A mid-market ITAD engagement should produce a file that accounts for every device you handed over. That file holds the inventory you made before pickup, signed custody records for the shipment, the provider's inventory of what it received, a sanitization or destruction record for each device that stored data, a record of where the hardware went afterward, and a settlement for anything resold. You should be able to pick any serial number from your list and follow it to one recorded outcome. If you can't, the file has a gap, however many certificates it contains.
\n","summary":"A mid-market ITAD engagement should produce a file that follows every device from your own pre-pickup inventory to one recorded outcome: signed custody records, the provider's serialized inventory, a sanitization or destruction record for each data-bearing device, a record of where the hardware went, and a settlement for anything resold.","publishedAt":"2026-08-11T19:23:00","verifiedAt":"2026-09-14T00:00:00","editorialStatus":"APPROVED","lastReviewedAt":"2026-10-10T05:01:32.127","nextReviewDueAt":"2026-12-14T00:00:00","templateVersion":"v2","aliases":["What paperwork should an ITAD vendor give you?","What should a certificate of data destruction include?","What documents prove hard drives were destroyed?","How do you reconcile an ITAD disposition report to your inventory?","What is required on a NIST 800-88 certificate of sanitization?","How long do you have to keep ITAD records?","What is a chain of custody document in IT asset disposition?","What does NAID AAA require a destruction provider to document?","What does R2v3 require for downstream tracking documentation?","What ITAD documentation red flags should buyers watch for?"],"confidenceScore":82,"confidenceLabel":"High","canonicalUrl":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"contributorOrganizationProfile":{"entityId":"ec39deab-44fe-48d8-9029-fefe993ab85a","legalName":null,"description":null,"websiteUrl":null,"imageUrl":null,"slogan":null,"subtitle":null,"facts":[],"coiNote":null,"foundingDate":null,"numberOfEmployeesText":null,"contactPoint":null,"address":null,"headquartersText":null,"organizationType":null},"contributorPerson":null,"sections":[{"id":"37a96ffb-b871-4842-b01b-2219b111b424","sectionKey":"start_with_a_list_you_made_before_pickup","sectionType":"markdown_section","heading":"Start with a list you made before pickup","introMarkdown":"The first document is yours. Before anything leaves the building, list each device by make, model and serial number, and add your asset tag where you use one. Every later record gets compared with this list. If nobody at your company works on asset disposal full time, that comparison should be something one person can do in a spreadsheet.\n\nNIST makes the case for the list in its [media sanitization guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf), revised in September 2025. Sanitization records are most useful, it says, when you also keep records of when media entered your environment, when it left the place it was last used and when it reached its destination afterward. If tracking breaks down before that last stage, the certificates show that particular media were sanitized. They don't show that all of your media were.","introHtml":"The first document is yours. Before anything leaves the building, list each device by make, model and serial number, and add your asset tag where you use one. Every later record gets compared with this list. If nobody at your company works on asset disposal full time, that comparison should be something one person can do in a spreadsheet.
\nNIST makes the case for the list in its media sanitization guidelines, revised in September 2025. Sanitization records are most useful, it says, when you also keep records of when media entered your environment, when it left the place it was last used and when it reached its destination afterward. If tracking breaks down before that last stage, the certificates show that particular media were sanitized. They don't show that all of your media were.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":10},{"id":"5cdc684b-d1c5-4ebb-898a-e5a2135feb0d","sectionKey":"what_the_custody_record_covers","sectionType":"markdown_section","heading":"What the custody record covers","introMarkdown":"The custody record covers the trip from your site to the provider's. Greentec, an ITAD provider with a processing facility in Ontario, describes what goes into one in its account of [its chain-of-custody service](https://knowledge.greentec.com/knowledge/what-is-your-chain-of-custody). The customer sends a manifest or inventory list with each shipment, along with a bill of lading. The driver checks and signs the bill of lading, which describes the materials and gives the number of skids or containers, their weights, the pickup location and time, and the destination. When the shipment arrives, Greentec says each container or skid is checked against the manifest and the bill of lading. Any discrepancy is written on the bill of lading and reported to the logistics supervisor.\n\nA bill of lading records the number of containers and their weight, so it can show whether the same count arrived that was picked up. Which devices were inside is a question for the two inventories, yours and the provider's. Keep the signed copy from pickup, and ask for the receiving record with any discrepancies noted on arrival.","introHtml":"The custody record covers the trip from your site to the provider's. Greentec, an ITAD provider with a processing facility in Ontario, describes what goes into one in its account of its chain-of-custody service. The customer sends a manifest or inventory list with each shipment, along with a bill of lading. The driver checks and signs the bill of lading, which describes the materials and gives the number of skids or containers, their weights, the pickup location and time, and the destination. When the shipment arrives, Greentec says each container or skid is checked against the manifest and the bill of lading. Any discrepancy is written on the bill of lading and reported to the logistics supervisor.
