Removing equipment does not retire its data
Consider a hypothetical branch replacing storage equipment that must be returned to a leasing company while staff may still need historical files. This is a process-design scenario, not a customer case. Checking boxes and asset labels alone leaves unanswered whether data was transferred, retention duties were met and residual information can be recovered. JOTOglobal recommends treating equipment retirement and data disposition as linked work items with separate acceptance decisions.
First establish why equipment is leaving: internal reassignment, repair, lease return and final disposal have different recipients and risks. The asset owner records equipment and media identifiers, location and recipient. The business owner identifies needed data, while the data owner checks retention and restrictions. Pause irreversible action where investigation, unclear retention or disputed ownership applies and refer it to authorized decision-makers; movers cannot substitute for business approval.
Choose methods for the media and information risk
MP-6 in NIST SP 800-53 Rev.5 calls for sanitizing media before disposal, release from organizational control or reuse, with mechanisms proportionate to the information’s security category. MP-6(1) also addresses review, approval, tracking, documentation and verification. These are control principles, not a command suitable for all equipment. The handover and acceptance workflow here is JOTOglobal guidance, not a replacement for media-specific vendor instructions or applicable requirements.
IT inventories disks, solid-state and embedded storage, and removable components, checking model, health, supported methods and verification capability. Ordinary deletion, formatting or factory reset must not be recorded as secure sanitization without validation. A failed command on faulty media does not establish absence of data. Security should select an approved alternative disposition path after checking lease, repair and asset-disposal conditions.
Approve sanitization after migration and retention checks
The migration owner lists data to retain, its destination, permissions, version and business acceptor. After copying, authorized business users should locate and open needed files and confirm that critical work continues in the new environment. A backup’s existence does not prove timely recovery or authorize immediate removal of historical data. Resolve migration differences, missing files and unreadable records first; the data owner confirms retention conditions.
The sanitization ticket should identify specific equipment and media, the data-handling basis, recipient, method, operator, verifier and stop conditions. Recheck asset identifiers before execution to avoid including live equipment or spare media in the retirement batch. For encrypted media, examine the chosen method and key dependencies; encryption alone does not remove the need for disposition. Retain cross-checks between approval and execution rather than relying on one person’s verbal assurance.
Maintain custody throughout sanitization
Once equipment enters the processing area, assign a custodian, controlled location and issue/return records. Before contractor access, confirm scope, identity and components permitted to leave. Operators record the approved tool and version, method parameters, start and end times, per-media results and exceptions. Halt handover after interruption, power loss or inconsistent identification. A technical owner determines rework and verification; keep incomplete items separate from accepted equipment.
For off-site sanitization or subsequent handling, the handover record should connect each device to packaging, transport, receipt and outcome, rather than simply stating a batch of computers. Investigate count discrepancies, packaging anomalies or changed media identifiers before closing the job. Irreversible disposition must follow the organization’s approval process. This article provides no command to erase production equipment; a supplier’s generic certificate cannot replace evidence linked to the actual batch.
Verification must establish method completion
The verifier checks method suitability, completion, exception handling and linkage of evidence to each device. Verification follows the approved method and risk assessment. Inability to see files or log in does not establish that data is unrecoverable. Mark media with insufficient evidence as not accepted, keep it in controlled custody and escalate. Sampling can assess the process but cannot automatically approve other devices that lack execution records.
The final evidence package includes approval, migration acceptance, media inventory, sanitization logs, verification conclusions and custody/handover records, with operators and reviewers identified. After acceptance, asset administration updates location, holder and lifecycle state; business confirms retained data is usable; security confirms residual risk handling. Record financial write-off separately from technical acceptance. Settled accounts do not authorize release of equipment still awaiting verification.
Keep exceptions and follow-up ownership visible
Common errors include treating factory reset as universal sanitization, an outsourcing contract as proof of execution, or leaving removed disks forgotten in storage. Maintain an exception queue for failed media, embedded storage, nonremovable components and equipment with unclear retention duties. Each exception needs an owner, next step and review condition and must survive batch closure. Hold release when safe disposition is unproven; changing a status cannot remove the underlying risk.
After a small batch, asset, business and security teams review identifier continuity, migration verification and per-device linkage of external evidence, then improve handover templates. Media capabilities and applicable requirements change, so an acceptance method is not permanent. A useful retirement process lets the next operator establish where equipment went, what data remains, who approved it and which exceptions are open, providing facts for later audits and disputes.
Sources
NIST SP 800-53 Rev.5: MP-6 and MP-6(1)