Skip to main content
What is ITAD? Your Guide to IT Asset Disposition
ITAD

What is ITAD? Your Guide to IT Asset Disposition

By August 13, 2026No Comments

Last updated: August 11, 2026

IT asset disposition (ITAD) is the process of retiring computers, servers, and other IT equipment in a way that permanently destroys the data on them, recovers the value still left in them, and keeps the hardware out of landfills, with documentation strong enough to survive a regulatory audit. Done well, ITAD is a risk-management program. Done poorly, it is how a global bank ended up paying more than $161 million in fines.

This guide explains how ITAD works in 2026: the process, the data destruction standards, the laws, the certifications, what your retired equipment is worth, and how to choose a vendor. It reflects the standards in force this year, including NIST SP 800-88 Revision 2 and IEEE 2883.

Human-I-T is a NAID AAA certified, ISO 9001, ISO 14001, and ISO 45001 certified nonprofit ITAD provider. We have distributed more than 656,000 technology items, connected over 120,000 households to the internet, supported 22,000+ digital literacy learners, and diverted 23 million pounds of e-waste from landfills. If you want to talk through a disposition project, contact our team.

Table of Contents

What Is ITAD (IT Asset Disposition)?

ITAD stands for IT asset disposition: the managed retirement of an organization’s technology hardware. A complete ITAD program covers secure data destruction, logistics and chain of custody, refurbishment and resale, donation, and certified recycling for whatever cannot be reused. The word to notice is disposition, not disposal. Disposal implies throwing something away. Disposition means deciding, deliberately and with records, what happens next to every asset.

An “IT asset” here means anything that stores or moves data: laptops, desktops, servers, storage arrays, network switches, phones and tablets, printers with internal drives, point-of-sale hardware, and increasingly the GPU-dense racks coming out of AI data centers.

ITAD is often confused with two neighboring practices, so here is the distinction:

  • ITAD vs. e-waste recycling: Recycling is one possible outcome of ITAD, and under responsible standards it is the last resort. ITAD is the governed process that decides whether a device is resold, redeployed, donated, or recycled, and proves what happened to the data first.
  • ITAD vs. ITAM: IT asset management (ITAM) tracks assets throughout their working life. ITAD is the final stage of ITAM, and the stage where most of the legal risk is concentrated.

This is a large and fast-growing industry. The global ITAD market was valued at roughly $19.3 billion in 2025 and is projected to reach $35.4 billion by 2034, a 6.77% compound annual growth rate. The industry has also shifted its language: what was once “disposal” is now framed as asset lifecycle management and circular IT, a response to how many buyers now carry formal ESG reporting obligations.

Every serious ITAD program, whatever the provider calls it, rests on three functions: certified data destruction, value recovery, and data center decommissioning. Around those sit the supporting pillars: certified e-waste recycling and secure, tracked logistics. The rest of this guide walks through each.

Why ITAD Matters: Risk, Recovery, and ESG

ITAD matters because retiring a device wrong carries three costs at once: regulatory penalties and breach liability, forfeited resale value, and environmental harm your organization may now be required to report. The clearest illustration of the first cost is the Morgan Stanley case.

The $161 million lesson

Between 2020 and 2023, Morgan Stanley paid more than $161.5 million in ITAD-related penalties and settlements. In 2016, the firm hired a moving and storage company with no data destruction experience to decommission two data centers. That company subcontracted the wiping to an unvetted e-waste firm, which sold the drives, data intact, on an internet auction site. In a separate 2019 incident, a records reconciliation found 42 decommissioned servers missing, and the firm discovered its encryption software had silently gone unactivated for years. The personal information of roughly 15 million customers was exposed. The bill: a $60 million fine from the Office of the Comptroller of the Currency in 2020, a $35 million SEC penalty and a $60 million class-action settlement in 2022, and a further $6.5 million to five state attorneys general in 2023.

Two details make the case instructive rather than just alarming. First, the failure was procurement, not technology: a mover was hired to do a forensic specialist’s job. Second, industry forensic analysis finds that 99% of ITAD-related data breaches and missing-asset incidents occur before the disposition vendor ever takes possession of the equipment. Your internal process, inventory, staging, and handoff, is where the risk lives. Compliance frameworks including HIPAA, GLBA, and CMMC 2.0 now operate on what amounts to a zero-trust posture for hardware end-of-life: an internal claim that a drive “was wiped” is no longer a defensible position in an audit. Only documented, verifiable sanitization is.

Retired hardware is worth more in 2026 than it has been in years

The second reason ITAD matters right now is financial. An AI-driven component shortage has repriced the secondary market. DRAM and SSD prices surged 130% by early 2026 (Gartner), pushing the average selling price of new enterprise PCs up 17%. Cisco and IBM raised list prices on networking and compute gear by 13% to over 100% in some regions after the 2025–2026 tariff rounds, lead times for servers with high-density memory stretched to 32 to 40 weeks, and global PC shipments are projected to fall 10.4% to 11.3% year over year, the sharpest supply-driven contraction in over a decade. Organizations are responding by holding devices longer, with business PC lifespans up 15% (Gartner), which makes disciplined disposition at the eventual exit worth more, not less. When new hardware is expensive and slow to arrive, used enterprise hardware appreciates: the refurbished IT market is valued at roughly $10.4 billion in 2026 and growing near 10% annually.

Layered on top is a one-time wave: Microsoft ended Windows 10 support in October 2025, and Windows 11’s TPM 2.0 and CPU requirements rendered an estimated 240 million PCs functionally obsolete for enterprise use (Canalys). Stacked as folded laptops, those machines would form a pile 600 kilometers high. Nearly every organization is disposing of something this year. The ones with a real ITAD program are recovering value from that wave; the ones without are paying to create risk.