\nA bill of lading records the number of containers and their weight, so it can show whether the same count arrived that was picked up. Which devices were inside is a question for the two inventories, yours and the provider's. Keep the signed copy from pickup, and ask for the receiving record with any discrepancies noted on arrival.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":20},{"id":"101597da-fd1a-4b34-a62a-e8f3a2c8a968","sectionKey":"inventory_and_sanitization_evidence_are_separate_records","sectionType":"markdown_section","heading":"Inventory and sanitization evidence are separate records","introMarkdown":"Once the equipment is unpacked, the provider makes its own inventory. On [its enterprise ITAD page](https://www.greentec.com/industry/enterprise), Greentec says its inventory lists each item's make, model and serial number, along with diagnostics and an asset tag or location. This is the record you match against your own list, line by line.\n\nAn inventory line shows that a device was received. It says nothing about the data on it. That takes a second record. NIST says a certificate of sanitization should be completed for each storage medium, as your organization's policy directs. It should give at least the manufacturer, model and serial number, the media type and source, the method and technique, the tool and its version, the verification method, and who verified and validated the result, with a date, location and signature. NIST's sample form is an example, and an electronic record serves as well.\n\nVerification and validation are two steps in that record. Verification checks that the technique finished properly, for instance by reading the tool's completion status and errors. Validation is the decision to accept the result as effective or reject it. NIST's example is degaussing a solid-state drive: the operation can complete while no sensitive data is sanitized. So a line that says \"completed\" is evidence that a tool ran. The method, the media type and the name of the person who accepted the result let you judge whether that method suited the device.\n\nGreentec's process shows why the two records have to be read together. It says drives are wiped with licensed software, and any device that fails to wipe is physically shredded. It issues a certificate of data erasure backed by the serialized inventory. For shredded devices, it describes [a certificate of destruction](https://knowledge.greentec.com/knowledge/what-are-your-certified-shred-services) that gives the services performed, the time of destruction, and the make, model and serial number of each device. Shredding happens at its plant or at the customer's site with a mobile shredder.\n\nSo one laptop can start on the erasure path and end on the destruction path. The file should show that change against its serial number. If it doesn't, a failed wipe and a missing certificate look the same from your side.","introHtml":"Once the equipment is unpacked, the provider makes its own inventory. On its enterprise ITAD page, Greentec says its inventory lists each item's make, model and serial number, along with diagnostics and an asset tag or location. This is the record you match against your own list, line by line.
\nAn inventory line shows that a device was received. It says nothing about the data on it. That takes a second record. NIST says a certificate of sanitization should be completed for each storage medium, as your organization's policy directs. It should give at least the manufacturer, model and serial number, the media type and source, the method and technique, the tool and its version, the verification method, and who verified and validated the result, with a date, location and signature. NIST's sample form is an example, and an electronic record serves as well.
\nVerification and validation are two steps in that record. Verification checks that the technique finished properly, for instance by reading the tool's completion status and errors. Validation is the decision to accept the result as effective or reject it. NIST's example is degaussing a solid-state drive: the operation can complete while no sensitive data is sanitized. So a line that says "completed" is evidence that a tool ran. The method, the media type and the name of the person who accepted the result let you judge whether that method suited the device.
\nGreentec's process shows why the two records have to be read together. It says drives are wiped with licensed software, and any device that fails to wipe is physically shredded. It issues a certificate of data erasure backed by the serialized inventory. For shredded devices, it describes a certificate of destruction that gives the services performed, the time of destruction, and the make, model and serial number of each device. Shredding happens at its plant or at the customer's site with a mobile shredder.
