve more weight than resale return.
Verify certifications independently and confirm that the certified location and scope match the proposed services. Certification is useful evidence of third-party oversight, but it does not replace your own due diligence.
Frequently Asked Questions
Is R2 certification enough to select an ITAD vendor?
No single credential answers every procurement question. Verify the facility, scope, sanitization capabilities, downstream process, documentation, and service terms.
Should an ITAD vendor follow NIST SP 800-88?
If your organization uses NIST as its sanitization framework, ask how the vendor aligns with the current NIST SP 800-88 Rev. 2 guidance and documents validation. Revision 2 superseded Revision 1 in September 2025.
What is the biggest red flag when evaluating an ITAD vendor?
Lack of transparency. Be cautious when a provider cannot explain where assets go, who handles them, how data is sanitized, how downstream vendors are controlled, or what documentation you receive.
Choose the Process Before the Pickup
The best time to evaluate an ITAD vendor is before equipment leaves your control. Put security methods, tracking, downstream expectations, reporting, pricing, and timelines into the scope of work.
For Houston organizations planning an IT refresh, office cleanout, server retirement, or other ITAD project, LoneStar e-Waste can help connect you with an appropriate electronics recycling or IT asset disposition solution based on equipment, volume, data-security needs, and pickup requirements.