The third reason is environmental, and because it now connects to formal reporting frameworks like CSRD and California SB 253, it gets its own section below.

The ITAD Process: 8 Steps From Decommissioning to Certificate

A defensible ITAD process runs through eight steps. The order matters, because the documentation each step produces is what protects you later.

  1. Inventory and serialized tagging. Record every asset before it moves, and record it twice: the device’s OEM serial number and a separate ledger of the internal storage-drive serial numbers. Tracking by internal asset tag alone is considered insufficient for a forensic audit, because drives are swapped, upgraded, and removed over a device’s life.
  2. Segregation of duties. The person who retires the hardware must not be the person who verifies the outbound inventory, and the ITAD vendor must never perform your initial reconciliation, which would be a conflict of interest. Missing-asset incidents are usually discovered, or missed, at this step.
  3. Secure logistics. Best practice is dedicated, GPS-tracked vehicles with dual-driver teams for high-value loads, tamper-evident bins, and, for remote workforces, trackable retrieval kits. What to avoid: less-than-truckload (LTL) freight and unsecured cross-dock warehouses, where custody physically changes hands without accountability.
  4. Facility intake and reconciliation. The receiving facility counts and scans everything against your outbound manifest and flags variances immediately. Until sanitization, data-bearing assets should be held in physically caged, access-controlled areas, segregated from processed stock.
  5. Data sanitization. Every storage device is cleared, purged, or destroyed according to NIST SP 800-88 Rev. 2 and IEEE 2883, with the method matched to the media type. This is the highest-liability step in the entire chain, and the next section covers it in depth.
  6. Triage and grading. Sanitized assets are tested and graded. The industry-standard framing comes from R2v3’s REC framework: cosmetic condition graded C1 (damaged) up to C9 (new open box), and functionality graded F1 (collectible or specialty) up to F6 (like new, zero defects). The grade determines the disposition path and the price.
  7. Disposition: reuse, donate, or recycle. Responsible standards impose a hierarchy: reuse first, materials recovery second, disposal last. In practice that means resale or redeployment where value remains, donation where social impact beats the resale margin, and certified recycling for the remainder. (For how to decide between those paths, see our guide on when to recycle, donate, or resell.)
  8. Documentation and reporting. The process ends with a per-device Certificate of Destruction or Sanitization, settlement reporting on resold assets, and environmental reporting on recycled ones. Mature vendors integrate this with your ITSM: ServiceNow-integrated ITAD platforms can trigger pickups when an asset is flagged “Ready for ITAD” and attach the certificate directly to the asset’s CMDB record.

If you only audit one thing about your current process, audit steps 1 and 2. Remember the forensic finding above: 99% of ITAD-related breaches happen before the vendor takes possession.

ITAD Data Destruction: Standards and Methods That Actually Work in 2026

Data destruction is the heart of ITAD, and it is where the most dangerous myths live. The governing framework changed recently: on September 26, 2025, NIST finalized Special Publication 800-88 Revision 2, the first update to the U.S. government’s media sanitization guidelines since 2014. Rev. 2 dropped the old device-by-device technique tables and became a governance standard, delegating the technical “how” to IEEE 2883-2022, the storage sanitization standard that defines the exact firmware commands for modern drives. That family is still expanding: IEEE published 2883.1-2025 as a recommended practice for choosing among sanitization methods, and a further standard for sanitization tooling (P3406) is in development, so expect vendor requirements to keep tightening.

Clear, Purge, Destroy: the three sanitization levels

  • Clear is logical sanitization, typically a software overwrite of all user-addressable storage. It defends against ordinary recovery tools working through standard interfaces. It is appropriate for low-sensitivity data staying inside your organization.
  • Purge renders data unrecoverable even against state-of-the-art laboratory attacks such as electron microscopy, while leaving the media reusable. Under NIST 800-88 Rev. 2, Purge is the mandatory minimum for medium- and high-sensitivity data on any asset leaving your control, including resale, lease return, donation, and recycling.
  • Destroy means physical elimination: disintegration, incineration, melting, or pulverization. It is mandated for classified data and Controlled Unclassified Information, and it is the required fallback whenever a device fails and a logical Purge cannot be verified.

The practical rule: if an asset is leaving your building with a resale or donation future, it needs a verified Purge. If it cannot be purged, it must be destroyed.

Four data destruction myths that fail audits

Myth 1: “Secure deletion means multiple overwrite passes.” The multi-pass DoD 5220.22-M wipe is obsolete; the Department of Defense itself has deprecated it. NIST 800-88 Rev. 2 confirms a single-pass overwrite is sufficient to Clear a modern magnetic hard drive, and extra passes add nothing but wear and time.

Myth 2: “Overwriting works on SSDs.” It does not, and this is the most consequential myth in ITAD. Solid-state drives reserve 7% to 28% of their physical capacity as overprovisioned space that the operating system cannot see, and wear-leveling scatters data across it. A host-level overwrite, including tools like DBAN or a Windows format, never touches those regions and can never rise above Clear. Purging an SSD requires firmware-level commands: NVMe Sanitize Block Erase, which drops every NAND block including remapped and overprovisioned sectors, or Cryptographic Erase.

