A laptop returned to a leasing company, a phone replaced after a refresh, or a printer sent for recycling can all carry business information beyond its useful life. Deleting a few files or choosing a reset option does not, by itself, prove that data is no longer recoverable or that every storage component was addressed.
NIST Special Publication 800-88 Revision 2, finalized in September 2025, treats media sanitization as a program that protects sensitive information during reuse or disposal. Its central lesson for a small organization is practical: decide what must be protected, choose a method that fits the data and the media, and retain enough evidence to show what happened. A repeatable process makes that decision more reliable than relying on a last-minute wipe.
Start with an inventory, not a wipe button
Before a device leaves a user, room, or service provider, match it to an asset record. Capture its asset tag or serial number, device type, assigned user or department, business owner, storage configuration, and expected destination. This helps distinguish a device that can be reused internally from one that will be returned, sold, donated, recycled, or destroyed.
Think beyond laptops and desktop computers. Phones, tablets, removable drives, network appliances, office printers, scanners, and other equipment may store local files, account information, print or scan jobs, configuration data, or credentials. Some devices contain more than one storage component. The asset record should identify what is known about each item and flag uncertainty for review instead of assuming that a device has no data because it lacks a visible hard drive.
Also identify the information previously handled by the device. A workstation used for ordinary internal work may have a different risk profile from equipment that accessed financial, customer, health, legal, or regulated records. The goal is not to create an elaborate classification bureaucracy. It is to know enough about sensitivity, device capability, and destination to select a defensible handling path.
- Record identity: asset tag, serial number, model, assigned user, and owner.
- Record exposure: data types, encryption status if known, storage components, and management enrollment.
- Record destination: internal reuse, vendor return, resale, donation, recycling, or destruction.
Choose the outcome and sanitization method deliberately
Decide what should happen to the equipment before performing the sanitization. Internal reassignment, a lease return, a sale, and physical destruction create different custody and reuse conditions. A business may need to preserve approved records elsewhere before clearing a device, but it should not treat the old device as an archive or keep sensitive data on it simply because no one has confirmed the transfer.
NIST describes three broad outcomes: clear, purge, and destroy. They are not interchangeable settings, and choosing among them depends on the sensitivity of the information, the media, and whether the device or media is intended for reuse. A method that is adequate for one storage type or risk level may not be appropriate for another. When data is highly sensitive, the device is damaged, or its storage technology is unclear, pause and involve someone qualified to make the decision.
A factory reset, file deletion, or operating-system reinstall may be part of a workflow, but do not treat the label on a menu as proof of an appropriate sanitization result. Follow the device maker's documented process and the organization's approved standard. For managed equipment, keep cloud access, device-management status, and storage sanitization as related but separate tasks: removing a device from management does not erase its data, and erasing local storage does not revoke a cloud session.
Use a documented process for tools and vendors
Write down the approved method for each common device and destination. NIST's current revision shifts toward establishing an enterprise media-sanitization program and recommends that sanitization techniques follow IEEE 2883, NSA specifications, or another organizationally approved standard. It also emphasizes establishing trust in a vendor's implementation of clear and purge methods. That is a reason to evaluate a service provider's process rather than accepting an undocumented promise that equipment will be wiped.
For an outside recycler, leasing company, refurbisher, or IT provider, ask who performs the work, where it occurs, whether subcontractors are involved, how items are tracked, and what happens when a device cannot be sanitized as planned. Confirm that the provider can associate its completion record with the actual asset identifiers you supplied. A generic certificate without serial numbers or a clear scope may not demonstrate that your specific equipment was handled.
Keep the procedure simple enough to follow during a busy refresh. State who approves the disposition, who prepares the device, which method is authorized for each risk category, who verifies completion, and where exceptions go. If a provider changes its process or storage technology changes, review the method rather than assuming an old checklist remains suitable.
Verify completion and preserve useful evidence
Close the loop by reconciling the asset list against the sanitization or destruction evidence. Confirm that each serial number is accounted for, the reported method matches the approved method, and the date and responsible party are recorded. Investigate missing devices, failed results, incomplete reports, and items that were diverted to another destination. Do not release an unresolved asset to resale, donation, or recycling just to clear a storage area.
Keep records proportionate to the data and applicable obligations. Useful fields include the asset identifier, prior owner, data sensitivity, approved disposition, sanitization method, result, date, operator or provider, verification evidence, and any exception or follow-up. Retain the evidence under the organization's records policy and any relevant contractual or regulatory requirements. A certificate is useful evidence, but it is not a substitute for checking whether it covers the right device and the right process.
Before closing the asset record, separately revoke access that is no longer needed. Remove the device from endpoint management and inventory, retire certificates or device identities as appropriate, sign out or revoke active sessions, and update assigned-user records. Back up business records that must be retained before sanitization, then verify that the approved copy is accessible. These steps reduce lingering access and avoid confusing cloud offboarding with physical media sanitization.
Make retirement a normal security control
Attach the same workflow to predictable events: an employee departure, a device refresh, a lease ending, a warranty replacement, equipment sent for repair, or a business closure. Use a release gate so an item cannot leave custody until its data-handling decision and required evidence are complete. For urgent exceptions, document the approver and the temporary control rather than silently bypassing the process.
Review a small set of measures periodically: the share of retired assets matched to records, the share with complete sanitization evidence, exceptions awaiting resolution, and devices whose destination is still unknown. These measures reveal whether the process works in practice. If a list is incomplete or a vendor report cannot be reconciled, fix the handoff before increasing the volume of devices being retired.
A sound retirement process does not require every business to buy the same tool or destroy every device. It requires a clear owner, a risk-based method, controlled custody, and evidence that matches the equipment. With those elements in place, a routine technology refresh becomes a manageable security task instead of an untracked path for old data to leave with old hardware.
