What Is ITAD? A Complete Guide to IT Asset Disposition

Retired technology may still contain sensitive information, including:

• Customer and employee records
• Financial information
• Medical or insurance information
• Passwords and authentication tokens
• Emails and business documents
• Intellectual property and source code
• Network configurations and system credentials
• Stored print, scan, fax, and copy jobs

Deleting files or performing a basic factory reset does not automatically provide documented, media-appropriate sanitization. A hard drive, SSD, phone, server, printer, or copier may retain data after the equipment is no longer in service.

Improper disposition can expose a company to data breaches, regulatory scrutiny, contract violations, lost customer trust, and unnecessary financial loss. It can also cause a company to discard equipment that still has resale or redeployment value.

The exact scope depends on the client’s equipment and requirements, but a complete ITAD project commonly includes the following stages.

1. Project planning

The provider and client define the locations, equipment types, quantities, timeline, security requirements, reporting needs, and final disposition options.

The project should also identify whether assets are intended for reuse, resale, donation, lease return, physical destruction, or recycling.

2. Inventory and asset identification

The provider records available information such as:

• Client asset tag
• Manufacturer and model
• Serial number
• Device type
• Storage-media type
• Condition
• Quantity
• Location
• Management-lock status
• Required disposition pathway

Accurate inventory records allow the client to reconcile what was released, what was received, and what happened to each asset.

3. Secure pickup and chain of custody

ITAD includes controlled transfer from the client’s location to the provider’s facility or processing point. Depending on the project, the custody record may include verified piece counts, serialized assets, pallet and box counts, photographs, pickup timestamps, authorized representatives, and receiving confirmation.

A documented chain of custody helps establish who controlled the equipment and when the transfer occurred.

4. Data sanitization or physical destruction

The provider determines the appropriate method based on the media, information sensitivity, device condition, and client requirements.

NIST SP 800-88 Rev. 2 describes three broad sanitization outcomes:

• Clear: A logical method intended to protect against ordinary recovery attempts while allowing the media to remain usable in appropriate situations.
• Purge: A stronger logical or physical method intended to make recovery infeasible for the applicable level of effort while potentially preserving the device.
• Destroy: A physical process that makes the media unusable and prevents reuse.

NIST describes media sanitization as a process that makes access to target data infeasible for a given level of effort.[1] The appropriate outcome depends on the risk assessment and the planned disposition.

5. Testing and value recovery

Working equipment may be tested, graded, and evaluated for:

• Internal redeployment
• Lease return
• Direct buyback
• Revenue-share remarketing
• Donation
• Parts recovery

The value of an asset depends on its manufacturer, model, processor, memory, storage, condition, quantity, age, battery health, market demand, and management-lock status.

Apple Activation Lock, MDM, Autopilot, BIOS passwords, Computrace, carrier locks, and other restrictions can prevent a device from being resold until the client resolves them.

6. Recycling and downstream management

Equipment that is damaged, obsolete, locked, failed in testing, or not economically recoverable can be routed to materials recovery or responsible electronics recycling.

A complete ITAD program should document the applicable downstream pathway rather than treating every asset as ordinary scrap. Reuse and parts recovery may be considered before final material recycling when approved and economically practical.

7. Reporting and project closeout

The closeout package may include:

• Serialized Certificates of Erasure
• Serialized Certificates of Destruction
• Final asset reconciliation
• Chain-of-custody records
• Exception reports
• Weight tickets
• Buyback or revenue-share statements
• Downstream documentation
• Photographs or video when requested

A weight ticket confirms material weight. It does not replace serialized data-destruction documentation when the client requires asset-level evidence.

Different storage technologies require different treatment.

Degaussing may be appropriate for magnetic hard drives and magnetic tape. It is not an effective sanitization method for SSDs, NVMe drives, USB flash drives, SD cards, or other flash-based media because those devices do not store data magnetically.

A capable provider should be able to identify the media and explain the method used. Hard drives, SSDs, NVMe drives, removable media, mobile devices, servers, and embedded storage should not automatically be processed using one generic method.

Printers, copiers, scanners, and multifunction devices also require attention. The Federal Trade Commission explains that digital copiers contain hard drives that can store information about documents they copy, print, scan, fax, or email.[2]

Basic electronics recycling generally focuses on collecting and processing material. Depending on the service level, the documentation may be limited to a weight ticket or receipt.

ITAD is broader. It may include:

• Asset-level inventory
• Data sanitization or destruction
• Chain of custody
• Testing and grading
• Buyback or revenue recovery
• Redeployment and remarketing
• Exception management
• Serialized certificates
• Downstream documentation
• Client portal visibility

A company selecting a service should determine whether it needs basic recycling, data destruction, or a complete ITAD program.

Businesses should ask exactly what a provider means when it says “certified.” The claim should identify the standard, certification body, facility, scope, and current status.

The U.S. Environmental Protection Agency encourages businesses to use electronics recyclers certified by an accredited, independent third-party auditor. EPA states that certification provides a way to assess environmental, worker health and safety, security, and downstream-management practices.[3]

Certification is not a substitute for project-specific due diligence, but it gives procurement and compliance teams a meaningful framework for evaluating a provider’s controls.

Businesses should verify:

• The current certificate
• The certified facility address
• The services included in the scope
• The certification body
• The provider’s data-destruction equipment
• Chain-of-custody procedures
• Employee training and access controls
• Downstream-management practices
• Certificate and reporting capabilities

Integritrade provides IT asset disposition, secure data destruction, electronics recycling, equipment buyback, revenue-share remarketing, and value-recovery services for businesses and organizations across California and the Western United States.

Material is processed through Integritrade’s dedicated 30,000 sq ft ITAD Megacenter at 944 S Topeka Ave in Fresno, California. The controlled-access facility includes 24/7 video monitoring, secure staging, industrial racking, dock capabilities, trained and background-checked personnel, PXE-based software sanitization infrastructure, magnetic-media destruction equipment, and specialized physical-destruction capability for approved flash media.

Integritrade maintains R2v3, ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001 certifications within their applicable scopes.

For Full ITAD projects, authorized clients receive access to TraceTech at no additional cost. TraceTech provides real-time project and asset visibility, client asset-tag reconciliation, certificates as issued, service requests and project amendments, client-specific handling instructions, and value-recovery reporting.

Before handing over equipment, a business should:

• Create an inventory with asset tags, serial numbers, models, quantities, and storage details.
• Confirm that backups, legal holds, retention requirements, and investigations are complete.
• Include printers, copiers, scanners, servers, backup appliances, and removable media.
• Separate reuse candidates from destroy-only equipment.
• Resolve Apple Activation Lock, MDM, Autopilot, BIOS, carrier, and other restrictions when reuse is intended.
• Define the required sanitization or destruction outcome.
• Confirm whether the count will occur at the client site or the ITAD facility.
• Specify certificates, reports, photos, video, and witness requirements.
• Establish how failed, locked, damaged, or unidentified assets will be handled.

After the project, reconcile the final report to the original inventory and retain the certificates, custody records, exception reports, and disposition documentation according to the organization’s record-retention requirements.

[1] NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization

[2] FTC: Digital Copier Data Security: A Guide for Businesses

[3] U.S. EPA: Certified Electronics Recyclers