Myth 3: “Degaussing destroys everything.” Degaussing has zero effect on SSDs, USB drives, memory cards, and phone storage, because flash memory stores data as electrical charge, not magnetism; a degaussed SSD remains fully recoverable. Even for magnetic drives, the degausser’s field must be matched to the media: 1.5 to 2 times the drive’s coercivity, so a 5,000-oersted drive needs at least a 10,000-gauss degausser. And degaussing is now failing at the frontier: next-generation HAMR and MAMR drives have shown residual data even after exposure to 20,000-gauss, NSA-listed degaussers. Those drives require cryptographic erasure or physical destruction by incineration or disintegration.

Myth 4: “Shredded means gone.” Standard industrial shredders cut drives into 1.5- to 2-inch strips, which is adequate for hard drive platters but can let intact SSD memory chips slip through the cutters. A desoldered NAND package can be read on a donor board, a technique called chip-off recovery. IEEE 2883 formally deprecates shredding as a destruction method for high-density media, noting that a 2-millimeter fragment of a modern drive can still hold gigabytes of data. For flash media that must be physically destroyed, the NSA requires disintegration to particles of 2 millimeters or less; the German DIN 66399 standard similarly escalates to 1 mm² (level E-6) and 0.5 mm² (E-7) particles for its highest security levels.

What a compliant SSD Purge looks like

Two firmware mechanisms achieve Purge on solid-state media under IEEE 2883. Sanitize Block Erase performs a low-level NAND erase across every channel and die, clearing overprovisioned and remapped sectors, in seconds to minutes. Cryptographic Erase (CE) destroys the media encryption key on a self-encrypting drive, rendering all ciphertext mathematically unrecoverable in milliseconds. CE carries conditions: NIST 800-88 Rev. 2 recognizes it as a valid Purge only when the drive’s AES-256 encryption was verifiably active at the controller level from first use and the key lifecycle is documented, with the key destruction executed as FIPS 140-3 style zeroization. Encryption that was never turned on protects nothing, which is precisely the flaw Morgan Stanley discovered years too late.

Verification, validation, and sampling

NIST 800-88 Rev. 2 separates verification, the per-device check that a specific sanitization completed successfully, from validation, the program-level, documented determination that a method actually works for a class of devices. Certified facilities operationalize this with forensic sampling: R2v3’s data sanitization appendix, for example, requires forensic verification of at least 5% of all logically sanitized media by a third-party auditor or independent QC representative. Ask any ITAD vendor what their sampling rate is and who performs it; silence is an answer.

Cloud and virtual storage

Decommissioning no longer stops at physical drives. For cloud workloads, NIST 800-88 Rev. 2 prescribes sanitization through the control plane: destroy the encryption keys in the provider’s key management system, delete all associated volumes and snapshots, and obtain a certificate of deletion from the provider for your records.

Sanitization methods by media type

MediaAchieves ClearAchieves PurgeDestroy (when required)
Magnetic HDDSingle-pass overwriteRated degaussing; crypto erase on SEDsShred/deform after degauss (per NSA practice)
SSD / NVMeHost-level overwrite (insufficient alone for release)NVMe Sanitize Block Erase or Cryptographic EraseDisintegration to ≤2 mm particles
Phones / tablets (embedded flash)Factory reset (low assurance)Manufacturer cryptographic eraseDisintegration to ≤2 mm particles
Magnetic tapeOverwrite (impractical at scale)NSA-evaluated degaussing matched to coercivityIncineration
HAMR / MAMR next-gen HDDsOverwriteCryptographic erase (degaussing unreliable)Incineration or disintegration
Cloud volumesVolume deletionKMS key destruction + snapshot deletionN/A, provider-side with certificate of deletion

For how we execute this in practice, including on-site destruction options, see our data destruction services and our guide to choosing a hard drive destruction vendor without destroying your devices’ value.

ITAD Compliance: The Laws That Govern IT Asset Disposal

No single “ITAD law” exists. Instead, IT asset disposal sits under a stack of data protection, financial, and environmental statutes, and several of them can fire on the same incident. Here are the ones that reach most U.S. organizations, with current penalty exposure.

RegulationWho it coversDisposal-related exposure
HIPAA Security RuleHealthcare entities and business associatesUp to $2,190,294 per identical violation category per year at Tier 4 (willful neglect), per current HHS inflation-adjusted tiers
GLBA Safeguards Rule / FACTA Disposal Rule“Financial institutions,” broadly defined, and anyone holding consumer report dataFTC civil penalties from $50,000 into the millions, plus consent decrees up to 20 years with mandated audits
PCI DSS v4.0.1 (Req. 9.4.7)Anyone storing or processing cardholder dataUp to $500,000 per incident plus loss of card-processing privileges
GDPR / UK GDPR (Art. 28)Any organization processing EU/UK personal dataFines up to €20 million or 4% of worldwide annual turnover, whichever is greater
SEC Regulation S-P (2024 amendments)Broker-dealers, investment advisers, funds, transfer agentsEnforcement plus mandatory breach notification duties (below)
State disposal laws (35+ states)Varies; e.g., NY SHIELD Act, California CPRAIndependent state AG enforcement, routinely multi-million dollar

Details worth knowing behind that table:

  • The FACTA Disposal Rule is not just for banks. It applies to any organization holding consumer report information for a business purpose, explicitly including employers, landlords, and car dealers, and the FTC reads “financial institution” under GLBA to cover payday lenders, mortgage brokers, real estate appraisers, and tax preparers. The FTC has enforced it over literal dumpsters: American United Mortgage paid $50,000 and took on 10 years of compliance audits for discarding loan files in an unsecured dumpster, and broker Gregory Navone paid $35,000 for 40 boxes of tax returns disposed the same way.
  • SEC Regulation S-P got teeth in 2024. The amendments, with compliance dates of December 2025 for larger firms and June 2026 for smaller ones, extend disposal obligations to all customer information, require notifying affected individuals within 30 days of determining a breach likely occurred, and require contracts that obligate your service providers, ITAD vendors included, to notify you within 72 hours of discovering a breach.
  • PCI DSS v4.0.1 became fully effective March 31, 2025, and its Requirement 9.4.7 names the standards directly: electronic media must be rendered unrecoverable per NIST SP 800-88 or IEEE 2883, or physically destroyed, with quarterly validation and documented custody for media awaiting destruction (PCI Security Standards Council).
  • SOX reaches ITAD too. Under Sarbanes-Oxley Section 404, a broken chain of custody over data-bearing assets can constitute a material weakness in internal controls, which is an executive-level problem, not an IT one.
  • Healthcare enforcement is active at every size. Recent HHS OCR actions include Montefiore Medical Center at $4.75 million (2024) and Solara Medical Supplies at $3 million (2025), but also a $90,000 settlement against a county ambulance authority, so small organizations are not below the radar. HIPAA’s Breach Notification Rule gives you 60 days; missing hardware you cannot account for starts that clock.

Environmental liability: the part indemnification cannot fix

Data law is only half the stack. Nearly half of U.S. states ban e-waste from landfills, and RCRA regulates hazardous components like CRT glass and lithium-ion batteries cradle-to-grave. The statute that should change your vendor diligence is CERCLA, the Superfund law: its liability is strict, joint, and several, imposed without regard to fault. If your recycler illegally dumps your equipment, you can be liable for the full cleanup cost even though you paid in good faith. The Superfund Recycling Equity Act (SREA) offers an exemption for parties who “arranged for recycling,” but only if you can produce documented due diligence on the vendor’s compliance and capability performed before shipment. That documentation habit is the difference between an exemption and a bill.

Export controls: the Basel reality

Export is where many “cheap recycling” schemes hide. The Basel Convention’s e-waste amendments entered into force on January 1, 2025 across its 191 parties, placing even non-hazardous e-waste (the new Y49 listing) under prior-informed-consent trade controls. The United States is not a Basel party, which makes direct export of controlled e-waste from the U.S. to most of the world legally hazardous; the U.S. currently holds a qualifying side agreement covering Y49 waste only with Canada. The risk is not hypothetical: the Basel Action Network’s GPS tracker studies, which covertly embedded trackers in devices handed to U.S. recyclers, found up to 40% were exported to substandard operations overseas. If your vendor cannot show you where material physically goes, assume the worst, because a regulator will.

Government, defense, and CJIS requirements

Public sector ITAD runs on stricter, named specifications. Agencies and contractors handling criminal justice information operate under CJIS policy, which requires witnessed destruction with explicit documentation. For classified magnetic media, the NSA requires degaussers generating at least 30,000 gauss, and its Evaluated Products List specifies disintegration of classified SSDs, phones, and flash media to a nominal edge length of 2 millimeters or less, using NSA-evaluated equipment. The Department of Defense has formally moved off the old DoD 5220.22-M overwrite standard in favor of NIST guidance and NSA-evaluated destruction for solid-state media, so a vendor still selling “DoD wipes” is a decade out of date. On the environmental side, federal procurement guidance frequently cites R2v3, a standard the EPA participated in developing, as the required certification for government contractors. If you are disposing of equipment under a federal, state, or military contract, put the named standard, NIST category, and witnessing requirement directly into the statement of work.

Chain of Custody: The Paper Trail That Protects You

Chain of custody is the unbroken, documented record of who controlled every asset from your dock to final disposition. In an audit or breach investigation, this paperwork, not your vendor’s marketing, is your legal defense. Under the FTC Disposal Rule or HIPAA, the Certificate of Sanitization or Destruction is effectively the only evidence that counts.

A defensible, 2026-grade Certificate of Destruction records, per device:

  • Make, model, OEM serial number, and asset tag of the host device
  • The internal storage drive’s own serial number
  • The NIST sanitization category applied (Clear, Purge, or Destroy)
  • The exact method, named specifically, e.g., “IEEE 2883 NVMe Sanitize Crypto Erase” or “DIN 66399 E-6 disintegration,” never just “wiped”
  • The tool or machine used, with software version or equipment make and model
  • A pass/fail verification outcome, with exception handling notes for failed devices
  • Date, timestamp, and signatures from both the operator and a validating officer

Two traps to avoid. First, batch certificates: a single certificate covering “one pallet of assorted drives” has no forensic value and is explicitly treated as a compliance liability under ISO/IEC 27040:2024 and NIST 800-88 Rev. 2 practice. Second, the Certificate of Indemnification: a CoI proves only that a vendor took possession and assumed commercial risk. It is not evidence any data was destroyed. Morgan Stanley had paperwork; what it did not have was per-drive proof of sanitization.

The deeper legal point: liability does not transfer with the pallet. Under HIPAA you remain the covered entity, under GDPR Article 28 you remain the controller (and your vendor’s subcontractors require your explicit written authorization), and under CERCLA you remain the generator. Indemnification clauses shift money after a disaster; they do not shift the regulatory duty to have prevented it.

ITAD Certifications: R2v3, e-Stewards, and NAID AAA Explained

Certifications exist so you do not have to personally audit a shred plant. The three that matter in North America are R2v3, e-Stewards, and NAID AAA, and they answer different questions: R2v3 and e-Stewards primarily govern responsible processing and downstream flows, while NAID AAA governs the security of information destruction itself.

