Looking for On-Demand Tech Support?
Techmate has the boots-on-the-ground IT Support where and when you need it.
Schedule a Discovery CallDrive Sanitization and Destruction Standards for Onsite IT Support Services
Quick answer: Drive sanitization is a required step in onsite IT support services whenever laptops, servers or printers leave service. Set a written policy aligned with NIST SP 800-88, match the method to the media type, verify results and keep serial-level records. Techmate technicians in 450+ US cities follow your policy during onsite hardware support, refreshes and closures.
A retired laptop, a failed server drive, a copier returned at lease end: each may hold client files, credentials or regulated data long after it stops being useful. Deleting files or reformatting does not reliably remove that data. When devices leave your control without proper sanitization, the data goes with them, and the exposure is expensive. The IBM Cost of a Data Breach Report, via CyberScoop, 2025 put the average US breach at a record $10.22 million.
Field technicians handle most of this equipment during refreshes, office closures and break-fix repairs, often at branch sites with no security staff present. This guide covers what buyers should require for drive sanitization and destruction, and how to run it consistently across many locations. It is general guidance; align your requirements with your security, legal and compliance teams.
What are the levels of media sanitization?
NIST Special Publication 800-88, Guidelines for Media Sanitization, is the most widely used reference for sanitization policy in the US. NIST, 2025 published Revision 2 in September 2025, superseding the 2014 Revision 1. Rev. 2 puts more weight on building an organization-wide sanitization program and points to current technical standards, such as IEEE 2883, for specific techniques. If your policy still cites Rev. 1, schedule a review.
The publication describes three categories of sanitization:
| Level | What it means | Typical use | Example methods |
|---|---|---|---|
| Clear | Logical techniques that protect against simple, non-invasive recovery | Reuse inside the organization | Overwrite with approved tools, factory reset where validated |
| Purge | Techniques that protect against advanced laboratory recovery | Media leaving organizational control (resale, donation, lease return) | Device sanitize commands, cryptographic erase |
| Destroy | Physical destruction so the media cannot be used again | End of life, highest sensitivity, failed drives that cannot be purged | Disintegration, incineration or other destruction by a qualified vendor, per current standards |
The right level depends on the media type, the sensitivity of the data and where the device is going next. A laptop moving from one employee to another may only need clear. The same laptop going to a reseller needs purge. A failed SSD from a file server holding client records may need destruction because it cannot be purged reliably.
Why does media type change the sanitization method?
Different storage technologies need different approaches, and the most common mistake is treating them all alike:
- Hard disk drives (HDDs): overwriting works on functioning drives; failed drives usually go to destruction.
- Solid-state drives (SSDs) and flash: wear leveling and spare blocks mean overwriting may not reach every storage area. Manufacturer-supported sanitize commands, cryptographic erase or destruction are commonly used.
- Self-encrypting and encrypted drives: cryptographic erase (securely destroying the encryption keys) can be effective when encryption was implemented properly from the start.
- Embedded storage: printers, MFPs, network devices, phones, tablets, point-of-sale terminals and conference room systems may require device-specific reset procedures or drive removal.
- Removable media: USB drives, SD cards and backup tapes are easy to forget and often hold the most sensitive copies.
Your policy should specify the approved method for each media type, not just a single rule for “drives.”
What are the options for sanitizing drives onsite?
Most multi-location companies combine onsite technicians with a certified destruction vendor. The right mix depends on volume, sensitivity and how many sites are involved.
| Option | How it works | Best for | Watch out for |
|---|---|---|---|
| Onsite sanitization by technician | Technician runs approved sanitization on the device before it leaves the site | Devices being reused or returned intact | Requires approved tools, time per device and a verification report |
| Drive removal for secure handling | Technician removes drives and hands them to a secure process | Failed devices, mixed fleets, small branch volumes | Chain of custody is critical between removal and destruction |
| Onsite destruction by certified vendor | Mobile service shreds or destroys media at your site | High sensitivity or high volume at one location | Scheduling a vendor at every small branch can be impractical |
| Offsite destruction by certified vendor | Media transported securely to a destruction facility | Consolidating drives from many sites | Requires sealed containers, secure transport and custody records |
A common pattern: local technicians remove and log drives at each branch, seal them in tamper-evident containers, and ship them to a central point or hand them to a destruction vendor. See chain of custody for hardware handled by field technicians for the custody side of that process.
