What to wipe when equipment is retired
When equipment is retired or returned from a lease, write for each storage medium whether it will be used again, which sanitization method applies, who signed the certificate, and hand the asset back or transfer it under the same identifier it received at delivery. Deleting a few files does not mean the medium has been sanitized. Lease versus buy decides who holds the asset at the end. This decision is whether the data can still be read before the medium leaves.
On this page
- Write retirement apart from delivery, lease or buy, and maintenance
- Decide first whether the medium will be used again
- Clear, purge, and destroy are not the same act
- An overwrite is not a finished wipe on every drive
- A lease return and a warranty exchange leave organizational control
- Keep one sanitization certificate for each medium
- Sign the verification and the acceptance apart
- Without a certificate, the equipment stays
Write retirement apart from delivery, lease or buy, and maintenance
Delivery acceptance records that day's identifier, the model, the serial number, the place, and who accepted the item. Lease versus buy records who holds the asset at the end and when cash leaves. Predictive maintenance records measurements and work orders while the equipment is running. Retirement records how the storage media inside this item are handled before it leaves the site, where the certificate is, and whether the asset number is marked returned or transferred. Those three notes are What to check when equipment is delivered, How to choose whether to lease or buy equipment, and How to do predictive maintenance for equipment.
Addresses and remote connections on the site network diagram are taken off the diagram the day the equipment leaves. Segmentation is not redone here. See How to plan the network for equipment on site. Equipment can be bought, leased, or taken forward with development in the same project. That is the block Buy, lease, or plan it with development on the homepage.
Decide first whether the medium will be used again
Read on 22 October 2026, the catalogue page for NIST SP 800-88 Rev. 2 gives the publication date as September 2025 and says the publication supersedes Rev. 1 of 17 December 2014. The body used here is that publication, approved on 12 September 2025, DOI 10.6028/NIST.SP.800-88r2. The catalogue page also carries a planning note dated 17 July 2026 that points readers to the frequently asked questions for the publication. The method definitions below are taken from the September 2025 body. The abstract describes media sanitization as a process that renders access to target data infeasible for a given level of effort, and as help for an organization setting up a sanitization program from the sensitivity of the information.
The guide places the decision on the confidentiality category of the information, not on the brand of the medium. Categorize the information being disposed of, assess the nature of the medium, assess the confidentiality risk, and decide what is to happen to the medium next, then choose the sanitization method. Cost, environmental impact, and similar factors are weighed after that. Section 4.3.3 says a key point is whether the medium will be used again. The examples are internal transfer, donation, and refurbishment. If reuse is not intended, the most direct method can be destroy. One piece of equipment often holds several media. The guide's desktop example can include a hard drive, a motherboard, and memory at the same time. The certificate is filled for each medium. The whole cabinet is not collapsed into one line.
Clear, purge, and destroy are not the same act
The guide defines three methods. Clear applies logical techniques to all user-addressable locations on the information storage medium, to resist simple non-invasive recovery through the same interface available to the user. It typically writes a new value with standard read and write commands. If the medium cannot be rewritten, a menu returns it to the factory state. Clear does not apply to hard copy. It typically leaves the medium usable afterwards. Purge uses physical or logical techniques that make recovery of the target data infeasible with current laboratory techniques, while leaving the medium potentially reusable. The guide says to use purge rather than clear when purge can be done. Destroy likewise makes laboratory recovery infeasible, and afterwards the medium cannot be used for storage. Destroy applies to hard copy and to most storage media. It does not apply to purely logical or virtual storage.
The destroy techniques the guide lists are disintegration, incineration, melting, pulverization, and shredding. Bending, cutting, or, in an emergency, drilling a hole or shooting the device, may damage only part of it, and a laboratory may still read what remains. The guide also says that as data density and the hardness of the material increase, pulverization and shredding should be avoided except for the lowest confidentiality categories. For logical purge techniques the guide says to consult IEEE 2883. Those techniques can include overwrite, block erase, and cryptographic erase through dedicated standardized sanitize commands. The body of the guide does not list the technique details item by item. Cryptographic erase removes the keys used to encrypt the data, or makes those keys unreachable, and can finish a purge quickly. Whether it works depends on the cryptographic conditions. The guide says ISO/IEC 27040 requires a security strength of at least 128 bits for the algorithm, and entropy from the random source at least equal to the number of bits in the keys. US federal agencies must also use a module validated to current FIPS 140 for self-encrypting drives. That is the guide's wording for federal agencies. It is not a requirement that a site buy from a particular validation list. If the medium has no such command, cryptographic erase is not entered on the certificate.
