Why these pages exist
Most of what is published about disposal compliance is written by vendors who benefit from you believing the rule is stricter than it is, or vaguer than it is.
So each page here does three things. It quotes the requirement verbatim and names where it sits. It says plainly what the rule does not require, which is usually the more useful half. And it links the primary source so you can check us.
That last part matters more than it sounds. A claim you cannot check is worth nothing, and "our vendor said it was compliant" has never survived contact with an assessor.
Defense and federal
What DFARS 252.204-7012 requires before a device holding CUI leaves your control — and which NIST revision your assessor actually scores, because it is not the one NIST currently publishes.
GSA screening, DLA Disposition Services, the exchange/sale authority, vendor take-back, and the SAM registration timing that catches firms out.
Start here
The document every one of these rules eventually comes down to. What it should contain, why no law actually requires it, and the difference between it and a chain-of-custody manifest.
Financial services
The FTC Safeguards Rule's two-year clock on customer information, and the vendor due-diligence checklist the Disposal Rule spells out in the regulation's own words.
Law enforcement
The rare policy that names methods rather than leaving them to you — three-pass overwrite or degaussing, destruction for inoperable media — plus the personnel screening a vendor has to pass before touching anything.
Healthcare
What 45 CFR 164.310(d) requires before a device holding ePHI is disposed of or reused, which specifications are Required and which are Addressable — and why "addressable" does not mean optional.
Education
Where the duty sits between a district and its vendor, and what has to be in the contract because the regulation will not do it for you.
Standards
Revision 1 was withdrawn in September 2025. The three method definitions, what each defends against, and why "NIST 800-88 certified" describes something that does not exist.
Colorado
The landfill ban and its exclusions, the hazardous-waste determination that is yours to make, and the written disposal policy CRS 6-1-713 requires of you.
What we are, on all of these
We collect retired phones, tablets and laptops and process them in our own facility: intake, data sanitization to NIST SP 800-88 Revision 2, grading, and routing to reuse or recycling. We hold no certifications — not R2, not e-Stewards, not NAID — and our R2 certification audit is pending.
That shapes what these pages are useful for. They will not tell you we make you compliant — no disposal vendor can, and one that says so is telling you something about themselves. They will tell you what each rule actually says, quoted, and what documentation you should require from any provider, us included.
What we can and cannot evidence · Plan a device-retirement project