What should buyers of onsite IT support services require?
Before any technician touches a drive, put these requirements in writing and share them with your provider:
- Written policy specifying sanitization level by media type and data sensitivity
- Approved tools and methods for any onsite sanitization, including versions
- Verification that sanitization succeeded, such as tool reports, and validation by sampling where your policy requires it
- Serial-level records tying each drive (not just each device) to its method and outcome
- Chain of custody for any media removed, stored or transported
- Certificates of sanitization or destruction from whoever performs the work
- Vendor qualifications for destruction providers, as your policy requires
- Photo evidence of removed drives, serial labels and sealed containers
- Exception handling: what the technician does when a drive will not sanitize, a serial does not match, or a device is missing
Treat this list as a statement of work, not a wish list. If a requirement is not in the ticket or work order, assume it will not happen consistently across sites.
How do you run drive sanitization during a refresh or office closure?
Refreshes and closures generate the most retired media at once. A step-by-step flow keeps nothing from slipping through:
- Build the asset list. Pull every device scheduled to leave the site from your inventory, including printers, network gear and phones. An accurate IT field support asset inventory is the foundation.
- Assign a disposition to each device: reuse, return to lessor, resale, donation or destruction.
- Assign a method per device and media type based on the disposition and your policy.
- Brief the technician with the asset list, methods, tools and exception rules before arrival.
- Sanitize or remove on site, recording the drive serial, device serial, method, result and time.
- Seal and photograph removed drives in tamper-evident containers with logged seal numbers.
- Hand off to the destruction vendor or courier with a signed custody record.
- Reconcile the asset list against technician records and certificates. Any gap becomes an open ticket.
For larger programs, coordinate sanitization with your refresh schedule using IT project and rollout field support, and see our guide to hardware refresh cycles across multiple sites.
What about devices being returned, repaired or resold?
Not every device leaving a site is headed for destruction. Each path has its own risk:
- Leased equipment: confirm lessor requirements and sanitize or remove storage before return. Copiers and MFPs are the classic miss. See printer and MFP fleet support.
- RMA and warranty returns: use drive retention options where your contract allows, so the failed drive stays with you. See smart hands for hardware break-fix under OEM warranty.
- Resale or donation: use purge-level methods or equivalent per policy and document results for every device.
- Internal redeployment: clear-level methods may be enough, but reimage and reassign through your normal provisioning process.
- Office moves: devices in transit are still in your custody; track them like any other asset.
What should a drive sanitization record include?
If an auditor, examiner or client asks what happened to a specific laptop, you should be able to answer in minutes. A complete record per drive includes:
| Field | Why it matters |
|---|---|
| Site, ticket and date | Ties the work to a location and an approved request |
| Device make, model and serial | Matches the record to your asset inventory |
| Drive model and serial | Proves which physical media was handled, since drives can be swapped |
| Media type | Shows the method was appropriate (HDD, SSD, embedded flash) |
| Sanitization level and method | Shows the policy was followed (clear, purge or destroy, plus tool) |
| Result and verification | Pass or fail, with the tool report attached |
| Technician name | Accountability for each step |
| Custody handoffs and seal numbers | Shows who held removed media and when |
| Certificate reference | Links the drive to the vendor’s destruction certificate |
How do you manage drive sanitization across many branch locations?
A central security team can enforce a policy at headquarters. The challenge is the 30 branches, satellite offices and retail sites where retired equipment piles up in a closet. A few practices make multi-site programs work:
- One policy, one checklist. Every technician at every site gets the same instructions and the same record template.