R2v3

R2v3, administered by SERI (Sustainable Electronics Recycling International), is the most widely adopted electronics recycling standard globally. Released in July 2020, it fully replaced the older R2:2013 on June 30, 2023, which means any vendor still advertising “R2:2013 certified” in 2026 is holding an expired credential. R2v3 is built on ten core requirements, including a reuse-first hierarchy of responsible management, and a set of process appendices: Appendix A for downstream chain control, Appendix B for data sanitization, Appendix C for test and repair, Appendix E for materials recovery. Appendix B is the one buyers should care about most: it requires a documented sanitization plan aligned to NIST 800-88, per-device serial tracking, access-controlled processing areas with a minimum 60 days of CCTV retention, and forensic verification sampling of at least 5% of logically sanitized media. Certification is a two-stage audit process that typically takes 7 to 8 months and costs a facility $15,000 to $75,000 to achieve.

The Appendix Trap: a facility can be legitimately R2v3 certified while holding only the appendices for scrap processing, with no Appendix B (data sanitization) or C (test and repair) in scope. The badge alone does not tell you. Verify the vendor’s scope statement, and verify certification at the specific facility address that will touch your assets, in SERI’s public directory. A parent company’s flagship certification does not extend to a subsidiary warehouse.

e-Stewards

e-Stewards, created by the Basel Action Network, is the strictest standard on exports and ethics: an absolute prohibition on exporting hazardous e-waste and non-working equipment to developing nations, a ban on prison labor, and a requirement that certified processors of data-bearing media also hold NAID AAA. Its fees scale with revenue, from $500 to $90,000 per year. BAN enforces with covert GPS trackers planted in seemingly broken devices; when trackers showed the processor Total Reclaim exporting LCD monitors to Hong Kong, BAN permanently revoked its certification and notified regulators. Healthcare, finance, and ESG-scrutinized multinationals tend to specify e-Stewards; U.S. federal and state procurement more commonly cites R2v3, which the EPA helped shape.

NAID AAA

NAID AAA, administered by i-SIGMA, certifies the information destruction operation itself, and its defining feature is unannounced audits: an inspector can arrive any business day and demand that a random chain-of-custody manifest reconcile against every serial number on the floor. It also mandates criminal background checks and ongoing substance screening for staff with media access, secure locked transport, and a minimum 90-day CCTV retention. NAID AAA is routinely a hard prerequisite in healthcare and government contracts, precisely because it is the certification that verifies destruction security continuously rather than on a scheduled audit day.

What about ISO, and “NIST certified”?

The ISO standards play supporting roles: ISO 9001 attests to quality management, ISO 14001 to environmental management systems, and ISO 45001 to worker health and safety, which matters in an industry that handles leaded glass and lithium batteries. ISO 27001 covers secure disposal on paper (Annex A controls) but says nothing about physical e-waste handling or downstream flows, so it cannot stand alone for ITAD. One claim should end a conversation: “NIST certified.” NIST does not certify companies, products, or software. A vendor can operate in conformance with NIST 800-88; anyone claiming NIST certification is either confused or hoping you are.

R2v3 vs. e-Stewards at a glance

R2v3e-Stewards
Administered bySERIBasel Action Network (BAN)
ExportsPermitted with legal compliance and documented downstream capabilityAbsolute ban on hazardous e-waste export to developing nations
Downstream diligenceTypically audited two tiers deep; focus materials tracked furtherFull chain of custody to final disposition
Data destructionAppendix B (must be in scope, check)NAID AAA certification required
ISO relationshipConformance to ISO 14001/45001 or equivalentIndependent ISO 14001 (or RIOS) certification required
Typical specifiersFederal and state procurement, general enterpriseHealthcare, finance, ESG-forward multinationals

Where Human-I-T stands

In the spirit of the scope-statement advice above, here is ours, stated plainly: Human-I-T is NAID AAA certified for information destruction and holds ISO 9001, ISO 14001, and ISO 45001 certifications. We are not an R2v3 facility ourselves; the downstream recycling partners that process our non-reusable material are R2v3 certified, and we track material to final disposition through them. Every data-bearing device we handle is sanitized to NIST 800-88 standards with per-device certificates. You can read more about how that works on our certified ITAD services page, and you should hold us to the same verification standard we just taught you: ask for the scope, the sample certificate, and the downstream map. We like those questions.

IT Asset Value Recovery: What Your Retired Equipment Is Worth

Value recovery is the discipline of getting paid for what your retired fleet is still worth, and in 2026’s constrained hardware market it frequently turns ITAD from a cost center into a funding source. The math is driven by one force: depreciation is a curve, and timing your exit on that curve is most of the game.

Enterprise equipment retains roughly 40% to 60% of its original value in its first two years. After that, assets shed value at 3% to 5% of remaining value per month, and by the time an end-user device passes years six and seven it is effectively parts. A three-year refresh cycle consistently recovers multiples of what a six-year cycle does, which is why value recovery strategy is really refresh strategy.

Typical recovery ranges by asset class

Asset classTypical retirement ageValue retainedTypical resale range
Tier-1 servers (1U/2U)3–5 years55–75%$500–$1,000+
ODM / white-box servers3–5 years53–73%$300–$600
Workstations5–6 years25–40%$400–$800+
Apple laptops and tablets3–4 years40–55%$300–$700+
Business laptops (Windows)3–4 years17–26%$120–$450
Enterprise desktops3–5 years15–33%$100–$300
Enterprise networking4–6 years20–35%$60–$300+

Within any class, controllable factors move the price substantially. A Grade A device sells for 20% to 40% more than a Grade B or C unit. Missing pieces, drive caddies, RAM, original power supplies, cut resale value 20% to 50%, so resist the urge to strip machines before disposition. A healthy battery adds 10% to 15% on laptops. And uniformity pays: consistent, identical-model batches command roughly 30% higher average returns than mixed pallets, an argument for disposing by refresh wave rather than by closet.