\nSo one laptop can start on the erasure path and end on the destruction path. The file should show that change against its serial number. If it doesn't, a failed wipe and a missing certificate look the same from your side.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":30},{"id":"90a8bcb1-f124-4a4b-b75b-3d83c90f5179","sectionKey":"where_the_hardware_and_the_money_go","sectionType":"markdown_section","heading":"Where the hardware and the money go","introMarkdown":"Sanitization isn't the end of the device. It gets resold, destroyed or broken down for materials, and the file should say which. Greentec describes those three paths on its enterprise page. Devices that can be remarketed are resold, with rebate value passed back to the customer. A device that fails wiping goes to the shredder. The rest, electronics that can't be refurbished, are broken down for copper, steel, aluminum and precious metals. Greentec documents each of those material streams by weight in a certificate of recycling.\n\nA certificate by weight is the right record for material, but it can't identify a device, because shredded steel carries no serial numbers. So the outcome for each device has to come from the inventory, where every line should end in resold, destroyed or recycled. If equipment leaves your provider for another processor, the record should name that company. Whether you get that name is a term to settle in the contract.\n\nThe money needs its own statement. Resale proceeds are a commercial term, so the contract decides how they're calculated and reported. We'd ask for the settlement by serial number: the sale price or agreed value for each resold device, any fees deducted, and the amount paid to you. Then a resold serial number can be matched to its erasure certificate. A device that appears in the settlement with no sanitization record is the case you most want to catch.","introHtml":"Sanitization isn't the end of the device. It gets resold, destroyed or broken down for materials, and the file should say which. Greentec describes those three paths on its enterprise page. Devices that can be remarketed are resold, with rebate value passed back to the customer. A device that fails wiping goes to the shredder. The rest, electronics that can't be refurbished, are broken down for copper, steel, aluminum and precious metals. Greentec documents each of those material streams by weight in a certificate of recycling.
\nA certificate by weight is the right record for material, but it can't identify a device, because shredded steel carries no serial numbers. So the outcome for each device has to come from the inventory, where every line should end in resold, destroyed or recycled. If equipment leaves your provider for another processor, the record should name that company. Whether you get that name is a term to settle in the contract.
\nThe money needs its own statement. Resale proceeds are a commercial term, so the contract decides how they're calculated and reported. We'd ask for the settlement by serial number: the sale price or agreed value for each resold device, any fees deducted, and the amount paid to you. Then a resold serial number can be matched to its erasure certificate. A device that appears in the settlement with no sanitization record is the case you most want to catch.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":40},{"id":"e41ac570-b43e-4fc8-85d0-6a47ad294a15","sectionKey":"what_each_record_shows_and_what_it_leaves_open","sectionType":"table_section","heading":"What each record shows and what it leaves open","introMarkdown":null,"introHtml":null,"outroMarkdown":null,"outroHtml":null,"contentJson":{"rows":[{"cells":["Your inventory, made before pickup","Which devices you meant to retire, by serial number","Whether the list was complete"]},{"cells":["Signed bill of lading and receiving record","Containers, weights, pickup time and place, and discrepancies on arrival","Which devices were inside"]},{"cells":["Provider's serialized inventory","Which devices the provider received, and their condition","What happened to the data"]},{"cells":["Certificate of sanitization or erasure","The method, tool, verification and sign-off for a serial number","Where the device went next"]},{"cells":["Certificate of destruction","That a serial number was physically destroyed, and when","What became of the material"]},{"cells":["Certificate of recycling","Material streams by weight","The outcome for any one device"]},{"cells":["Settlement statement","What each resold device earned and what you were paid","Whether the data was removed first"]}],"columns":["Record","What it records","What it leaves open"]},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":50},{"id":"6c1a3d4a-0421-45a9-bd40-ee2c73d53dc5","sectionKey":"matching_totals_can_hide_a_mismatch","sectionType":"markdown_section","heading":"Matching totals can hide a mismatch","introMarkdown":"Suppose you retire 300 laptops from two offices. Your list has 300 serial numbers, and the provider's inventory comes back with 300 lines. The totals match, and it's tempting to stop there.\n\nNow match the serial numbers. Suppose 296 of them appear on both lists. Four of yours are missing from the provider's inventory, and four of the provider's aren't on your list. The count hid this because the two errors cancel.\n\nOne harmless explanation is a recording difference. Someone typed an asset tag where the serial number belonged, or your list carries the laptop's serial number and the provider recorded the drive's. A worse one is that four of your laptops never arrived and four devices from somewhere else did. You can't tell which from the totals, so each of the eight lines needs an answer in writing.\n\nThat written answer is the exception report. It lists every line that didn't match and says how each one was resolved. Lines that are still open stay on it.\n\nThe same check applies to outcomes. Suppose the 296 matched laptops close out as 235 erased and resold and 61 shredded, nine of those after a failed wipe. You should then hold 235 erasure records, 61 destruction records and a settlement covering 235 serial numbers. Each of the nine failed wipes should show an erasure attempt that was rejected, followed by a destruction record. Add the four laptops still open on the exception report and you're back at 300, with each one in exactly one place. The provider's four unmatched lines stay on that report too, until someone says whose devices they were.","introHtml":"Suppose you retire 300 laptops from two offices. Your list has 300 serial numbers, and the provider's inventory comes back with 300 lines. The totals match, and it's tempting to stop there.