- Scheduled sweeps. Rather than waiting for closets to fill, schedule periodic visits to collect, log and remove retired media from each site.
- Secure interim storage. If drives must wait on site, use a locked container with a key holder named in the policy.
- Central reconciliation. A single owner compares technician records, vendor certificates and inventory every month.
- Local technicians, central oversight. Dispatching a local technician from a nationwide network avoids flying staff to each branch while keeping documentation standards consistent.
How do requirements differ by industry?
The method rules stay the same, but documentation expectations rise with regulation:
- Banks and credit unions: customer financial data is usually covered by regulatory and examiner expectations, so serial-level records and certificates matter. See IT services for banks.
- Law firms: client confidentiality obligations make retired laptops and file server drives a real risk. Many firms default to destruction for any drive that held matter data.
- Healthcare-adjacent and benefits businesses: protected health information brings its own disposal requirements; involve compliance early.
- Retail and branch networks: point-of-sale terminals, back-office PCs and network gear may hold payment or customer data, and stores often close or remodel on tight timelines.
- Real estate and professional services: client documents on shared MFPs and laptops are the main exposure.
What mistakes should you avoid?
- Treating formatting or deleting files as sanitization
- Using the same method for HDDs and SSDs without considering the difference
- Forgetting printers, MFPs, phones, network devices and removable media
- Recording device serials but not drive serials
- Accepting a destruction vendor’s batch certificate without serial-level detail
- Storing drives in an unsecured box “for later” in a branch storage room
- Letting a policy based on the 2014 NIST revision go unreviewed
- No exception process when a drive fails to sanitize
How should onsite IT support services handle drives?
Onsite IT support services should follow your written sanitization policy, remove or sanitize media per device type, document every drive by serial number and keep custody until handoff. Share the policy with your provider before work begins, and confirm how technicians report exceptions. Techmate’s network of 7,000+ vetted technicians works from your instructions on every ticket; see how Techmate dispatch works or contact us.
This article is general information, not legal or compliance advice.
Frequently Asked Questions
What is drive sanitization?
Drive sanitization is the process of removing data from storage media so it cannot be recovered, using a method suited to the media type and data sensitivity. It ranges from logical clearing for internal reuse, to purge methods for media leaving your control, to physical destruction for end-of-life or highly sensitive drives.
What is NIST SP 800-88?
NIST SP 800-88, Guidelines for Media Sanitization, is a NIST publication widely used as the reference for sanitization policies. It describes clear, purge and destroy categories. Revision 2, published in September 2025, replaced the 2014 version and focuses more on running an organization-wide sanitization program.
Is formatting a hard drive enough to erase data?
No. Formatting or deleting files typically removes only the references to data, leaving the data itself recoverable with common tools. Use approved sanitization methods matched to the media type, verify the result, or send the drive for certified destruction. Record the outcome by drive serial number.
How are SSDs sanitized?
SSDs are commonly sanitized with manufacturer-supported sanitize commands, cryptographic erase or physical destruction. Traditional overwriting may not reach every storage area because of wear leveling and spare blocks. Confirm your tool supports the specific drive model and produces a verification report.
Do printers need to be sanitized?
Often, yes. Many printers and MFPs store scanned, copied and printed documents on internal drives or flash memory. Wipe or remove that storage before lease return, resale or disposal, following the manufacturer’s procedure and your policy, and document the result with the device and drive serials.
What is a certificate of destruction?
A certificate of destruction is a document from a destruction provider confirming that specific media was destroyed, including serial numbers, method, date and location. Ask for serial-level certificates rather than batch totals, and reconcile them against the drive list your technicians recorded on site.
Can onsite IT support services destroy drives?
Some providers coordinate destruction, but most onsite IT support services remove drives, log them by serial, seal them and hand them to a certified destruction vendor. Confirm how your provider handles custody, documentation and exceptions before the first refresh or closure.
Planning a refresh, closure or cleanup of retired hardware across several offices? Book a free 30-minute IT support audit to review your drive handling process and onsite coverage.