One underused channel: employee buyback, letting departing or upgrading staff purchase their own sanitized machines at fair market value. It recovers value with zero freight and near-zero remarketing cost, and works especially well for the Windows 10 wave of devices that are enterprise-obsolete but personally perfectly useful.

Not every asset should be resold, of course. Where market value is thin but the device still works, donation often produces more total return, in tax treatment and in impact, than a $40 resale. Our guide to choosing between recycling, donating, and reselling walks through that decision, and the donation path gets its own section below.

ITAD and ESG: E-Waste, Embodied Carbon, and Scope 3

ITAD used to appear in sustainability reports as a feel-good paragraph. In 2026 it appears in audited disclosures, because e-waste and IT carbon now sit inside formal reporting frameworks. The underlying numbers explain the attention.

The world generated a record 62 million metric tons of e-waste in 2022, and only 22.3% of it was formally collected and recycled, according to the UN Global E-waste Monitor 2024. That is 7.8 kg per person per year, up 82% since 2010, and the gap is widening: generation is growing 2.6 million tons per year while formal recycling capacity grows only 0.5 million tons. An estimated $62 billion in recoverable materials, copper, gold, iron, rare earths, is discarded annually, and generation is projected to hit 82 million tons by 2030 (UN GEM 2024).

The waste is also a supply-security story, which is why regulators now call e-waste an “urban mine.” The EU alone discards roughly 1 million metric tons of critical raw materials, lithium, cobalt, palladium, and rare earths like neodymium, inside electronic devices every year, while single nations control up to 100% of global refining capacity for some heavy rare earth elements. The EU’s Critical Raw Materials Act responds by mandating that 25% of the bloc’s strategic raw material consumption come from domestic recycling by 2030, and the UN GEM 2024 estimates that raising global e-waste collection to 60% by 2030 would generate net benefits exceeding $38 billion. Enterprise ITAD is the intake valve for all of it: retired corporate fleets are the cleanest, best-documented feedstock the circular economy has.

Reuse beats recycling, and the carbon math proves it

For laptops, phones, and other end-user devices, 80% to 85% of lifetime greenhouse gas emissions are embodied: they happen during manufacturing, before the device is ever switched on. Producing a single computer and monitor consumes roughly 240 kg of fossil fuels, 22 kg of chemicals, and 1.5 metric tons of water (UN estimates). That is why extending a device’s life is mathematically stronger climate action than recycling it: recycling recovers materials, but reuse avoids an entire manufacturing cycle. A lifecycle assessment by Cranfield University using ISO 14040/14044 methodology found a remanufactured enterprise laptop generates just 6.34% of the CO2e of a newly manufactured one, roughly 316 kg of CO2e avoided per device, along with about 190,000 liters of water. Remarket a thousand laptops instead of shredding them and you have avoided over 316,000 kg of CO2e, on the order of taking 80 cars off the road for a year. (Honesty note for your reporting: the ratio inverts for servers, where 60% to 80% of lifecycle emissions are operational, so old, inefficient servers can genuinely merit recycling over reuse.)

Where ITAD lands in your carbon accounting

Under the GHG Protocol, IT hardware touches Scope 3 in three places: new hardware purchases in Category 2 (capital goods), disposal of your own equipment in Category 5 (waste generated in operations), and, for OEMs, product end-of-life in Category 12. Two practical consequences: buying refurbished directly suppresses your Category 2 number, and device life extension shrinks it structurally. One rule keeps you credible: avoided emissions are not offsets. The GHG Protocol prohibits netting “avoided emissions” figures (like the 316 kg per laptop above) against your Scope 1, 2, or 3 inventory; they must be reported as a separate metric. Any vendor encouraging you to subtract them is coaching you into greenwash.

The reporting frameworks now asking for this data include the EU’s CSRD (ESRS E5-5 requires the actual weight of IT assets diverted through reuse and recycling, split hazardous and non-hazardous), California SB 253 (companies over $1 billion in revenue doing business in California: Scope 1 and 2 disclosure beginning 2026, Scope 3 phasing in from 2027), GRI 306-4 waste-diversion disclosures, and CDP climate responses. For end-of-life emission factors, the EPA’s WARM model (v16) is the standard North American tool; it credits recycling a short ton of desktops at −1.49 MTCO2e, useful context, and still far smaller than the avoided-manufacture numbers reuse delivers.

How do you know a vendor’s environmental report is real? Two markers. First, mass-balance reporting: inbound asset weight reconciled against outbound disposition, resold, recycled, landfilled, so the tons add up. Second, verifiable instruments rather than adjectives: serialized environmental certificates (such as I-TECs, which work like renewable energy certificates for ITAD and are verified under ISO 14064) prevent the same carbon claim from being counted twice. A glossy PDF with a tree on it is not evidence; a ledger is.

A good ITAD partner should hand you this section’s data for your own fleet: weights diverted by pathway, per-device avoided-emissions figures with the methodology named, and serialized backup for all of it. Our own program has diverted 23 million pounds, over 10,000 metric tons, of e-waste from landfills, and reuse-first is the reason. More on how we operationalize circularity is on our sustainable ITAD and circular economy page.

The Third Path: Donation-Based ITAD and Digital Equity

Between resale and recycling sits a third disposition path most ITAD guides skip: donation. Donation-based ITAD applies the exact same security pipeline, serialized custody, NIST 800-88 sanitization, per-device certificates, but routes the working devices to people instead of wholesale brokers. For equipment whose resale value is modest, it routinely produces more total return, in tax treatment, ESG reporting, and community outcomes, than a thin wholesale check.

