Device disposal and data wiping checklist

Who this is for

This Device disposal and data wiping checklist is for the people who sign off when hardware leaves the building. That usually means IT, operations, finance and whoever owns the asset register. It also fits managed service teams that handle offboarding for several small companies.

The focus is narrow: what to do with a device after it stops being useful and before it leaves your control. It is not a refresh plan, an inventory guide or a mobile device management setup. Those decisions come earlier. Here the question is whether the data is gone, whether the record is complete and whether the hardware goes to resale, recycling or destruction.

Disposal is where small companies take the most risk with the least ceremony. A laptop sits in a closet, a phone goes to a reseller, a firewall goes to the trash. Each one can hold credentials, customer files, keys or configuration data. The checklist below slows that moment down enough to make it repeatable.

Before you begin

Decide the disposal route before you touch the device: reuse inside the company, resale, donation, recycling or physical destruction. Each route has a different evidence standard. Reuse inside the company still needs a wipe and a new owner. Resale needs a wipe plus proof that activation locks are off. Destruction needs a witness and a record.

Write down the wipe standard you will use. NIST SP 800-88 is the common reference. It separates clear, purge and destroy. Clear is a logical overwrite or factory reset. Purge is a stronger method such as cryptographic erase on a self-encrypting drive, ATA Secure Erase or NVMe Sanitize. Destroy means shred, crush or degauss. Choose one method per media type and do not leave it to the technician's mood.

Set a hold period. A device that comes back from a departing employee should sit for a set number of days before it is wiped, in case someone needs a file or a license key. During that time, keep it powered off and out of the general spare pool. Label it with the asset tag, the serial number and the date it was pulled.

Gather the tools: a bootable wiping environment, the manufacturer's drive utility, a label printer, anti-static bags, a screwdriver set and a camera or phone for photos. Check that you have admin access to the management console so you can remove the device from mobile device management and clear activation locks. If the device is encrypted with BitLocker or FileVault, confirm you have the recovery key or can sign in before you erase it.

The checklist

Run the checklist in order. The first steps protect data you may still need and remove cloud ties. The middle steps wipe the storage. The last steps prove what happened and move the device out. If a step fails, stop and mark the device as an exception. Do not skip ahead to recycling.

Use one record per serial number. A spreadsheet is fine, but the record must show the asset tag, serial number, model, storage type, wipe method, date, person, result and destination. Add a photo of the screen showing the wipe result where the tool provides one. For phones, include the IMEI and the activation lock status.

The bullets below are written as full checks so you can paste them into a ticket template. Keep the order. A wiped device with an active iCloud lock is not ready for resale, and a device with a removed drive is not wiped until you handle that drive.

• Confirm the device is on the approved disposal list and has an owner sign-off.
• Record the asset tag, serial number, model, storage type and current location.
• Back up any data the business still needs and confirm the restore before you erase.
• Sign out of cloud accounts, remove the device from mobile device management and revoke its tokens.
• Turn off activation locks such as Find My, iCloud Lock, Google account lock and Windows device encryption tied to a Microsoft account.
• Export or record the BitLocker or FileVault recovery key only if policy allows, then delete it after the wipe.
• Choose the wipe method for the media: factory reset with encryption, ATA Secure Erase, NVMe Sanitize, cryptographic erase or physical destruction.
• Run the wipe from a trusted boot environment or the device settings, and let it finish without interruption.
• Verify the result by booting to the setup screen, checking the drive is empty and confirming no recovery partition remains.
• Remove and wipe or destroy SIM cards, memory cards and USB drives that were stored with the device.
• If the wipe fails or the drive is failing, remove the storage and send it for physical destruction with a serialized record.
• Take a photo of the wipe confirmation screen and attach it to the asset record.
• Pack the device with a label that shows the wipe date, method and destination.
• Update the asset register to show the device as disposed, and file the certificate or log.

What good looks like

Good disposal looks boring. Every device has one record, one method and one destination. The record is filled in at the time of the wipe, not reconstructed a month later. The person who wipes the device is not the only person who can change the record.

You can show a clear trail from the asset tag to the final certificate. For wiped devices, the trail includes the wipe tool, the version, the result and a photo. For destroyed media, it includes the serial number, the destruction method, the date and the name of the witness. For resale, it includes the buyer and a statement that activation locks are cleared.

Exceptions are visible. A drive that failed to wipe is not quietly put in the recycle bin. It is logged, removed and destroyed. A phone with an unknown iCloud lock is not sold. The team reviews open exceptions at a fixed interval and closes them with evidence.

The process also protects the people doing the work. Wiping a drive takes time. A checklist with a hold period and a two-person check for destruction prevents shortcuts at the end of a long day. It also gives finance a clean list for write-offs and gives security a clean answer when an auditor asks where a laptop went.

What to do next

Start with one page. Name the wipe methods you will use for hard drives, solid state drives, phones and network gear. Set the hold period and the destruction threshold. Add the checklist to your offboarding ticket so it fires when a device is returned, not when someone remembers.

Pilot the checklist on five devices of different types. Include one old spinning disk, one encrypted laptop, one phone and one switch. Time each step and fix the parts that slow you down. Then pick a recycler or reseller and ask for their process in writing: how they wipe, how they track serial numbers, what certificate they issue and where the material goes.

If you need help setting a standard device spec and a disposal recommendation, the Cloudverg Hardware and endpoint review is a two week fixed price package at $4,500. It inventories endpoints, servers, network gear and licenses, and includes warranty, spare and disposal recommendations. It is one option among others, and it fits best when you have mixed devices and no clear standard.

Review the disposal log every quarter. Look for devices that sat too long, wipes that failed, and destinations with missing certificates. Update the checklist when you add a new device type or storage technology. The goal is not a perfect binder. It is a habit that keeps data from leaving with the hardware.

Frequently asked questions