Key takeaways
- Sanitize or destroy media to NIST SP 800-88 and keep a certificate per serial number.
- Choose R2v3 or e-Stewards processors and NAID AAA for destruction; demand downstream visibility.
- In the EU, retired IT is WEEE: authorized treatment is mandatory and exports are tightly controlled.
- A serialized reconciliation (assets out = certificates in = revenue received) is your best audit defense.
- Revenue share on reuse and metals often turns disposition from a cost into income.
Why ITAD is an EHS topic, not just an IT topic
IT teams own the asset list and security policy. EHS owns the waste obligations: classification, authorized processors, transport documents and reporting. When the two do not talk, sites end up with drives in skips, servers in unapproved scrap streams and no paper trail.
The 6-step compliant decommissioning process
- Plan: define scope, asset list and the reuse / resale / recycle decision per asset class.
- Inventory: scan serial numbers of every data-bearing device (HDD, SSD, NVMe, tapes, also controllers with cache).
- Sanitize or destroy: clear, purge or destroy per NIST SP 800-88, on-site shredding when policy requires that drives never leave intact.
- Transport: sealed, tracked transport with chain-of-custody forms; in the EU, the right waste transport documents.
- Process: reuse first, then certified recycling; get downstream destinations in writing.
- Reconcile and report: certificates per serial, weights per material, revenue per lot, and data for ESG reporting.
Certifications that matter
US vs. EU obligations at a glance
- US: no single federal e-waste law; state laws vary. Batteries and lamps removed from equipment can be handled as universal waste. CRT glass and some components may be hazardous.
- EU: WEEE Directive 2012/19/EU applies; treatment only by authorized facilities. In France, professional equipment falls under the DEEE producer responsibility scheme, and hazardous fractions are tracked in Trackdéchets.
- Both: export of non-functional electronics to non-OECD countries is heavily restricted under the Basel framework.
Where the money is
Servers and network gear less than five years old often have resale value. Even end-of-life hardware contains copper, aluminium, gold and palladium. Contracts that only bill a per-unit destruction fee leave that value with the processor.
- Request a revenue-share model for resale and metal recovery.
- Get weight tickets and material breakdown per lot.
- Benchmark offers from at least two certified processors.
- Audit invoices against the asset list and certificates.
Wastetide
Know what your retired hardware is worth before you sign
Wastetide's AI agent prices recyclable materials and matches you with buyers, then audits every invoice against your contracts. Try it free with one invoice.
FAQ
Is degaussing enough for SSDs?
No. Degaussing works on magnetic media only. SSDs and NVMe drives need cryptographic or firmware-based purge, or physical destruction, per NIST SP 800-88.
What documents should we keep after decommissioning?
Asset list with serial numbers, chain-of-custody forms, certificates of sanitization or destruction per serial, transport documents, processor certificates and the final reconciliation with revenue.
Can we donate old servers?
Yes, after certified sanitization and with documentation. Reuse ranks above recycling in the waste hierarchy and can count toward diversion targets.
Sources: NIST SP 800-88 · WEEE Directive 2012/19/EU