--- title: "Decommissioning and IT asset disposition" description: "Decommissioning, data sanitization to NIST SP 800-88, certified destruction, asset recovery and responsible disposal, with chain of custody." url: https://www.expandware.com/services/data-centers/decommissioning-and-itad/ section: "Services" topics: ["Data Centers and Infrastructure", "NIST SP 800-88", "IEEE 2883", "R2 recyclers", "e-Stewards recyclers"] publisher: "Expandware Private Limited" --- # Decommissioning and IT asset disposition Decommissioning, data sanitization to NIST SP 800-88, certified destruction, asset recovery and responsible disposal, with chain of custody. Retire hardware without leaving data behind. Old hardware carries data long after it stops running. Decommissioning done carelessly leaves drives in storerooms, assets missing from the register and no proof that data was destroyed. We decommission systems in an order that protects what is still running, sanitize or destroy every storage device with a certificate tied to its serial number, recover value where hardware can be reused and dispose of the rest through certified recyclers. Where it usually starts: - Retired servers and drives are in storage, and nobody is sure what data they hold. - An audit asks for proof that decommissioned media was destroyed. - A data center exit leaves racks of hardware to remove. - The asset register and the hardware on the floor no longer match. What is included: - Decommissioning planning: Systems shut down in an order that protects the services still running. - Data sanitization: Overwrite, cryptographic erase or purge to NIST SP 800-88, verified per device. - Physical destruction: Shredding or degaussing where media cannot be sanitized. - Chain of custody: Every device tracked by serial number from rack to final disposition. - Asset recovery: Reusable hardware redeployed or resold to offset the cost. - Responsible recycling: Disposal through certified recyclers, with certificates. Where it sits: Decommissioning is the last part of the data center architecture's lifecycle: equipment leaves the racks, its data is destroyed, and the asset records close. Decisions to settle early: - On-site or off-site sanitization. On-site destruction keeps media under your control; off-site processing costs less. The sensitivity of the data decides. - Reuse, resell or recycle. Reuse saves the most; resale recovers some cost; recycling handles the rest. Only verified, erased equipment leaves for reuse or resale. - How much evidence to keep. Auditors and regulators expect certificates per device. The record is kept for as long as your obligations require. How the work runs: Inventory, Every device and the data it holds. Sanitize, Erased or destroyed, verified per device. Recover, Reuse or resale where possible. Certify, Certificates and records for audit. How it is bought: - A fixed-fee assessment: We inventory the equipment to be retired, match it to your asset register and identify what holds sensitive data. You receive the plan and a fixed price for decommissioning. - A fixed-price build: Shutdown sequencing, sanitization or destruction, chain of custody, asset recovery and recycling for the equipment in scope, at a fixed price. - Running it afterwards: Each project closes with certificates and an updated asset register; repeat projects follow the same recorded procedure. Worked example, a storeroom full of old drives. Say an insurer keeps retired servers and loose drives in storage from several refresh cycles, an auditor wants evidence that old disks were wiped or shredded, and the asset register no longer matches the hardware. - Inventory: We record every device and drive by serial number, match each to the asset register and flag those that hold customer data. - Sanitize: Drives fit for reuse are erased to NIST guidance and verified, and those that are not are shredded, each with a certificate. - Recover: Working servers are reset and either redeployed or resold, which offsets part of the cost. - Certify: Certificates, chain of custody records and recycling documents are compiled, and the asset register is corrected. At the end, the auditor has a certificate for every drive, the storeroom is empty, and the asset register matches the hardware that remains. (An illustration, not a client account.) What you have at the end: - Decommissioning plan and schedule: Which systems are shut down, in what order and when, so nothing still in use is switched off. - Device inventory with serial numbers: Every device and storage medium being retired, identified by serial number and location. - Sanitization and destruction certificates: Proof for each storage device that its data was erased or its media destroyed, tied to its serial number. - Chain of custody records: Where each device was, and who had it, from the rack to its final disposition. - Recycling certificates and an updated asset register: Evidence of responsible disposal, and an asset register that matches what remains. Standards and platforms worked with: NIST SP 800-88, IEEE 2883, R2 recyclers, e-Stewards recyclers, WEEE Directive, ISO 14001. Where it goes wrong, and what we design out: - Formatting and hoping. Deleted files and formatted drives can often be recovered. Media is sanitized to the recognized standard or destroyed. - Losing track of devices. A drive missing from the chain of custody is a breach risk. Every device is tracked by serial number. - Shutting down what is still used. Systems retired in the wrong order take services with them. Shutdown follows confirmed dependencies. What it changes: - Proof the data is gone. Every drive has a certificate tied to its serial number. - A register that matches reality. Retired assets leave the record with evidence of where they went. - Value recovered. Hardware with remaining life is reused or resold instead of scrapped. How you will know it is working: - Each retired drive can be matched to its destruction certificate. - The asset register matches what remains. - Auditors receive evidence without a search. - Reusable hardware offsets part of the cost. Who you work with: - Decommissioning lead. Plans the shutdown sequence and confirms each step with system owners. - Technicians. Remove, sanitize or destroy media and maintain the chain of custody. - Asset coordinator. Reconciles the asset register and compiles certificates. What we need from you: - A list of equipment to be retired, and its location. - Owners who can confirm each system is no longer in use. - Your data retention and destruction requirements. - Access to the premises where the equipment sits. Common questions: Q: Is deleting files or formatting a drive enough? A: No. Deleted data can usually be recovered. Sanitization to NIST SP 800-88 uses overwrite, cryptographic erase or purge methods suited to each type of media, followed by verification. Q: How do you handle SSDs? A: With methods designed for flash storage, such as cryptographic erase or the manufacturer's sanitize commands, verified afterwards, or physical destruction where those are unavailable or not trusted. Q: Can drives be destroyed on our premises? A: Yes. On-site destruction can be arranged where policy requires that no media leaves the building intact, with a certificate issued for each device. Q: What happens to hardware that still works? A: After sanitization it can be redeployed in your estate or resold, with the proceeds offsetting the cost of the project. Hardware with no further use goes to certified recyclers. Q: What is the difference between clearing, purging and destroying media? A: NIST SP 800-88 defines three levels. Clearing overwrites data so it cannot be recovered with ordinary tools; purging uses methods such as cryptographic erase that defeat laboratory recovery; destroying makes the media physically unusable. The level depends on how sensitive the data is and whether the device will be reused. Q: Can decommissioning happen while the rest of the estate keeps running? A: Yes, and it usually has to. Systems are shut down in an order that respects their dependencies, each shutdown is confirmed with its owner, and nothing is removed until its data has been migrated or archived and its services are confirmed unused. Q: What certificates do we receive? A: A sanitization or destruction certificate for each storage device, identified by serial number, with the method and the date. Recycling certificates come from the certified recycler. Together with the chain of custody records, they are the evidence auditors and regulators ask for. Q: Does reselling hardware create a data risk? A: Not when sanitization is done and verified first. Only devices with a verified erase certificate are offered for reuse or resale, and anything that cannot be verified is destroyed instead. The certificate travels with the asset record. Often paired with: Data center migration and relocation, Servers, storage and hardware engineering, Device and endpoint management. --- Canonical page: https://www.expandware.com/services/data-centers/decommissioning-and-itad/ Site index for machines: https://www.expandware.com/llms.txt Full site text: https://www.expandware.com/llms-full.txt Expandware Private Limited. Inquiries: solutions@expandware.com, +92 (333) 32 11011.