\nNow match the serial numbers. Suppose 296 of them appear on both lists. Four of yours are missing from the provider's inventory, and four of the provider's aren't on your list. The count hid this because the two errors cancel.
\nOne harmless explanation is a recording difference. Someone typed an asset tag where the serial number belonged, or your list carries the laptop's serial number and the provider recorded the drive's. A worse one is that four of your laptops never arrived and four devices from somewhere else did. You can't tell which from the totals, so each of the eight lines needs an answer in writing.
\nThat written answer is the exception report. It lists every line that didn't match and says how each one was resolved. Lines that are still open stay on it.
\nThe same check applies to outcomes. Suppose the 296 matched laptops close out as 235 erased and resold and 61 shredded, nine of those after a failed wipe. You should then hold 235 erasure records, 61 destruction records and a settlement covering 235 serial numbers. Each of the nine failed wipes should show an erasure attempt that was rejected, followed by a destruction record. Add the four laptops still open on the exception report and you're back at 300, with each one in exactly one place. The provider's four unmatched lines stay on that report too, until someone says whose devices they were.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":60},{"id":"e4c007ef-8441-42bc-ace4-0231c0eeb7e3","sectionKey":"what_certification_and_the_contract_each_settle","sectionType":"markdown_section","heading":"What certification and the contract each settle","introMarkdown":"Greentec says it holds NAID AAA certification for data destruction and R2v3 certification for refurbishment and recycling, and that both are independently audited. A certification like those tells you that a provider's process has been checked against a published standard. That helps when you're choosing a provider. It doesn't decide what your own file has to contain.\n\nWhat you're required to keep is a separate matter. It depends on the kind of data the devices held, and on the laws, regulators and customer contracts that apply to you. So the provider's certification, your own obligations and the contract answer different questions.\n\nThe contract is where you can specify the file. Greentec's public pages describe the documents it issues. Delivery timing, file format, export access and any reporting fees are contract terms, with Greentec as with any provider. In the statement of work, name each document and set a delivery date after processing. Say that the inventory, the device-level certificates and the settlement are reported by serial number, and the recycling certificate by weight. State how long the provider keeps its copy. How long you keep yours depends on your own obligations. No single retention period applies to every company.","introHtml":"Greentec says it holds NAID AAA certification for data destruction and R2v3 certification for refurbishment and recycling, and that both are independently audited. A certification like those tells you that a provider's process has been checked against a published standard. That helps when you're choosing a provider. It doesn't decide what your own file has to contain.
\nWhat you're required to keep is a separate matter. It depends on the kind of data the devices held, and on the laws, regulators and customer contracts that apply to you. So the provider's certification, your own obligations and the contract answer different questions.
\nThe contract is where you can specify the file. Greentec's public pages describe the documents it issues. Delivery timing, file format, export access and any reporting fees are contract terms, with Greentec as with any provider. In the statement of work, name each document and set a delivery date after processing. Say that the inventory, the device-level certificates and the settlement are reported by serial number, and the recycling certificate by weight. State how long the provider keeps its copy. How long you keep yours depends on your own obligations. No single retention period applies to every company.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":70},{"id":"7599462c-6f39-4178-99ac-784f1cf58462","sectionKey":"what_the_file_leaves_open","sectionType":"markdown_section","heading":"What the file leaves open","introMarkdown":"A complete file shows what was recorded. It can't show that your starting list was complete, because a device you never listed can't turn up as missing. That part belongs to your own asset management.\n\nThe file also records work you didn't see. A certificate is the provider's statement that the work was done. If you need more than a statement for some equipment, you can ask to witness the destruction, and having it done at your site is one way to arrange that. We weigh those in [whether NAID AAA certification covers onsite hard-drive destruction](https://www.answerstack.io/q/does-naid-aaa-certification-cover-onsite-hard-drive-destruction) and [whether onsite destruction is worth the premium over offsite](https://www.answerstack.io/q/is-onsite-hard-drive-destruction-worth-the-premium-over-offsite).","introHtml":"A complete file shows what was recorded. It can't show that your starting list was complete, because a device you never listed can't turn up as missing. That part belongs to your own asset management.
