When a Security Incident Happens: How Proper ITAD and a Verifiable Chain of Custody Protect Your Company

When a cybersecurity incident occurs, the first response measures are usually isolating affected systems, analyzing logs, rotating credentials, and restoring backups.

However, there is a critical area that is often overlooked: the physical equipment on which the information was stored.

Decommissioned servers, laptops, phones, hard drives, SSDs, storage systems, network equipment, and backup media may still contain personal data, financial information, intellectual property, passwords, technical configurations, or other confidential information.

A proper IT Asset Disposition (ITAD) program, backed by a complete chain of custody and verified sanitization or destruction methods, protects the company even after the equipment has been retired.

What Does ITAD Mean?

ITAD, short for IT Asset Disposition, is the controlled process through which a company identifies, retires, inventories, secures, reuses, remarkets, recycles, or destroys IT equipment that has reached the end of its useful life.

A professional ITAD process is not just about picking up old equipment from the client’s premises. It must simultaneously manage data security, the inventory and identification of each asset, the chain of custody, secure transport, sanitization or destruction of data-bearing media, controlled reuse when permitted, recycling of equipment that becomes waste, and the documentation required for audit, accounting, compliance, and ESG reporting.

The goal is for every piece of equipment to have a demonstrable trail, from decommissioning to final destination.

What Is Chain of Custody in ITAD?

Chain of custody is the chronological record of every person, organization, location, and operation an IT asset or data-bearing media passes through.

It must be able to clearly answer the following questions: which equipment was handed over, what serial number or unique identifier does it have, who handed it over and who received it, when and from which location was it collected, how was it packaged and transported, where was it stored, who had access to it, what sanitization or destruction method was applied, how was the result verified, and what was the final destination of the resulting materials.

A simple handover form for a quantity of “IT equipment” is not a sufficient chain of custody. For assets containing data, there must be, depending on risk, individualized records by serial number, barcode, RFID, or another unique identifier.

Why Does Chain of Custody Become Essential in a Security Breach?

During an investigation, the company must be able to demonstrate not only how it protected its network, but also what happened to the equipment that was retired.

A verifiable chain of custody contributes to the following.

1. Preserving digital evidence

A laptop, server, or storage medium may contain evidence relevant to determining the cause and scope of the incident.

For this reason, equipment potentially involved in a breach must not be automatically wiped, reused, or destroyed. It must be placed under legal hold or forensic hold, separated from the regular disposal flow, until legal counsel and digital forensics specialists approve its final disposition.

Traceability demonstrates that the device was not replaced, altered, accessed without authorization, or lost.

2. Preventing secondary data exposure

An incident can expand if retired equipment ends up in uncontrolled storage, is transported without protection, or is resold before the data has been properly eliminated.

Standard formatting, file deletion, or a factory reset do not automatically guarantee that the information can no longer be recovered.

3. Demonstrating accountability to regulators and auditors

In the European Union, the data controller must use vendors that offer sufficient guarantees and must implement technical and organizational measures appropriate to the risk.

In an audit or investigation, ITAD documentation can demonstrate that the organization maintained control over the data even after the equipment was removed from the network.

4. Precisely scoping the incident

If all retired assets are identified and tracked, investigators can quickly exclude certain equipment from the scope of the incident.

If devices or documents are missing, the company may be forced to treat the situation as a potential additional exposure, with greater investigative effort, cost, and reputational risk.

Data Sanitization or Physical Destruction?

The choice of method must be made based on the classification of the information, the type of media, the condition of the equipment, contractual obligations, and the possibility of reuse.

Data Sanitization

Sanitization aims to make data access infeasible for the established level of effort and risk. This can include verified logical erasure, dedicated secure erase commands, or cryptographic erasure.

Sanitization can allow equipment to be reused, but only if the method is compatible with the media in question, the operation completes without errors, the result is verified, the asset identifier is linked to the sanitization report, and any exceptions or failed media are separated and physically destroyed.