This is the model Human-I-T was built on. As a nonprofit ITAD provider, we have distributed more than 656,000 technology items, connected over 120,000 households to the internet, supported more than 22,000 digital literacy learners, and diverted 23 million pounds of e-waste from landfills (see our impact). Every one of those devices moved through the same certified destruction and chain-of-custody controls described above; the difference is where the hardware goes when the data is gone. One in five U.S. households lacks adequate home internet or a working computer, and enterprise refresh cycles are the largest untapped supply of exactly the hardware that closes that gap.

Three practical notes for organizations considering the donation path:

  • Tax mechanics are real but procedural. Corporate equipment donations over $500 in aggregate require IRS Form 8283; claim more than $5,000 for an item group (say, a fleet of identical laptops) and you need a signed qualified appraisal completed no more than 60 days before the donation. A donation-experienced ITAD partner handles that paperwork as part of the engagement.
  • Impact is quantifiable, not anecdotal. Social return on investment (SROI) frameworks convert donation programs into auditable numbers. An illustrative model: donating 1,000 refurbished laptops at $50,000 in program cost against $285,000 in quantified social value yields a 5.7:1 SROI, a figure that belongs in the same ESG report as your Scope 3 data.
  • Security standards do not relax because the destination is charitable. If a donation program cannot produce per-device certificates of sanitization, it is not an ITAD program, it is a liability with good intentions.

If your refresh calendar has a wave coming, our technology donation program and digital inclusion services for organizations pages show how enterprises plug retired fleets directly into that pipeline.

How to Choose an ITAD Vendor: Criteria, Red Flags, and Killer Questions

Choose an ITAD vendor by verifying four things in order: certifications that are in-scope for data sanitization at the specific facility handling your assets; a serialized, per-device chain of custody with real certificates; adequate insurance; and transparent value-recovery math. Everything else, portals, marketing, price per pound, is secondary to those four.

A weighting that procurement teams use for RFP scoring, and that matches where the actual risk sits: data security and compliance 35%, certifications and environmental practices 20%, logistics and chain of custody 15%, value recovery and financial transparency 15%, operational scale and references 15%.

Insurance minimums to require in the contract: cyber liability and data breach coverage of $5–10 million, errors and omissions of $5 million (this is what pays when a wiping tool’s software bug leaves residual data), and environmental impairment coverage of $2–5 million.

Red flags that should end the conversation

  • “Completely free ITAD” with no structured revenue-share agreement. Processing has real costs; if you are not paying and not splitting resale value, the margin is coming from somewhere, typically skipped sanitization steps, illegal export, or selling data-bearing assets to informal buyers.
  • Per-pound pricing. Paying by weight incentivizes the vendor to shred your highest-value assets, drives, RAM, dense servers, to hit tonnage, destroying both your resale return and the reuse hierarchy.
  • Brokers posing as processors. Refusal of a site visit, no certification listed at the physical address they quote, and reliance on third-party LTL freight are the tells that your assets will be resold, data intact, to whoever pays.
  • Vague certificates. If the sample Certificate of Destruction does not show per-device serials, both chassis and drive, and a named standard and method, it is decorative.
  • “NIST certified” claims. As covered above: NIST certifies nothing. This claim is a competence test the vendor just failed.

Four killer questions for any ITAD RFP

  1. “Describe your exact technical procedure for sanitizing NVMe SSDs. How do you account for overprovisioning?” The right answer names IEEE 2883 firmware commands, Sanitize Block Erase or Cryptographic Erase. “Multi-pass wipe” or “we shred everything” are disqualifying answers for any fleet with resale value.
  2. “Will our assets ever be handed to a subcontractor or downstream vendor while data is still intact?” The only acceptable answer is an unequivocal no.
  3. “Send a redacted sample Certificate of Destruction.” Check it against the checklist in the chain-of-custody section above.
  4. “How do you calculate Scope 3 emissions avoidance for our ESG reporting?” A capable partner references GHG Protocol Categories 2 and 12 and named emission factors, not a marketing number.

If the engagement is large enough to justify it, visit the facility: you are looking for controlled access (mantraps, biometrics, 90-day CCTV retention), physically caged unprocessed assets segregated from sanitized stock, and the ability to pull a random asset’s live processing record on request. Regulated buyers should also note their sector’s norms: finance and healthcare organizations typically require NAID AAA and often on-site destruction before assets leave their own dock, while public sector and education buyers frequently purchase through cooperative vehicles like NASPO ValuePoint and Sourcewell rather than open RFPs.

For the data center-specific version of this diligence, including decommissioning logistics, see our guide to evaluating a data center ITAD vendor and our overview of how ITAD providers should handle asset tracking.

What ITAD Costs: Pricing Models Compared

ITAD pricing follows three models, and the honest answer to “what does it cost” is that a well-run program on a young fleet can cost less than zero, while a destruction-only program on old hardware is a straightforward fee.

  • Fee-for-service: flat per-device pricing, typically $15–$30 per laptop, $5–$15 per drive wiped or shredded, and $50–$150 per server, with logistics billed separately. This is the standard model where residual value is negligible or policy mandates 100% destruction, common in defense and other high-security environments.
  • Revenue share: the vendor processes assets for free or nominal freight and both parties split resale proceeds. Splits run from 60/40 to 80/20 in the client’s favor depending on asset age and volume; 70/30 is the common benchmark for good-condition enterprise gear, with 80/20 achievable on desirable data center equipment.
  • Hybrid: explicit line-item fees for logistics and data destruction, plus a revenue share on resale. Because every cost is visible before the split, this is widely considered the most transparent model in 2026.

