When IT equipment leaves your facility, your data responsibility does not leave with it. Retired agency hardware stays a risk until it is destroyed to standard and documented to prove it. But not every vendor’s process holds up when it counts. Use these questions before any vendor pickup, so your records are audit-ready before the equipment is gone.

WHAT’S INSIDE

Section 1: Inventory and Chain of Custody
The documentation gaps that are invisible until a device goes missing from the record.

Section 2: Data Sanitization and Destruction Standards
How to tell whether a vendor’s method is right for your media type, and why the wrong method produces a result that looks correct but isn’t.

Section 3: Classified and National Security System Media
The separate standard that governs classified and NSS hardware, the equipment that meets it, and what the audit file needs to show.

Section 4: Certifications and Independent Validation
How to verify that credentials are current, correctly scoped, and independently audited — not just listed on a website.

Section 5: Reporting, Turnaround, and FISMA Documentation
The complete reporting package your audit posture requires, and why an open-ended timeline is a gap, not an inconvenience.

WHY THIS MATTERS

In a 2019 study, Blancco Technology Group found that approximately 42% of used drives purchased on the open market still contained recoverable data, including personally identifiable information and corporate IP. (Blancco Technology Group, 2019 — third-party study)

Retired agency drives hold recoverable data until they are destroyed and documented. And most vendors do not deliver the records that prove they were.

This checklist shows you:

• What to verify before any vendor pickup, not after the equipment is gone
• Which standards apply by media type, including classified and national security system hardware
• What credentials to confirm and how to verify them independently, not from the vendor
• What the complete documentation set looks like — the one that holds up to a FISMA audit, an IG review, or a breach investigation

WHO SHOULD USE THIS

• Agency CIOs and CISOs are accountable for data protection through end-of-life
• ISSOs and ISSMs are responsible for system security plans and continuous monitoring
• IT Program Managers managing device refresh cycles and vendor relationships
• Contracting Officers evaluating ITAD vendor qualifications and SOW requirements
• IT Directors responsible for property accountability and disposition records