Data center decommissioning checklist and process

Which sanitization method fits the drive, what to put in writing before anything is unracked, and the recycler certification worth checking on resale.

A data center or server room decommission carries a documentation obligation that outlasts the move itself: every drive leaving the building needs a record of how it was sanitized and who performed it, because the data on it stays your liability until that record exists. Our IT and data center relocation guide covers cutover planning and the physical move. The sanitization and disposal side sits underneath that: choosing and documenting a method, and checking a disposal vendor's certification before equipment leaves your control.

Pick the sanitization method before you choose a vendor

The recognized federal standard here is NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, published September 2025 and currently Final. NIST writes it for federal agencies. NIST also states the publication may be used by nongovernmental organizations on a voluntary basis, so for a commercial decommission it works as the standard to ask a vendor to name and follow.

The standard defines three sanitization methods, based on how much recovery effort each one defeats and whether the media stays usable afterward.

Method	What it does	Leaves the drive usable?
Clear	Applies logical techniques through the device's own read and write interface, typically an overwrite, though a factory reset that skips rewriting can also qualify. Defeats simple, non-invasive recovery attempts.	Usually
Purge	Applies physical or logical techniques that defeat state-of-the-art laboratory recovery attempts, aiming to keep the device reusable.	Often, technique-dependent
Destroy	Physically destroys the media (disintegrate, incinerate, melt, pulverize or shred), so recovery is infeasible even with laboratory techniques.	No

The standard also names cryptographic erase: a logical Purge-category technique that sanitizes the encryption keys so the underlying data becomes unreadable, on devices that support it.

Source: NIST SP 800-88 Revision 2, Guidelines for Media Sanitization

Which method fits is a data-sensitivity decision. A workstation being redeployed inside the same company after a Clear pass is a straightforward case. A decommissioned server being resold or scrapped calls for Destroy, or a verified Purge, because the buyer or recycler is now outside your control. Make the call in writing, per asset class, before the vendor touches the hardware, so the method used doesn't default to whatever is fastest for the vendor that day.

What to put in writing before anything is unracked

Four things belong in the contract before the first drive comes out of a rack.

• Which sanitization method applies to which asset class, put in writing before the move starts.
• Who performs sanitization: your own IT team, the moving company, or a separate ITAD vendor, and exactly where custody transfers between them.
• A sanitization record for each individual device. NIST SP 800-88 Revision 2 states a certificate of sanitization should be completed for each ISM that has been sanitized, and Appendix C supplies a sample form for it.
• What happens to a device that fails sanitization or can't be sanitized. NIST notes destruction may be the only option left once other methods can't be effectively applied, so settle that outcome in the contract in advance.

Source: NIST SP 800-88 Revision 2, Guidelines for Media Sanitization

Keep every sanitization record after the move closes out. If a device later turns out to be missing, or a certificate can't be produced, this is the paper trail that shows what actually happened to it.

Check the disposal recycler's certification too

Equipment leaving your control for resale or recycling adds a second question on top of sanitization: who is actually receiving it. The EPA names two audited certification programs for electronics recyclers, Responsible Recycling (R2) and e-Stewards. In the EPA's own words, certified recyclers "have demonstrated through audits and other means that they continually meet specific high environmental standards and safely manage used electronics."

Asking whether your mover's disposal partner holds either certification takes about as long as looking a carrier up in FMCSA's mover database, and it serves the same purpose: it turns a claim into something you can check.

Source: EPA, Certified Electronics Recyclers