ENStarting point
An IT asset disposition programme (ITAD) should identify media, establish treatment according to risk, preserve custody and demonstrate the result before release. NIST SP 800-88 Rev. 2 organises sanitisation into methods and controls that need to be applied to the media type and subsequent use.
Two paths, linked records
Equipment path
- 01
Identification
Serial number, configuration, condition and ownership.
- 02
Assessment
Residual value and inspection criteria.
- 03
Routing
Reuse, repair, components or recycling according to the pathway.
- 04
Reconciliation
Output, documentation and commercial settlement within the contracted scope.
Media path
- 01
Identification
Medium linked to the asset inventory.
- 02
Custody
Responsible parties and movements tracked.
- 03
Treatment
Compatible method and defined service provider.
- 04
Validation
Result, evidence and failure handling.
The paths show control links, not simultaneity. Procedures, responsible parties and outputs depend on requirements and the contract.
Locate media and retention decisions
The IT inventory should identify where data exist, including devices embedded in equipment not usually treated as computers. Hard drives, SSDs, network equipment and printers may require different assessments. Link each medium to its asset and record situations where identification is missing or the unit cannot be accessed.
Before sanitisation, the information owner needs to resolve retention, required copies and any barriers to deletion. Asset retirement is not sufficient authorisation to erase any data. The organisation's policy should define who decides, how release is documented and what to do when there is uncertainty. This article presents management criteria; execution should follow procedures approved by information security and the relevant responsible parties.
Use a current reference for the programme
NIST SP 800-88 Rev. 2 was published in September 2025 and superseded the previous revision. It treats sanitisation as the process of making access to target data infeasible for a given level of effort. Its focus includes organising the programme and selecting controls compatible with information sensitivity. The reference is technical; its use does not in itself constitute provider certification or proof of compliance with every Brazilian obligation. [1]
The organisation should connect this reference to its policy, contractual requirements and equipment characteristics. The choice needs to consider reuse potential, but cannot be governed solely by resale value. An asset may be released only when treatment and acceptance conditions have been met or an authorised decision determines another route.
Distinguish sanitisation methods
The NIST reference distinguishes clear, purge and destroy. In management terms, these are levels and approaches with different capabilities to prevent data recovery and preserve the possibility of using the medium. The actual technique should be selected for the device and risk; the name of a command does not automatically prove that the objective has been achieved. [1]
| Method | Objective in brief | Implication for the decision |
|---|---|---|
| Clear | Protection against simple recovery through standard interfaces | Verify whether it meets the intended risk and destination requirements |
| Purge | Make recovery using advanced laboratory techniques infeasible | May preserve the possibility of reusing the medium |
| Destroy | Make the medium unusable and recovery infeasible in line with the objective | Requires an appropriate technique and management of the waste generated |
Ordinary formatting, file deletion and factory resets should not be accepted generically as proof of sufficient sanitisation. Assessment depends on what the procedure actually does to the device and the criteria established for that information.
Consider the particular characteristics of SSDs and encryption
Different media expose and manage storage in different ways. In flash devices, overwriting through the standard interface may not reach internally managed areas. Device documentation and relevant technical standards help select compatible techniques. NIST Rev. 2 refers to specific references, such as IEEE 2883, for storage sanitisation techniques. [1]
Cryptographic erase depends on correct implementation of encryption and key management. It is not simply deleting a password or disconnecting an account. It is necessary to assess whether the target data were protected, which keys and copies exist, and whether the procedure eliminates the possibility of recovery in line with the objective. When these conditions cannot be demonstrated, the responsible team needs to review the method choice.
Control custody throughout the operation
The chain of custody should record transfers, locations, responsible parties and item status. Use identification that connects the medium to the inventory, the procedure performed and completion evidence. Sealed containers, access control and counting may form part of the operation according to risk, but should belong to a verifiable procedure, rather than merely a commercial description.
Define what happens when a medium cannot be located, arrives damaged or has different identification. The discrepancy should prevent close-out of that item until investigation and a decision. A matching total count does not resolve mismatched serial numbers. Also establish access limits for records: an ITAD report should demonstrate execution without unnecessarily exposing data on the equipment.
Separate verification from validation
In NIST Rev. 2, verification examines sanitisation operation results, while validation decides whether those results are adequate for the intended protection. A command completed without error is relevant information, but its sufficiency depends on the chosen technique, device and observed conditions. Anomalies need analysis before the treatment is accepted. [1]
The contract should specify who performs these activities and what evidence remains available. Do not turn a software-generated report into automatic approval when failures, incompatibilities or incomplete information are present. A medium that does not meet the criterion should follow an exception path: repeat treatment where technically appropriate or adopt another authorised solution. The result and decision must remain linked to the item.
Require evidence compatible with the decision
A useful record structure includes asset and media identification, type and model, method and technique, the tool or equipment used, date, operator, result, verification and validation decision. Include the authorised destination and exception handling. These fields allow execution to be examined; the certificate format should be adapted to the procedure and the organisation's requirements.
Physical destruction requires the same care over suitability. Damaging the casing or drilling a device does not in itself demonstrate that every data-bearing area has become unrecoverable at the intended level. The choice should follow technical criteria for the medium and information. Evidence of treatment or disposal of the resulting waste is an additional workstream and does not replace the sanitisation record.
Release reuse by item and track exceptions
Illustrative example: of 200 media units processed, 190 have accepted treatment, six show failures and four remain unmatched to the inventory. The programme should not declare 200 items complete. The ten exceptions require investigation and controlled routing. Equipment release should consider which media belong to each device and what additional reuse conditions remain outstanding.
Monitor close-out time, the proportion of reconciled media and the causes of repeated treatment. These data help improve preparation, technique selection and provider control. The trade-in and ITAD programme can integrate inventory, commercial decisions and data security, preserving technical approval by the information owner.
Sources and references
References accessed on 30 September 2026. The numbering in the text indicates the concepts supported by each source.
Circuvia corporate content to support project discussions. Methods, acceptance criteria and applicable requirements are defined within the scope of each operation.
