Chain of custody is the documented, unbroken record of who handled each device — from pickup to final disposition. It’s the least glamorous part of IT asset disposition and the part auditors care about most, because it’s the only thing that turns “we destroyed the data” into “we can prove it, device by device.” When something goes wrong in ITAD, it almost always goes wrong at a gap in the chain.
What “chain of custody” actually means
Borrowed from evidence handling, chain of custody in ITAD is the continuous, timestamped trail showing who had each asset, when, and what happened to it — collection, transport, receipt, data destruction, and final outcome (resale or recycling). The key word is unbroken: there should be no moment where a device exists but isn’t accounted for in the record.
The unit that matters is the serial number. A chain of custody that tracks pallets or box counts isn’t good enough — if one drive goes missing from a pallet of fifty, a pallet-level record can’t tell you which one, or prove the other forty-nine were destroyed. Serial-level tracking can.
Why it’s the whole ballgame in ITAD
Every compliance regime that touches retired hardware — HIPAA, GLBA, PCI-DSS, SOX — ultimately asks the same question: where did that specific device go, and can you prove the data on it was destroyed?
- With a serial-level chain of custody, the answer is a record and a certificate for that exact serial.
- Without one, the answer is “we think it was in that batch,” which an auditor reads as a failure and a regulator reads as a reportable risk.
A retired drive that can’t be accounted for isn’t a closed disposal — it’s an open data-breach exposure. The chain of custody is what closes it.
Where chains break
Two failure modes account for most broken chains:
- Brokering. A “provider” who collects your gear and quietly subcontracts it to a third party you never vetted. The moment your drives leave for an unknown facility, the chain you were promised is broken — and the certification you were shown may not cover whoever actually has your data now. (This is why “certified operator, not a broker” is the first vendor-selection criterion.)
- Bulk handling. Recording a pallet or a weight instead of individual serials. It’s faster and cheaper, and it makes per-device proof impossible.
What a real chain of custody looks like
- It opens at pickup. Devices are inventoried and scanned by serial the moment they’re collected, not later at a warehouse.
- Transport is sealed. Tamper-evident seals and a dedicated vehicle, with armed transport for the highest-security loads.
- Every handoff is logged. Receipt, staging, destruction — each step reconciles against the serial manifest.
- It closes with a certificate per serial. The certificate of destruction ties the outcome back to the individual device.
- It’s run in-house. The fewer external handoffs, the fewer places the chain can break.
How CTS does it
CTS runs the full lifecycle in-house as an R2v3-certified operator, so the chain of custody is one continuous record rather than a series of handoffs between vendors. Every device is scanned by serial at pickup, tracked through sanitization or destruction, and tied to a certificate per serial number — the evidence an auditor, examiner, or customer security review actually wants.
See how CTS runs ITAD, the ITAD process explained, or talk to the team about a fleet that needs an airtight trail.