Read the split’s fine print, because deduction order quietly changes your return. Take a device that sells for $100 with $20 in processing fees. Pre-split deduction: $100 − $20 = $80, and your 70% share is $56. Post-split deduction: your 70% of the gross is $70, minus the whole $20 fee, leaving $50. Same headline “70/30,” 11% less money. The only number that matters is net-to-you: gross recovery minus erasure, logistics, and processing fees. Ask every bidder to model the same 100-asset lot, net, in writing.

A fixed-price buyout, where the vendor pays a lump sum upfront and takes all market risk, is also legitimate; just understand you are trading upside for certainty at a wholesale discount.

ITAD Frequently Asked Questions

What does ITAD stand for?

ITAD stands for IT asset disposition: the managed process of retiring IT equipment through certified data destruction, then resale, redeployment, donation, or recycling, with a documented chain of custody. It is sometimes called IT asset disposal, but disposition is the accurate term, since destruction of the hardware is only one of several outcomes.

Is wiping a drive once enough to erase it?

For a magnetic hard drive, yes: NIST SP 800-88 Rev. 2 confirms a single-pass overwrite achieves Clear, and multi-pass DoD-style wipes are obsolete. For SSDs and NVMe drives, no overwrite is enough, because 7–28% of the drive’s capacity is invisible to the host; they require firmware-level commands (NVMe Sanitize or Cryptographic Erase) to reach Purge.

Does degaussing destroy data on SSDs?

No. Degaussing only disrupts magnetic storage. SSDs, USB drives, memory cards, and phone storage hold data as electrical charge in flash cells, so a degaussed SSD remains fully recoverable. SSDs must be purged with firmware sanitize commands or cryptographic erase, or physically disintegrated to particles of 2 mm or smaller.

What is the difference between a Certificate of Destruction and a Certificate of Indemnification?

A Certificate of Destruction is per-device forensic evidence: serials, the sanitization standard and method, verification outcome, and signatures. A Certificate of Indemnification only documents that a vendor took possession and assumed commercial risk; it proves nothing about the data. Regulators accept the CoD, not the CoI, as evidence of compliant disposal.

Which certification should my ITAD vendor have, R2v3 or e-Stewards?

Either can anchor a responsible program; they differ most on exports, where e-Stewards imposes an outright ban and R2v3 allows compliant, documented export. What matters more is scope: for data-bearing assets, verify R2v3 Appendix B or NAID AAA certification at the specific facility touching your equipment, not just a logo on the parent company’s website.

What does ITAD cost per device?

Destruction-only, fee-for-service pricing typically runs $15–$30 per laptop, $5–$15 per drive, and $50–$150 per server, plus logistics. For newer fleets, revenue-share models (60/40 to 80/20 splits in the client’s favor) can offset fees entirely and return net proceeds. The honest comparison metric is net-to-you on an identical asset lot.

Can we be held liable if our ITAD vendor illegally dumps our equipment?

Yes. Under CERCLA, environmental liability is strict, joint, and several, meaning you can owe full cleanup costs regardless of fault, and under HIPAA and GDPR the data duty stays with you no matter what your vendor signed. The SREA recycling exemption protects you only if you documented due diligence on the vendor before shipment.

How is data center ITAD different from regular ITAD?

Scale, speed, and hazard. AI hardware refresh cycles have compressed to 18–36 months, racks now draw 132–240 kW, and decommissioning adds field risks like live adjacent racks, heavy UPS strings, and liquid-cooling refrigerants. The data center decommissioning segment alone reached $12.95 billion in 2026. See our data center ITAD services for specifics.

Is donating retired IT equipment tax-deductible?

Generally yes, for corporate donations to qualified nonprofits. File IRS Form 8283 when total noncash donations exceed $500, and obtain a qualified appraisal (completed within 60 days before donation) when a claimed item group exceeds $5,000. Donation does not waive security obligations: devices still require certified sanitization with per-device documentation first.

How does ITAD reduce Scope 3 emissions?

Two ways. Extending device life or buying refurbished shrinks GHG Protocol Category 2 (capital goods) emissions, since 80–85% of an end-user device’s lifetime footprint is embodied in manufacturing. Reuse also generates quantifiable avoided emissions, roughly 316 kg CO2e per remanufactured laptop (Cranfield University), which must be reported separately, never netted against your inventory.

Retire Your Technology the Right Way

ITAD done properly is not complicated, but it is unforgiving of shortcuts: serialize everything, purge or destroy to current standards, keep the certificates, and choose partners you have actually verified. If you would rather run that playbook with a certified nonprofit partner, one that turns your retired fleet into connected households instead of landfill weight, we should talk. Start with our certified ITAD services, or contact our team for a disposition plan and a net-to-you quote on your next refresh wave.

Liz Cooper

About Liz Cooper

Related Posts

ITAD

Is a Factory Reset the Same as Data Destruction and Does it Really Erase Your Data?

August 19, 2026
Lo Terry
Not really and not always. On a modern iPhone or Android phone with encryption on from day one, a factory…
Read more >
ITAD

Hard Drive Destruction Services: How to Choose a Vendor Without Destroying Your Devices’ Value

August 6, 2026
Lo Terry
When Morgan Stanley decommissioned two data centers, it hired a moving company instead of a certified provider of data destruction…
Read more >
ITAD

How to Evaluate Data Center ITAD Vendors in 2026

July 8, 2026
Lo Terry
Looking for data center ITAD services now? See our full list of services here. Data center decommissioning services handle the secure…
Read more >
Close Menu