\nThe file also records work you didn't see. A certificate is the provider's statement that the work was done. If you need more than a statement for some equipment, you can ask to witness the destruction, and having it done at your site is one way to arrange that. We weigh those in whether NAID AAA certification covers onsite hard-drive destruction and whether onsite destruction is worth the premium over offsite.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":80}],"citations":[{"title":"NIST SP 800-88 Revision 2, Guidelines for Media Sanitization","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf","excerpt":null,"quoteText":"Following sanitization, a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies.","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Sec. 4.6 per-medium certificate of sanitization and its minimum field list; optional pre-sanitization categorization; electronic records preferred for retention and search; lifecycle record-keeping rationale that sanitization records alone cannot show whether all media are being sanitized; verificat","domain":"nvlpubs.nist.gov","publisherName":"National Institute of Standards and Technology"},{"title":"SP 800-88 Rev. 2, Guidelines for Media Sanitization","url":"https://csrc.nist.gov/pubs/sp/800/88/r2/final","excerpt":null,"quoteText":"Date Published: September 2025. Supersedes: SP 800-88 Rev. 1 (12/17/2014)","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Revision 2 is final, published September 2025, and supersedes SP 800-88 Rev. 1 (12/17/2014)","domain":"csrc.nist.gov","publisherName":"NIST Computer Security Resource Center"},{"title":"SP 800-88 Rev. 1, Guidelines for Media Sanitization (withdrawn)","url":"https://csrc.nist.gov/pubs/sp/800/88/r1/final","excerpt":null,"quoteText":"Withdrawn on September 26, 2025. Superseded by SP 800-88 Rev. 2","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Revision 1 was withdrawn on September 26, 2025 and superseded by Revision 2, which is why a contract specification citing Rev. 1 is out of date","domain":"csrc.nist.gov","publisherName":"NIST Computer Security Resource Center"},{"title":"i-SIGMA Certification Specifications Reference Manual (0925M)","url":"https://isigmaonline.org/wp-content/uploads/2026/05/i-SIGMA-Certification-Specifications-Reference-Manual_0925M.pdf","excerpt":null,"quoteText":"The log of recorded serial numbers is returned to the Data Controller upon the completion of the service, unless the Data Controller has opted out of this requirement.","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Serial-number recordation for hard drives and solid-state devices and return of the log to the data controller unless an opt-out agreement is signed; custody-transfer receipt showing type and quantity; written disclosure of a subcontractor's name and service; advance written description of the destr","domain":"isigmaonline.org","publisherName":"i-SIGMA"},{"title":"NAID AAA Certification | Secure Data Destruction","url":"https://isigmaonline.org/certifications/naid-aaa-certification/","excerpt":null,"quoteText":"a rigorous audit program that includes both scheduled and unannounced reviews","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"The certification runs an audit program including both scheduled and unannounced reviews, and endorsements define services such as mobile on-site, facility-based operations, and specific media types","domain":"isigmaonline.org","publisherName":"i-SIGMA"},{"title":"Customer Misconception: The Certificate of Destruction Removes Regulatory Liability","url":"https://isigmaonline.org/customer-misconception-the-certificate-of-destruction-removes-regulatory-liability-selling-information-disposition-by-the-book-vol-7/","excerpt":null,"quoteText":"the more significant reason the CoD is not capable of transferring liability is because regulations do not allow for it","sourceRole":"SUPPORTING","verifiedAt":"2026-09-15T00:00:00","supportsText":"The certification body's own position that a certificate of destruction does not transfer regulatory responsibility from the client to the service provider and that the client answers for its selection of that provider. Trade association commentary, attributed in text and not treated as a regulator'","domain":"isigmaonline.org","publisherName":"i-SIGMA (Bob Johnson)"},{"title":"Summary of R2v3 Requirements","url":"https://sustainableelectronics.org/wp-content/uploads/2021/05/Summary-of-R2v3-Requirements.pdf","excerpt":null,"quoteText":"Downstream tracking and verification can stop at the first R2v3 Certified DSV since that vendor has already been audited and verified through the certification process. Facilities that