Old Hardware Is a Breach Waiting in a Storeroom: A Security Checklist for IT Equipment Disposal

Sponsored contribution by Laston Madson of Tornado Disposal, Waco, Texas. Edited by BlueRadius editorial; sources checked.

Every company has one. A storeroom, a closet, the corner of a warehouse, where the old laptops go when they are replaced, where the retired server sits because nobody is sure what is still on it, where the external drives from a project three years ago live in a box marked "keep." Nobody thinks of it as a security problem. It is one of the most common ones there is.

The hardware in that room holds the same data it held the day it was unplugged. Customer records, credentials, email archives, financial exports, source code. The difference is that nothing is watching it anymore. No endpoint agent, no access log, no backup policy. Just a door, and eventually, a decision to get rid of it.

How you make that decision is the whole game. Here is what the people who haul equipment for a living see go wrong, and the sequence that keeps a cleanout from becoming a breach.

The cost of getting disposal wrong is on the record

In 2022 the SEC fined Morgan Stanley $35 million over the way it decommissioned data center equipment. The firm had hired a moving company with no experience in data destruction to remove thousands of hard drives and servers, some of which were later sold on to third parties and turned up at auction still holding customer data (SEC press release, September 2022). The lesson was not that the drives were old. It was that the handoff had no controls.

Smaller organizations face the same rules at a smaller scale. The FTC Disposal Rule requires any business that holds consumer report information to dispose of it in a way that protects against unauthorized access, and names "destroying or erasing electronic media" as the standard (16 CFR Part 682). HIPAA's Security Rule requires covered entities to have policies for the final disposition of electronic protected health information and the hardware it lives on (HHS guidance). Neither rule cares whether the drive was in a server, a laptop, a copier or a desk drawer.

Step one: inventory before anything moves

Most disposal failures start with a list that does not exist. Before anyone touches the pile, record every device that can hold data: computers, servers, storage arrays, external drives, phones, tablets, network appliances with onboard storage, printers and copiers with internal drives, and the loose drives that were pulled out of something years ago. Capture the make, model, serial number and, where you can, the asset tag and who last used it.

This list becomes the backbone of everything that follows. It is what you check the destruction certificates against. It is what you show an auditor. It is what tells you, six months later, that the one drive you cannot account for was a decommissioned domain controller and not a spare.

Step two: sanitize to a standard, not to a feeling

"We formatted it" is not sanitization. Neither is deleting the files or pulling the drive and leaving it in a box. The reference that auditors and regulators recognize is NIST Special Publication 800-88, Guidelines for Media Sanitization, now in its second revision (NIST SP 800-88 Rev. 2, which superseded the 2014 edition in 2025). It sorts sanitization into three levels:

• Clear: overwriting with a software tool so the data cannot be recovered with ordinary utilities. Appropriate for drives that will be reused inside your own organization.
• Purge: methods such as a cryptographic erase or a manufacturer secure-erase command that defeat laboratory recovery. Appropriate when the drive is leaving your control intact.
• Destroy: shredding, disintegrating or degaussing (for magnetic media) so the drive cannot be used again. Appropriate when the data was sensitive or when the drive is failing and cannot be reliably overwritten.

Two practical points trip people up. Solid-state drives do not respond to the overwrite methods that worked on spinning disks; use the drive's own secure-erase or crypto-erase function, or destroy it. And anything that cannot be powered on cannot be wiped, which means a dead drive is a destroy case by default, not a "probably fine" case.

For most small and mid-sized companies the right answer is a certified destruction vendor for anything that held regulated or confidential data. Look for R2v3 or e-Stewards certification on the recycler and ask for a certificate of destruction that lists serial numbers. If you are shredding on site, get the serial list reconciled against your inventory before the shredder leaves.

Step three: chain of custody, written down

Between "it was in our building" and "it was destroyed" there is a gap, and that gap is where the Morgan Stanley drives disappeared. Close it with paper. Who removed the equipment, when, from where, and where it went next. If a vendor is wiping or shredding, their certificate closes the chain. If equipment is being transported before destruction, it should travel sealed, with the serial list, and the hauler should sign for it.

Keep the inventory, the sanitization record and the certificates together, for as long as your retention policy says. If a regulator or a customer ever asks what happened to the hardware that held their data, that folder is the answer.

Step four: the physical removal

This is the part people underestimate, and it is the part I see most often. Once the drives are wiped or pulled for destruction, you still have the carcasses: racks, chassis, monitors, cabling, UPS units with lead-acid batteries, CRTs from the back of the storage room, pallets of desktops, the furniture the equipment sat on. Moving that volume out of an office or a job site is a logistics job, and doing it badly creates its own risks: equipment left on a loading dock overnight, a dumpster that the wrong person goes through, batteries and CRTs that cannot legally go in the municipal stream.

Texas law requires computer and television manufacturers to offer recycling for their branded equipment (TCEQ). Those programs are aimed at consumers, so check whether your manufacturer accepts business volumes before counting on them. For everything else, a hauling partner that documents the pickup and routes material to recycling or donation is the practical option. That is the work we do at Tornado Disposal across Central Texas: cleanouts and bulk hauling for offices, job sites and businesses, loaded and removed in one visit, with recycling and donation wherever the material allows. We are not a data destruction company, and we tell clients that plainly. Our job starts after the drives are handled, and the handoff works best when the client has done steps one through three first.

A short checklist for the next cleanout

1. Inventory every device that can hold data, with serial numbers, before anything is moved.
2. Decide per device: reuse internally (clear), release intact (purge), or destroy. Default dead drives and anything with regulated data to destroy.
3. Use a certified destruction vendor and get certificates that list serials. Reconcile them to the inventory.
4. Document custody for every handoff: who, when, where to.
5. Only then schedule the hauling. Keep equipment inside and supervised until the truck is loaded.
6. File the inventory, the sanitization records and the certificates together and keep them per your retention policy.

None of this is expensive compared with the alternative, and most of it is a morning's work for a small company. The storeroom is only a problem while nobody owns it. Give it an owner, a list and a sequence, and it becomes one of the easier security controls you will ever close.

Sources

1. U.S. Securities and Exchange Commission, "Morgan Stanley Smith Barney Charged for Failing to Safeguard Customer Information," press release 2022-168, September 20, 2022.
2. Federal Trade Commission, Disposal of Consumer Report Information and Records, 16 CFR Part 682.
3. U.S. Department of Health and Human Services, HIPAA FAQ 575, disposal of protected health information.
4. NIST Special Publication 800-88 Revision 2, Guidelines for Media Sanitization, 2025.
5. Texas Commission on Environmental Quality, Electronics Recycling Programs.

Laston Madson is with Tornado Disposal, a junk removal and demolition company based in Waco, Texas. This is a sponsored contribution; BlueRadius editorial reviewed and edited it, and the views are the author's.