An ITAD checklist for whoever signs off the handoff

Before retired equipment leaves your organization, three things need agreeing: who's responsible for the decision, what the provider is authorized to do, and which evidence shows the project is finished.

This is a planning aid. Your own policy, information requirements, property rules and contract decide the final scope.

1. Confirm the authority

Find the asset owner and the person who can actually approve disposal or transfer. Those are often different people and occasionally the second one doesn't exist yet.

Separate out anything leased, financed, employee-owned, government-owned or contract-restricted. Sort out retention requirements and legal holds before anyone authorizes data treatment, not after.

For public property, get the responsible property and procurement officials involved early.

2. Establish the inventory

List equipment by category, model where you know it, quantity and location. Agree when asset identifiers get recorded and how you'll reconcile discrepancies, because there will be discrepancies.

Flag anything damaged, missing components, with inaccessible storage, or with battery concerns.

One practical note: keep the preparation inventory separate from the confidential data on the devices. A general website form isn't the place for a detailed sensitive asset register. Ours included.

3. Specify the data outcome

Name the information owner and the policy that applies. Then agree the permitted methods, verification, validation, release approval, exception handling, required evidence, and whether the device can be reused afterwards.

Identify any requirement for someone to witness the work, or restrictions on where it can happen.

Talk to your security team, and read the current federal guidance directly rather than a vendor's summary of it. NIST SP 800-88 Revision 2 is the current version. Revision 1 was withdrawn on September 26, 2025, so anything citing Rev. 1 as current practice is citing a withdrawn document.

Two things in the current revision surprise people. Multi-pass overwriting isn't necessary, and on flash-based media it does very little while shortening the drive's life. And the FAQ NIST published for it says destructive techniques like shredding are ineffective for medium and high security categories because of data density.

Don't assume one generic wiping procedure satisfies every device and every contract.

4. Plan the account and management release

Have an authorized administrator work out the release steps for the actual platform and enrollment state, and confirm the sequence before anyone changes management settings.

• Apple documents Activation Lock.
• Google covers retiring managed ChromeOS devices.
• Microsoft documents Windows Autopilot deregistration.

Account release and data sanitization are separate jobs. Record both.

Skip it and the value can walk out with the pallet. A locked device that had resale money in it comes back as scrap, and that usually surfaces at the settlement statement rather than on collection day.

And don't share administrative credentials through a public inquiry form.

5. Define movement and custody

Agree who packs, who transports, where collection happens, what access looks like, and the exact point where custody and ownership change hands.

Ask any provider one question: where does your chain of custody start? If the first complete inventory happens at their receiving dock rather than your loading dock, the gap in between isn't documented, and that gap is what you'll be asked about.

Flag damaged batteries before anyone confirms a transport plan. PHMSA's lithium battery guidance covers why.

For multiple locations, decide early how separate collections connect to one reconciliation record.

6. Review the evidence before you appoint anyone

Check the actual facility and the actual scope of any certification. A company-level claim doesn't tell you which site handles your equipment or which processes the certificate covers.

Ask for the proposed documentation format up front. Ask whether the work happens in house or through another company, and if it's another company, ask who.

Then check the scope covers the outcomes you need, not just the ones the vendor likes talking about.

7. Close the asset record and the financial record

Agree who reviews the final inventory, the exceptions, the disposition results, the charges and any proceeds. Decide how you'll handle unresolved differences and who signs off closure.

Projects close easily when the acceptance criteria were agreed before the first collection. Agree them in the scoping call and write them into the purchase order.

Working sign-off record

Take a copy for each unresolved decision. Complete it inside your organization. Don't submit sensitive details through a public website.