Certificate of destruction

Two documents, routinely confused

A certificate of sanitization or destruction says what was done to a device: the method, the tool, the result, by whom. It comes from the party that performed the work.

A chain-of-custody manifest says where a device went: what left your building, counted against your list, sealed, signed for, and who accepted it next. It comes from whoever moved it.

They answer different questions and neither substitutes for the other. A certificate with no custody record cannot tell you the device on the certificate is the device that left your building. A custody record with no certificate cannot tell you the data is gone.

We produce both, because we perform both the collection and the sanitization, and the two reconcile against each other by serial number. If any provider offers you a certificate of destruction for work they did not perform themselves, ask who actually did it, and ask to see the custody record that connects the two. That is the failure mode this page exists to warn you about.

No law requires one. The strongest source says "should."

This surprises people, so it is worth being precise.

NIST SP 800-88 Rev. 2, Section 4.6, September 2025:

"Following sanitization, a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies."

Should, not shall — and "per the organization's policies", which puts the obligation in your policy rather than in the document. NIST publishes a sample form at Appendix C.

What the other rules say:

HIPAA names no certificate. 45 CFR 164.310(d)(2)(i) requires policies and procedures for final disposition; the Addressable Accountability specification asks for "a record of the movements of hardware and electronic media and any person responsible therefore" — a custody record, not a destruction certificate. What HIPAA actually requires

GLBA's Disposal Rule is more pointed. 16 CFR 682.3(b)(3) describes "entering into and monitoring compliance with a contract with another party engaged in the business of record destruction" — an ongoing obligation, not a piece of paper you file once.

CJIS MP-6 prescribes methods and says nothing about certificates.

CMMC scores NIST SP 800-171 Rev. 2 requirement 3.8.3, which requires sanitization or destruction, not documentation of it. The evidence question arrives at assessment, not in the clause.

So the certificate is a convention, not a mandate. That does not make it optional in practice — your auditor, your contract or your own policy will very likely require one. It means the specification is yours to write, and nobody will write it for you.

What it should contain

NIST's own list, from Section 4.6. "When fully completed, the certificate should record at least the following details":

• Manufacturer
• Model
• Serial number
• Organizationally assigned media or property number (if applicable)
• Media type (hard copy or ISM)
• Media source (e.g. user, computer)
• Pre-sanitization confidentiality categorization (optional)
• Sanitization method — clear, purge, or destroy
• Sanitization technique — e.g. degauss, overwrite, block erase, cryptographic erase
• Tool used, including version
• Verification method
• Information of individuals performing verification and validation — name, position or title, date, location, contact information, and signature

Print that list and hand it to whoever quotes you. Three fields do most of the work:

Serial number, because it ties the certificate to a specific device rather than a quantity.

Tool used, including version. A method name alone is unfalsifiable. A tool and version can be checked against known behaviour on that media type.

Verification method, because sanitization that was not verified is an intention. NIST separates verification — inspecting the immediate outcome — from validation, the organizational decision that the outcome was adequate.

What a certificate does not prove

It does not prove the device was yours. Without a custody record tying that serial number to your collection, the certificate is a statement about a device, not about your device.

A batch certificate proves nothing about any one device. "500 drives were destroyed on 4 March" is not evidence about the drive somebody is asking you about, and the drive somebody asks about is always a specific one. NIST's wording is "for each ISM."

It does not prove the method suited the media. A certificate saying "degaussed" is a red flag on a solid-state drive, because degaussing acts on magnetic domains that flash memory does not have. The certificate can be entirely truthful and the work still useless.

It does not make anyone compliant. No certificate discharges a regulatory duty on its own. It is evidence that one step happened.

And a certification is not a certificate. "R2 certified" describes an audited facility; a certificate of destruction describes one job. Vendors blur the two constantly.

What we give you instead

The certificate of sanitization, per media item, carrying the Section 4.6 fields: manufacturer, model, serial, property number, media type and source, method, technique, tool and version, verification method, and the named individuals who verified and validated it, with the date.

The collection manifest: what was picked up, counted against the list you supplied, discrepancies and exceptions recorded at the moment they were found, seal numbers logged, signed and dated at the point of collection — plus the intake reconciliation showing what we received against what left.

Together those let you say: this serial number left this building on this date, arrived under an unbroken seal, and was sanitized by this method with this tool, validated by this named person. Either document alone leaves a gap, which is why we never issue one without the other.

How collection and custody works ·

Common questions

What is the NIST 800-88 certificate of destruction?

NIST SP 800-88 calls it a certificate of sanitization and provides a sample form at Appendix C of Revision 2. Section 4.6 says one should be completed for each item of media sanitized, per your own policies. There is no NIST-issued certificate and no NIST certification of vendors — a provider claiming to be "NIST 800-88 certified" is describing something that does not exist.

What is a data destruction certificate?

The same document under a more common name. What matters is not the title on it but whether it carries the fields above, per device.

Is a certificate of destruction a legal requirement?

Not under HIPAA, CJIS, GLBA or CMMC as such. It is very often a contractual or policy requirement, which is a different thing and just as binding on you.

Can we accept a certificate for a batch?

You can, and plenty of organizations do. Understand what you are accepting: a batch certificate is evidence about a quantity, not about any particular device.

Who should sign it?

NIST's field list asks for the name, title, date, location, contact information and signature of the individuals performing verification and validation — not a company logo and an unnamed signature block.

Do you provide one?

Yes, per media item rather than per batch, carrying the Section 4.6 fields including the named individuals who verified and validated the work. It reconciles against the collection manifest by serial number, which is the linkage that makes either document worth anything.

Where to read it yourself

NIST SP 800-88 Rev. 2 — Section 4.6 for the documentation guidance, Appendix C for the sample form · 16 CFR 682.3 · 45 CFR 164.310