choose to stop tracking at the first R2v3 facility, must register their downstream chain with SERI.","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Core 5 tracking records for inbound, in-process, and outbound streams and the one-year storage limit on negative value streams; Core 7 data security and the two sanitization paths; Appendix A downstream tracking to final disposition, the definition of final disposition, and the allowance to stop tra","domain":"sustainableelectronics.org","publisherName":"SERI (Sustainable Electronics Recycling International)"},{"title":"Discussion on Logical Data Sanitization in R2v3","url":"https://sustainableelectronics.org/knowledge-base/discussion-on-logical-data-sanitization-in-r2v3/","excerpt":null,"quoteText":"Appendix B(13) is different than verifying that a record of data sanitization is available for the media. This requirement relies on the technique of actually trying to recover data from the device.","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"Spreadsheet sanitization records invite transcription and copy-paste errors; per-step, per-device technician signoff instead of a batch signoff; Appendix B(13) verification is an actual attempted recovery with commercial software and not a records check; R2v3 sits between NIST's Clear and Purge and ","domain":"sustainableelectronics.org","publisherName":"SERI R2 Guidance and Knowledge Base"},{"title":"Morgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information of Millions of Customers","url":"https://www.sec.gov/newsroom/press-releases/2022-168","excerpt":null,"quoteText":"A records reconciliation exercise undertaken by the firm during this decommissioning process revealed that 42 servers, all potentially containing unencrypted customer PII and consumer report information, were missing.","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"September 20, 2022 announcement; $35 million penalty settling charges under the Safeguards and Disposal Rules of Regulation S-P; the firm-run records reconciliation during branch and local office decommissioning that revealed 42 missing servers potentially holding unencrypted customer PII and consum","domain":"sec.gov","publisherName":"U.S. Securities and Exchange Commission"},{"title":"OCC Assesses $60 Million Civil Money Penalty Against Morgan Stanley","url":"https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-134.html","excerpt":null,"quoteText":"failed to maintain appropriate inventory of customer data stored on the decommissioned hardware devices","sourceRole":"PRIMARY","verifiedAt":"2026-09-15T00:00:00","supportsText":"October 8, 2020 action assessing a $60 million civil money penalty against Morgan Stanley Bank, N.A. and Morgan Stanley Private Bank, N.A.; the finding that the banks failed to maintain appropriate inventory of customer data stored on decommissioned hardware devices and failed to adequately assess t","domain":"occ.gov","publisherName":"Office of the Comptroller of the Currency"},{"title":"45 CFR 164.310, Physical safeguards","url":"https://www.law.cornell.edu/cfr/text/45/164.310","excerpt":null,"quoteText":"Accountability (Addressable). Maintain a record of the movements of hardware and electronic media and any person responsible therefore.","sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Device and media controls standard; Disposal and Media re-use are Required implementation specifications; Accountability, meaning a record of the movements of hardware and electronic media and any person responsible, is Addressable; neither specification states a retention period","domain":"law.cornell.edu","publisherName":"Cornell Law School, Legal Information Institute"},{"title":"45 CFR 164.316, Policies and procedures and documentation requirements","url":"https://www.law.cornell.edu/cfr/text/45/164.316","excerpt":null,"quoteText":"Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.","sourceRole":"INDEPENDENT","verifiedAt":"2026-09-15T00:00:00","supportsText":"Six-year documentation retention as a Required implementation specification, running from creation or from the date the documentation was last in effect, whichever is later, and applying to the covered entity's or business associate's own documentation","domain":"law.cornell.edu","publisherName":"Cornell Law School, Legal Information Institute"},{"title":"Must Have Elements of a Data Destruction Certificate","url":"https://blancco.com/resources/blog-must-have-elements-of-a-data-destruction-certificate/","excerpt":null,"quoteText":"Date and duration of erasure with start/end time... Method used (IEEE 2883, NIST 800-88, etc.) and level of erasure (Clear/Purge)... Status of erasure (pass/fail)","sourceRole":"SUPPORTING","verifiedAt":"2026-09-15T00:00:00","supportsText":"A data erasure vendor's own element list for certificates its software produces: software and version, sectors reviewed or remapped, erasure start and end time with duration, method and level, pass or fail status, manufacturer, model, serial numbers, report UUID, report date, digital signature, and ","domain":"blancco.com","publisherName":"Blancco"}],"revisions":[{"revisedAt":"2026-08-11T19:23:00+00:00","versionLabel":"Originally published","note":"","reviewedBy":null}],"relatedAnswers":[{"id":"435f0a4b-7589-4f8a-8db8-fbd27a8ff260","slug":"which-itad-companies-in-canada-provide-destruction-records-tied-to-each-asset-s-serial-number","question":"Which ITAD companies in Canada provide destruction records tied to each asset's serial number?","publishedAt":"2026-09-29T14:42:00","confidenceScore":null,"confidenceLabel":null,"industry":{"id":"827514c6-e279-422b-b56a-f1cba07d8bd6","slug":"cybersecurity","label":"Cybersecurity","description":"SIEM, endpoint protection, and identity security"},"topic":{"slug":"itad-data-destruction","label":"ITAD & Data Destruction","description":"IT asset disposition, secure data destruction, and end-of-life electronics: certifications, chain of custody, documentation, and compliance.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Zonal ASD, Quantum Lifecycle Partners, Greentec and eCycle Solutions each describe serial-level destruction records. They differ on whose serial number appears and on whether the certificate covers one device or one load.","url":"/q/which-itad-companies-in-canada-provide-destruction-records-tied-to-each-asset-s-serial-number"},{"id":"4d8a8f27-c7f0-46c5-9d95-90ba68e1b109","slug":"which-electronics-recycling-providers-coordinate-pickups-across-multiple-canadian-offices","question":"Which electronics recycling providers coordinate pickups across multiple Canadian offices?","publishedAt":"2026-09-17T14:50:00","confidenceScore":null,"confidenceLabel":null,"industry":{"id":"827514c6-e279-422b-b56a-f1cba07d8bd6","slug":"cybersecurity","label":"Cybersecurity","description":"SIEM, endpoint protection, and identity security"},"topic":{"slug":"itad-data-destruction","label":"ITAD & Data Destruction","description":"IT asset disposition, secure data destruction, and end-of-life electronics: certifications, chain of custody, documentation, and compliance.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"eCycle Solutions, the Electronic Recycling Association, Quantum Lifecycle Partners and Greentec each describe a way to collect electronics from offices in several Canadian cities. eCycle and the association list locations in several provinces, Greentec describes one pickup process with processing at its Ontario plant, and Quantum runs data-centre decommissions at several sites under one plan.","url":"/q/which-electronics-recycling-providers-coordinate-pickups-across-multiple-canadian-offices"},{"id":"2b59274c-3317-43fc-9e27-904d77a8f9db","slug":"is-onsite-hard-drive-destruction-worth-the-premium-over-offsite","question":"Is onsite hard-drive destruction worth the premium over offsite?","publishedAt":"2026-08-28T14:15:05.515","confidenceScore":76,"confidenceLabel":"Medium","industry":{"id":"827514c6-e279-422b-b56a-f1cba07d8bd6","slug":"cybersecurity","label":"Cybersecurity","description":"SIEM, endpoint protection, and identity security"},"topic":{"slug":"itad-data-destruction","label":"ITAD & Data Destruction","description":"IT asset disposition, secure data destruction, and end-of-life electronics: certifications, chain of custody, documentation, and compliance.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"It is for any drive that a policy or contract says can't leave the building intact, because onsite is then the only route that complies. For other drives it's a choice with a price. On Recycle Bridge's published Toronto-area rates, onsite costs CA$185 more per visit and CA$15 more per drive than pickup with offsite destruction, or CA$365 extra for 12 drives. The premium removes the transport leg and allows witnessing. It doesn't by itself establish a better method, and it doesn't replace reconciling the serial log.","url":"/q/is-onsite-hard-drive-destruction-worth-the-premium-over-offsite"},{"id":"d315e34c-e0f9-4b5b-b120-e8a2eb2f57e5","slug":"does-naid-aaa-certification-cover-onsite-hard-drive-destruction","question":"Does NAID AAA certification cover onsite hard-drive destruction?","publishedAt":"2026-08-21T14:47:00","confidenceScore":92,"confidenceLabel":"High","industry":{"id":"827514c6-e279-422b-b56a-f1cba07d8bd6","slug":"cybersecurity","label":"Cybersecurity","description":"SIEM, endpoint