Does NAID AAA certification cover onsite hard-drive destruction?

The scope is printed on the certificate itself. A one-page certificate i-SIGMA issued to Vanish Document Shredding of Houston shows one layout. Each platform has its own line, and each line lists the media it covers. The mobile line on that certificate reads "Mobile Operation Endorsement for Paper/Printed Media, Physical Hard Drive, Non-Paper Media, Solid-State Device & Product Destruction." A separate facility-based line carries its own media list. The certificate also lists the locations it applies to and prints a "Valid Through" date, which on this one was 30 September 2025. That date has passed, so the document shows the layout and no longer proves coverage.

For an onsite drive job, four things on that page have to line up. The platform has to be mobile. i-SIGMA places mobile operations at the client's site and facility-based operations at a secure, stationary location, so a facility line certifies work done at the plant. Physical Hard Drive has to be named inside the mobile line, because a media type that appears only on the facility line is certified only there. The branch that dispatches to you has to be among the listed locations, since the certificate applies to the locations it names. And the valid-through date has to fall on or after the day of service.

A current i-SIGMA membership doesn't settle that last point. Membership and certification are separate programs. Membership renews annually, and certification renews on the anniversary of its approval.

i-SIGMA's specifications manual lists Hard Drives and Solid-State Device as separate media endorsements under each platform. A mobile line that names one doesn't cover the other.

Suppose an Ontario company is retiring 150 laptops and a rack of servers under a policy that no drive leaves the building intact. Its inventory shows hard drives in the servers and solid-state drives in most of the laptops. That job needs both media named on the mobile line, so sort the asset list by drive type before you read the certificate.

The manual also treats overwriting and degaussing as their own endorsements, each with a facility-based and a mobile version. An erasure endorsement covers erasure, and it doesn't extend to drives that go through a shredder.

The mobile platform carries an on-premises requirement: destruction happens at the customer's premises. The audit checks that the provider's written procedures call for mobile work to be done at the customer's site unless the customer has agreed otherwise in writing. That exception is yours to control. Read the service agreement for any clause that permits destruction elsewhere, and state in your own contract that all destruction is completed at your address.

The manual's glossary describes a mobile operation as commercial-grade destruction equipment working inside an enclosed, securable truck or trailer at the customer's site. A provider that collects drives at your office and shreds them at its plant is doing facility-based work with a transport leg in front of it. The facility line of the certificate is the one that applies to that job, even when the quote calls the pickup onsite.

The hard-drive endorsement adds requirements for records. Before the job, the provider gives you a written description of how it destroys the drives. It records the serial number of every drive and returns the log when the service is complete, unless you've signed an opt-out agreement. The drives have to be damaged until the "platters will not engage." The solid-state endorsement follows the same pattern with two differences. Serial numbers are recorded "where possible," and the device has to be damaged until it can't be used.

That wording leaves two things to your contract. Neither endorsement sets a particle size for drives, so a shred dimension in your policy belongs in the agreement with the provider. And "where possible" leaves room for a solid-state drive with no readable serial number to be logged without one. Record the laptop's serial number or asset tag beside each solid-state drive in your inventory, and ask the provider to log that identifier when the drive has none.

Greentec, an Ontario IT asset disposition provider, shows how an offered service differs from a certified scope. Its certified shred article says devices can be shredded at Greentec's plant or on-site with its mobile shredder, and it lists hard drives and solid state drives among the media it accepts. A profile of Greentec on i-SIGMA's conference site describes the company as certified to NAID AAA.

Those pages tell you Greentec sells mobile shredding for both drive types and is described as holding the certification. The endorsements, the covered locations and the valid-through date are on the certificate. So for a mobile job you'd ask Greentec for the current certificate of the location dispatching the shredder, and read its mobile line. i-SIGMA's service provider locator lists NAID AAA Certified members, which lets you look the company up with the association itself.

The same reading applies when one job uses two methods. Greentec's secure destruction page says devices are wiped with licensed software and any device that fails the wipe is shredded. i-SIGMA certifies overwriting under a separate endorsement from physical destruction, so the wiped devices and the shredded ones fall under different lines of the certificate.

Greentec's article also says its certificate of destruction lists the services performed, the time of destruction, and the make, model and serial number of each device destroyed. That gives you a record to set against your own inventory after the visit. Ask about any drive on your list that the certificate doesn't show.

The certificate's own terms make the clearest requirement:

NAID AAA Certification with a Mobile Operation Endorsement for Physical Hard Drive and Solid-State Device, valid on the service date, for the location dispatching the vehicle. All destruction is completed at the customer's address, and no device listed for destruction leaves the premises intact.

Wording it this way brings in the manual's transparency in bidding requirement, which applies to every certified bidder. Where an RFQ requires NAID AAA certification, the bidder has to tell you in writing when any part of the requested service isn't certified at the time of the bid. It also has to say when a subcontractor is involved and whether that subcontractor holds the certification.

What happens to the equipment after destruction is a separate question from data security. RPRA registration for Ontario electronics service providers is checked on its own, and the RFQ can ask for it in a separate line.