Certificate of destruction.
Document what happened to each retired device. Reconcile sanitization and destruction records with your asset register.
What is a certificate of destruction?
A certificate of destruction records the processing of specific data-bearing assets. It connects asset identifiers to the method, date and outcome of the work. The certificate is one part of the evidence to review alongside your inventory, custody records and verification results.
Review a sample before your project starts.
Ask CTS for a sample and confirm that its fields match your asset register and review requirements. Agree on the media-specific method, evidence of verification, delivery schedule and retention arrangements as part of the project scope.
Request a sample certificate →What to check in a destruction record.
Asset identity
Reconcile the media type, make, model and serial number with your asset register.
Method and technique
Record the sanitization method and technique selected for the media and the required assurance.
Date and location
Record when and where processing took place.
Accountability
Identify who performed and verified the work, with a witness when the project requires one.
Verification and exceptions
Record the outcome, including failed processing and any additional action taken.
Disposition and custody
Connect the record to the custody trail and the final reuse, recycling or destruction decision.
NIST's current media sanitization guidance is SP 800-88 Rev. 2, published in September 2025. It addresses choosing techniques and controls based on media and information sensitivity. Agree with CTS on the specific process and documentation for your project.
Evidence supports a review. It does not guarantee an outcome.
A certificate does not transfer all liability or guarantee that an auditor will accept a disposal process. Your security and compliance team should define the required controls and evidence before equipment is released. For healthcare-specific disposal guidance, consult HHS guidance on disposing of protected health information.