Physical Destruction

Physical destruction is required when the level of risk, security policy, contractual obligation, or condition of the media does not allow for reuse.

The method must be chosen based on the media’s underlying technology. An HDD, an SSD, a phone, a magnetic tape, and a memory chip cannot automatically be treated with the same method or the same final particle size.

Destroying a computer’s casing does not necessarily mean the data has been destroyed. The component that stores the information must be identified and treated separately.

How Should a Secure ITAD Process Work?

A mature ITAD process should include the following stages.

Asset inventory prior to pickup. The equipment type, serial number, owner, location, and data risk level are established.

Separation of assets under investigation. Devices under legal hold or forensic hold do not enter the destruction flow.

Documented handover. Responsibility is transferred by name, at an identifiable date and time.

Packaging and securing the shipment. Sealed containers, numbered seals, or other risk-appropriate controls are used.

Controlled transport. The route, vehicle, personnel, and any transport incidents must be verifiable.

Receipt and inventory reconciliation. Assets received are compared against the handover list, and any discrepancy is investigated immediately.

Authorized sanitization or destruction. Each medium is processed using the method approved for its type and information classification.

Verification of results. Sanitization must be validated, and destruction must be verified through operational controls and documented evidence.

Compliant recycling of resulting materials. Data destruction and waste handling are two distinct obligations. After the information risk has been neutralized, materials must be transferred to authorized operators.

Issuance of the traceability file. The client receives the documentation required for audit, accounting, data protection, and ESG reporting.

What Documents Should a Company Receive?

Depending on the project and the level of risk, the closing file should include a handover certificate, an individualized inventory of assets, serial numbers and unique identifiers, proof of responsibility transfers, a seal log, a receipt and reconciliation report, a sanitization report, a certificate of destruction, the method and date of processing, any exceptions or equipment that could not be sanitized, a photo/video report when agreed upon, waste traceability documentation, and proof of final destination and recycling.

A certificate of destruction should not be treated as a generic document issued for the entire quantity. For projects with a high information risk, it must be traceable to the specific assets and media processed.

What Standards and Certifications Should Be Checked for an ITAD Vendor?

There is no single universal certification that covers all components of ITAD. The client must separately verify information security, the destruction method, traceability, and waste handling.

ISO/IEC 27001 – information security. ISO/IEC 27001 sets the requirements for an information security management system. For an ITAD vendor, the certification must explicitly cover the activities and locations where the client’s assets are collected, transported, stored, sanitized, or destroyed. Having the certificate is not sufficient if its scope does not include ITAD services.

ISO/IEC 21964 – destruction of data carriers. The ISO/IEC 21964 series sets out principles and requirements for the destruction of data carriers, including information classification, security levels, and requirements applicable to the process and equipment. It is one of the key technical benchmarks for the physical destruction of documents and data media. Compliance with the standard must be demonstrated through procedures, appropriate equipment, checks, and records, not merely stated in marketing materials.

NIST SP 800-88 Rev.2 – media sanitization. NIST SP 800-88 Rev.2, published in September 2025, is a technical reference guide for building a sanitization program tailored to information sensitivity and media type. NIST does not certify ITAD vendors. A provider can demonstrate that its procedures and tools are aligned with the guide, but the phrase “NIST certified” should be examined carefully.

ISO 14001 – environmental management. ISO 14001 demonstrates the existence of a system for identifying and controlling environmental impact. In ITAD, this is relevant because equipment that becomes electrical and electronic waste must be managed separately from the data elimination process. Certification does not replace environmental permits or legal WEEE obligations.

EN 50625 and WEEELABEX certification. The EN 50625 series sets requirements for the collection, logistics, and treatment of waste electrical and electronic equipment. WEEELABEX has incorporated the relevant CENELEC standards into an accredited operator certification scheme. This certification matters for facilities that actually process WEEE, but it does not replace standards related to information security and data destruction.

