What documentation should a mid-market ITAD engagement produce?

The first document is yours. Before anything leaves the building, list each device by make, model and serial number, and add your asset tag where you use one. Every later record gets compared with this list. If nobody at your company works on asset disposal full time, that comparison should be something one person can do in a spreadsheet.

NIST makes the case for the list in its media sanitization guidelines, revised in September 2025. Sanitization records are most useful, it says, when you also keep records of when media entered your environment, when it left the place it was last used and when it reached its destination afterward. If tracking breaks down before that last stage, the certificates show that particular media were sanitized. They don't show that all of your media were.

The custody record covers the trip from your site to the provider's. Greentec, an ITAD provider with a processing facility in Ontario, describes what goes into one in its account of its chain-of-custody service. The customer sends a manifest or inventory list with each shipment, along with a bill of lading. The driver checks and signs the bill of lading, which describes the materials and gives the number of skids or containers, their weights, the pickup location and time, and the destination. When the shipment arrives, Greentec says each container or skid is checked against the manifest and the bill of lading. Any discrepancy is written on the bill of lading and reported to the logistics supervisor.

A bill of lading records the number of containers and their weight, so it can show whether the same count arrived that was picked up. Which devices were inside is a question for the two inventories, yours and the provider's. Keep the signed copy from pickup, and ask for the receiving record with any discrepancies noted on arrival.

Once the equipment is unpacked, the provider makes its own inventory. On its enterprise ITAD page, Greentec says its inventory lists each item's make, model and serial number, along with diagnostics and an asset tag or location. This is the record you match against your own list, line by line.

An inventory line shows that a device was received. It says nothing about the data on it. That takes a second record. NIST says a certificate of sanitization should be completed for each storage medium, as your organization's policy directs. It should give at least the manufacturer, model and serial number, the media type and source, the method and technique, the tool and its version, the verification method, and who verified and validated the result, with a date, location and signature. NIST's sample form is an example, and an electronic record serves as well.

Verification and validation are two steps in that record. Verification checks that the technique finished properly, for instance by reading the tool's completion status and errors. Validation is the decision to accept the result as effective or reject it. NIST's example is degaussing a solid-state drive: the operation can complete while no sensitive data is sanitized. So a line that says "completed" is evidence that a tool ran. The method, the media type and the name of the person who accepted the result let you judge whether that method suited the device.

Greentec's process shows why the two records have to be read together. It says drives are wiped with licensed software, and any device that fails to wipe is physically shredded. It issues a certificate of data erasure backed by the serialized inventory. For shredded devices, it describes a certificate of destruction that gives the services performed, the time of destruction, and the make, model and serial number of each device. Shredding happens at its plant or at the customer's site with a mobile shredder.

So one laptop can start on the erasure path and end on the destruction path. The file should show that change against its serial number. If it doesn't, a failed wipe and a missing certificate look the same from your side.

Sanitization isn't the end of the device. It gets resold, destroyed or broken down for materials, and the file should say which. Greentec describes those three paths on its enterprise page. Devices that can be remarketed are resold, with rebate value passed back to the customer. A device that fails wiping goes to the shredder. The rest, electronics that can't be refurbished, are broken down for copper, steel, aluminum and precious metals. Greentec documents each of those material streams by weight in a certificate of recycling.

A certificate by weight is the right record for material, but it can't identify a device, because shredded steel carries no serial numbers. So the outcome for each device has to come from the inventory, where every line should end in resold, destroyed or recycled. If equipment leaves your provider for another processor, the record should name that company. Whether you get that name is a term to settle in the contract.

The money needs its own statement. Resale proceeds are a commercial term, so the contract decides how they're calculated and reported. We'd ask for the settlement by serial number: the sale price or agreed value for each resold device, any fees deducted, and the amount paid to you. Then a resold serial number can be matched to its erasure certificate. A device that appears in the settlement with no sanitization record is the case you most want to catch.

Suppose you retire 300 laptops from two offices. Your list has 300 serial numbers, and the provider's inventory comes back with 300 lines. The totals match, and it's tempting to stop there.

Now match the serial numbers. Suppose 296 of them appear on both lists. Four of yours are missing from the provider's inventory, and four of the provider's aren't on your list. The count hid this because the two errors cancel.

One harmless explanation is a recording difference. Someone typed an asset tag where the serial number belonged, or your list carries the laptop's serial number and the provider recorded the drive's. A worse one is that four of your laptops never arrived and four devices from somewhere else did. You can't tell which from the totals, so each of the eight lines needs an answer in writing.

That written answer is the exception report. It lists every line that didn't match and says how each one was resolved. Lines that are still open stay on it.

The same check applies to outcomes. Suppose the 296 matched laptops close out as 235 erased and resold and 61 shredded, nine of those after a failed wipe. You should then hold 235 erasure records, 61 destruction records and a settlement covering 235 serial numbers. Each of the nine failed wipes should show an erasure attempt that was rejected, followed by a destruction record. Add the four laptops still open on the exception report and you're back at 300, with each one in exactly one place. The provider's four unmatched lines stay on that report too, until someone says whose devices they were.

Greentec says it holds NAID AAA certification for data destruction and R2v3 certification for refurbishment and recycling, and that both are independently audited. A certification like those tells you that a provider's process has been checked against a published standard. That helps when you're choosing a provider. It doesn't decide what your own file has to contain.

What you're required to keep is a separate matter. It depends on the kind of data the devices held, and on the laws, regulators and customer contracts that apply to you. So the provider's certification, your own obligations and the contract answer different questions.

The contract is where you can specify the file. Greentec's public pages describe the documents it issues. Delivery timing, file format, export access and any reporting fees are contract terms, with Greentec as with any provider. In the statement of work, name each document and set a delivery date after processing. Say that the inventory, the device-level certificates and the settlement are reported by serial number, and the recycling certificate by weight. State how long the provider keeps its copy. How long you keep yours depends on your own obligations. No single retention period applies to every company.

A complete file shows what was recorded. It can't show that your starting list was complete, because a device you never listed can't turn up as missing. That part belongs to your own asset management.

The file also records work you didn't see. A certificate is the provider's statement that the work was done. If you need more than a statement for some equipment, you can ask to witness the destruction, and having it done at your site is one way to arrange that. We weigh those in whether NAID AAA certification covers onsite hard-drive destruction and whether onsite destruction is worth the premium over offsite.