How to securely dispose of company computers: a checklist for businesses

Why disposal is a security issue

Deleting files or reformatting a drive doesn't actually remove the data. In most cases it only removes the "map" that points to it, and the files can be recovered with free software. A factory reset is better, but depending on the device it isn't always a guarantee.

And it's not just computers. Copiers and multifunction printers often contain hard drives that store copies of scanned documents. Servers, network equipment, phones and tablets can hold sensitive data, too.

If a retired device with customer, patient or employee information ends up in the wrong hands, the cost goes well beyond the hardware: breach notifications, regulatory penalties and lost customer trust. A documented disposal process is how you prevent that, and how you prove you did.

Step 1: Take inventory

Before you call anyone, get a rough picture of what you have. It doesn't need to be perfect. Note:

• What and how many: laptops, desktops, servers, monitors, printers, phones, network gear
• Condition: which items still work and which don't
• Age: roughly when the equipment was purchased, which affects resale value
• Data: which devices hold data (anything with a hard drive, SSD or memory)
• Location: one office, several sites, or a storage unit

Step 2: Decide to reuse, resell or recycle

Every device ends up on one of three paths:

• Redeploy internally. If it still meets someone's needs, reuse it after the data is wiped.
• Resell. Newer, fully working business equipment can have real resale value that offsets your disposal costs. At iRecycleKC, for example, we buy fully working equipment that is 5 years old or newer in quantities of 75+ units, or 3 years old or newer in smaller quantities. See our buyback requirements.
• Recycle. Everything else should be recycled responsibly so metals, plastics and circuit boards are recovered and kept out of landfills.

Whichever path a device takes, data destruction comes first.

Step 3: Choose a data destruction method

The standard most organizations follow is NIST Special Publication 800-88, the media sanitization guidelines from the National Institute of Standards and Technology. It describes three levels:

• Clear: software overwrites the data so it can't be recovered with standard tools. Common for hard drives that will be reused or resold.
• Purge: stronger techniques, such as a drive's built-in sanitize or cryptographic erase commands, that protect against advanced laboratory recovery. Especially relevant for solid-state drives (SSDs).
• Destroy: the media is physically destroyed so it can never be read or used again.

SSDs store data differently than traditional spinning hard drives, so make sure your vendor uses methods suited to the drive type. Learn how we handle data destruction.

Step 4: Pick the right vendor

Ask any recycler or ITAD (IT asset disposition) provider these questions before you hand over equipment:

1. Will I get a certificate of data destruction, and does it list drives by serial number?
2. What standard do you follow for wiping, such as NIST 800-88?
3. Can you physically destroy drives if we require it?
4. Where is the equipment processed, and who handles the material that can't be reused? Look for R2v3 or e-Stewards certified recyclers in the chain.
5. Do you pick up, and how is the equipment transported?
6. Will you pay for equipment that has resale value, and what are your requirements?
7. Can you share reviews or references from businesses like ours?

Be cautious with anyone who offers to haul everything away with no paperwork. If they can't document it, you can't prove it was handled properly.

Step 5: Get the paperwork and file it

When the job is done, you should receive:

• A Certificate of Data Destruction
• A Certificate of Recycling for the rest of the equipment
• An asset list showing what was collected
• A settlement statement if any equipment was purchased

Store these digitally with your IT asset records so you can find them during an audit, a cyber-insurance review or a compliance check. Not sure what a good certificate looks like? Read what a certificate of data destruction should include.

Mistakes to avoid

• Letting equipment pile up. Stored devices can be lost or stolen, and they lose resale value every month they sit.
• Pulling drives yourself and losing track of them. Loose drives in a drawer are a risk of their own.
• Relying on "delete" or a quick reformat. The data is usually still there.
• Forgetting copiers, phones and network gear. If it stores data, it needs to be sanitized.
• Choosing a vendor that can't document anything. No certificate means no proof.

About the author

Asencio Renteria-vigil is COO of iRecycleKC, a Kansas City IT asset disposition and electronics recycling company with 19+ years in the industry.