Specialized ITAD schemes. In the international market, other schemes are used, including the ADISA ICT Asset Recovery Standard 8.0, for the security and control of IT asset recovery and disposal operations, NAID AAA Certification, focused on secure information destruction, R2v3, for the responsible reuse and recycling of electronic equipment, and e-Stewards, for responsible recycling and control of electronic equipment flows. These schemes can add an extra layer of trust, but their relevance must be assessed based on country, industry, project type, and equipment destination.

ISO 9001 and ISO 45001. ISO 9001 for quality management and ISO 45001 for occupational health and safety round out the control framework of a professional operator. They are relevant to operational consistency and process safety, but on their own do not prove that data was irreversibly destroyed.

What Is Mandatory and What Is Recommended?

A clear distinction must be made between legal permits, required for the collection, transport, or treatment of waste; GDPR obligations, including selecting and controlling vendors that process or may access data; technical standards, which set out methods and security levels; independent certifications, which confirm that a system or process has been audited; and the client’s contractual requirements, which may go beyond the legal minimum.

An ISO certification does not replace an environmental permit. An environmental permit does not certify data security. A certificate of destruction does not compensate for the absence of a chain of custody.

A credible ITAD vendor must be able to demonstrate all elements relevant to the contracted service.

Checklist for Selecting an ITAD Vendor

Before awarding the contract, request documented answers to the following questions: is every piece of equipment inventoried individually, are serial numbers recorded, who assumes responsibility and at what point, how are assets sealed and transported, how is personnel access controlled, are there integrity checks and incident procedures, what method is applied to each type of media, how is sanitization verified, what happens to media for which erasure fails, what standards are applied, what certifications does the vendor hold and what is their exact scope, does the vendor use subcontractors, where do the resulting components and materials end up, does the client receive a certificate of destruction and an individualized report, are photo/video evidence or witnessed destruction available, how long are traceability documents retained, and is there a procedure for legal hold and evidence preservation.

Conclusion

Data security does not end when a piece of equipment is disconnected from the network or removed from inventory.

A secure ITAD process must combine asset identification, chain of custody, access control, secure transport, verified sanitization, appropriate physical destruction, and compliant recycling.

In the event of a breach, this documentation can make the difference between a controlled investigation and months of uncertainty over missing devices, unrecovered data, and responsibilities that cannot be demonstrated.

KAPUTT SEKURO – Secure Destruction & Asset Management supports organizations in building a verifiable process of decommissioning, secure destruction, and asset traceability, so that every piece of equipment can be tracked from handover to final destination.

Secure Destruction. Verified Compliance. Protected Data.

Frequently Asked Questions About ITAD and Data Destruction

What does ITAD mean? ITAD stands for IT Asset Disposition and refers to the controlled process of retiring, sanitizing, reusing, remarketing, destroying, and recycling IT equipment.

Is formatting a hard drive enough? No. Standard formatting or file deletion does not guarantee that the data cannot be recovered. The method must be chosen and verified based on the media’s technology and the level of risk.

What is the difference between sanitization and physical destruction? Sanitization removes access to data and can allow the media to be reused. Physical destruction renders the media unusable and is used when the risk, internal policy, or contractual obligations rule out reuse.

What is a certificate of destruction? It is the document that confirms the processing of assets or data media. In a robust system, the certificate is linked to the inventory, the date, the method applied, and the verification result.

Can equipment involved in an incident be destroyed immediately? No. If the device may contain evidence, it must be preserved under legal hold or forensic hold until approved by those responsible for the investigation and by legal counsel.

Is ISO/IEC 27001 sufficient for an ITAD vendor? Not on its own. The scope of the certificate, the technical destruction methods, the chain of custody, environmental permits, and the final destination of equipment and materials must all be verified.

Does NIST certify data destruction companies? No. NIST publishes the SP 800-88 Rev.2 guide, but it does not certify ITAD vendors. Vendors can demonstrate that their methods and procedures are aligned with NIST’s recommendations.