An overwrite is not a finished wipe on every drive
The guide says hard drives were historically wiped by repeated overwrites with specific binary patterns, from one pass up to as many as 39. It notes that the US Department of Defense later removed the overwrite specification from the relevant manual, and that for some media, such as solid-state drives with overprovisioning, that repeated overwrite should be avoided because it gives almost no confidentiality protection. Where more assurance is needed, use purge or destroy. When flash memory has spare cells and wear levelling, the user cannot address every location that once held data through the native read and write interface, so that overwrite cannot remove all of the previous data.
On media that cannot be overwritten, or media already damaged past the point of operation, an overwrite does not reach areas that may still hold data. Putting a file in the recycle bin, or deleting only the file pointers, is not what the guide calls clear, unless a return to factory state leaves the interface available to the user unable to retrieve the original data. If a factory reset only deletes the pointers and the interface can still read the content, clear is not entered on the certificate. Degaussing applies only to magnetic media. It does not apply to non-magnetic media such as a solid-state drive. The guide says that, at the time of writing, degaussing is not an approved destroy technique even when it leaves the device unable to start. Degaussing a solid-state drive while the command reports completion can still leave verification with nothing sanitized. That is the guide's example.
A lease return and a warranty exchange leave organizational control
Section 4.3.4 says that when media leaves organizational control, consider who can still reach it. Control changes when a lease returns the storage medium, when the medium is donated or resold for use outside the organization, or when it is sent for recycling. The guide's examples: media handed to a maintenance provider and transported securely can remain under organizational control if the contract expressly provides for confidentiality of the information; maintenance on the organization's premises, under the organization's supervision, also stays under that control. Media exchanged for warranty, a rebate, or another purpose, and not returned to the organization, has left organizational control.
The same section says these examples do not replace legal, regulatory, or statutory requirements for particular sensitive information. Some of those requirements treat a loss of organizational control over media that has not been sanitized as a data breach. The guide gives no deadline for a lease return and states no penalty. The return date and any penalty for breach stay in the lease. The retirement record states only whether this medium goes back to the lessor, moves internally, or is destroyed and not used again, and, if it goes back, the day control left the organization. Section 4.3 also says that when a contractual duty such as a lease return, environmental concerns, a wish to reuse the medium, the price of the medium, or the difficulty of physically destroying some media is taken into account, purge, or clear where it applies, may fit better than destroy. A price is not written here. The record names the method that was chosen.
Keep one sanitization certificate for each medium
Section 4.6 says that after sanitization a certificate is completed for each information storage medium, on paper or as an electronic record, following organizational policy. At a minimum it records the manufacturer, the model, the serial number, the organization's own media or property number if there is one, the type of media (hard copy or information storage medium), the source of the media, the confidentiality category before sanitization (optional), the method (clear, purge, or destroy), the technique (for example degauss, overwrite, block erase, or cryptographic erase), the tool used and its version, the verification method, and, for the people who verify and who validate, the name, title, date, location, contact, and signature.
The property number is the same identifier written at delivery. The medium's own serial number is written under that identifier. A second asset series is not opened. The guide says that, to see whether the organization sanitized the media that came in, the records have to meet at three moments: when the medium entered the environment, when it left the last place of use, and when it reached its destination after sanitization. A certificate only at the destination, with no matching number from delivery, does not show which machine it belongs to. How the identifier was written on the day of delivery is in What to check when equipment is delivered.
Sign the verification and the acceptance apart
The guide splits assurance into verification and validation. Verification asks whether this technique finished. For destroy, check that the equipment shows the job completed. For non-destructive clear or purge, a full reading or a sampled close reading of the content is not required unless organizational policy says so in writing. Validation is the decision to accept or reject. A rejection means a different technique, or a step up to a stronger method.
The guide lists cases that should not be accepted as they stand. The method does not fit that medium or that confidentiality category. The people or the tools are not approved, or the tools are not calibrated. The result falls short of the organization's own minimum. The scope is too narrow, for example a simple write overwrite on overprovisioned media, which can leave a large amount of user data unchanged. The person who validates signs the certificate and writes accept or reject. A rejected medium is not handed to the lessor, and it is not moved to the next place of use.
Without a certificate, the equipment stays
If the method, the technique, the serial number, or the signature is blank, the medium stays on site and the status is written as awaiting sanitization. Powered off is not written as sanitized. Hard copy is not marked clear or purge. Virtual storage is not marked destroy. The guide says destroy does not apply to purely logical or virtual storage. If that storage is to be purged, the conditions for cryptographic erase are confirmed first, and purge is entered only then.
The number of days allowed on a lease return, a fee for destruction, and a ranking of tool brands stay in the contract and on the quote for this job. The guide does not give those figures. Before the equipment leaves, three things are on the record: each medium says whether it will be used again, the method is one of clear, purge, or destroy and the technique is named, and the certificate is signed against the delivery identifier. The asset status changes, and the equipment is handed over, when those three are written down.