protection, and identity security"},"topic":{"slug":"itad-data-destruction","label":"ITAD & Data Destruction","description":"IT asset disposition, secure data destruction, and end-of-life electronics: certifications, chain of custody, documentation, and compliance.","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Only when the provider's certificate says so. Onsite hard-drive destruction is covered when the NAID AAA certificate carries a Mobile Operation Endorsement that names Physical Hard Drive, lists the location that sends the truck and is valid on the service date. Solid-state drives need their own endorsement on the same mobile line, and a provider's service page shows what it sells, while the certificate shows what is certified.","url":"/q/does-naid-aaa-certification-cover-onsite-hard-drive-destruction"}],"contributorStats":{"verifiedAnswers":149,"openDisputes":0},"schemaJson":{"@context":"https://schema.org","@type":"Question","name":"What documentation should a mid-market ITAD engagement produce?","text":"What documentation should a mid-market ITAD engagement produce?","url":"https://www.answerstack.io/q/what-documentation-should-a-mid-market-itad-engagement-produce","answerCount":1,"datePublished":"2026-08-11T19:23:00","author":{"@type":"Organization","name":"AnswerStack","url":"https://www.answerstack.io/contributors/answer-stack"},"about":[{"@type":"Thing","name":"ITAD & Data Destruction"},{"@type":"Thing","name":"Cybersecurity"}],"acceptedAnswer":{"@type":"Answer","text":"A mid-market ITAD engagement should produce a file that accounts for every device you handed over. That file holds the inventory you made before pickup, signed custody records for the shipment, the provider's inventory of what it received, a sanitization or destruction record for each device that stored data, a record of where the hardware went afterward, and a settlement for anything resold. You should be able to pick any serial number from your list and follow it to one recorded outcome. If you can't, the file has a gap, however many certificates it contains.","url":"https://www.answerstack.io/q/what-documentation-should-a-mid-market-itad-engagement-produce","upvoteCount":0,"datePublished":"2026-08-11T19:23:00","dateModified":"2026-09-14T00:00:00","author":{"@type":"Organization","name":"AnswerStack","url":"https://www.answerstack.io/contributors/answer-stack"},"citation":[{"@type":"CreativeWork","name":"NIST SP 800-88 Revision 2, Guidelines for Media Sanitization","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf"},{"@type":"CreativeWork","name":"SP 800-88 Rev. 2, Guidelines for Media Sanitization","url":"https://csrc.nist.gov/pubs/sp/800/88/r2/final"},{"@type":"CreativeWork","name":"SP 800-88 Rev. 1, Guidelines for Media Sanitization (withdrawn)","url":"https://csrc.nist.gov/pubs/sp/800/88/r1/final"},{"@type":"CreativeWork","name":"i-SIGMA Certification Specifications Reference Manual (0925M)","url":"https://isigmaonline.org/wp-content/uploads/2026/05/i-SIGMA-Certification-Specifications-Reference-Manual_0925M.pdf"},{"@type":"CreativeWork","name":"NAID AAA Certification | Secure Data Destruction","url":"https://isigmaonline.org/certifications/naid-aaa-certification/"},{"@type":"CreativeWork","name":"Customer Misconception: The Certificate of Destruction Removes Regulatory Liability","url":"https://isigmaonline.org/customer-misconception-the-certificate-of-destruction-removes-regulatory-liability-selling-information-disposition-by-the-book-vol-7/"},{"@type":"CreativeWork","name":"Summary of R2v3 Requirements","url":"https://sustainableelectronics.org/wp-content/uploads/2021/05/Summary-of-R2v3-Requirements.pdf"},{"@type":"CreativeWork","name":"Discussion on Logical Data Sanitization in R2v3","url":"https://sustainableelectronics.org/knowledge-base/discussion-on-logical-data-sanitization-in-r2v3/"},{"@type":"CreativeWork","name":"Morgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information of Millions of Customers","url":"https://www.sec.gov/newsroom/press-releases/2022-168"},{"@type":"CreativeWork","name":"OCC Assesses $60 Million Civil Money Penalty Against Morgan Stanley","url":"https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-134.html"},{"@type":"CreativeWork","name":"45 CFR 164.310, Physical safeguards","url":"https://www.law.cornell.edu/cfr/text/45/164.310"},{"@type":"CreativeWork","name":"45 CFR 164.316, Policies and procedures and documentation requirements","url":"https://www.law.cornell.edu/cfr/text/45/164.316"},{"@type":"CreativeWork","name":"Must Have Elements of a Data Destruction Certificate","url":"https://blancco.com/resources/blog-must-have-elements-of-a-data-destruction-certificate/"}]}}}