ITAD: The Term and What It Covers
IT Asset Disposition (ITAD) is the formal industry term for the end-of-life management of information technology equipment. "Disposition" implies a structured process of deciding what happens to each asset, rather than simply "recycling everything."
A complete ITAD program answers four questions for every asset:
1. What data is on it, and how will that data be irrevocably destroyed?
2. Does the asset have remaining economic value?
3. What are the regulatory requirements for this asset's disposal?
4. What documentation proves all of the above were handled correctly?
ITAD emerged as a formal discipline in the 2000s as IT departments realized that the combination of data security risk, regulatory requirements, and environmental liability from retired hardware required a more structured approach than dropping old computers at a community collection event.
ITAD vs. E-Waste Recycling: The Important Distinction
E-waste recycling focuses on the environmental dimension: ensuring electronics containing hazardous materials are processed through certified facilities rather than landfilled. A recycler accepts electronics, processes them for material recovery, and provides a recycling certificate.
ITAD encompasses recycling but adds:
- Data security: Certified sanitization of every storage device with serial-number documentation
- Asset tracking: Per-device inventory from pickup through final disposition
- Remarketing: Recovering residual value from equipment with remaining market life
- Compliance documentation: The full package that satisfies auditors
The practical distinction: A small business disposing of five laptops for environmental reasons can use e-waste recycling. A healthcare provider disposing of workstations that processed patient data, under HIPAA audit obligations, needs ITAD.
Most Orange County businesses with any sensitive data — client records, employee PII, financial data, healthcare information — need ITAD.
The Business Risk That Created ITAD as an Industry
2008: Oklahoma Department of Human Services. Used hard drives sold on eBay. Data on more than 1 million individuals recovered by purchaser. Drives had been "formatted" but not sanitized.
2010: CBS News investigation. Investigators purchased 40 used photocopiers. Found: complete medical records, police security records, domestic violence records, small business personal records — all from copier hard drives that weren't wiped.
2015: Health Net. Server drives disposed of through a moving company went missing. 1.9 million records potentially exposed. California settlement: $250,000.
These incidents — and thousands of less public ones — created the demand for ITAD with documentation at every step.
The ITAD Value Chain
1. Asset Inventory
Every device catalogued: make, model, serial number, asset tag, data sensitivity classification.
2. Data Destruction
Every storage device handled per NIST 800-88:
- Clear: Logical overwrite; for low-sensitivity internal redeployment
- Purge: Multi-pass overwrite, ATA Secure Erase, cryptographic erase; for external transfer or disposal of most business data
- Destroy: Physical shredding; for highest-sensitivity data or failed drives
Every device receives a certificate with serial number, method, standard, operator, and date.
3. Grading and Remarketing
Functional equipment in good condition is assessed for remaining market value. At scale — a 200-device enterprise refresh — remarketing value can meaningfully offset ITAD program costs. All remarketed devices must have certified wiped storage before transfer.
4. Certified Recycling
Equipment below remarketing threshold goes to certified downstream recycling through DTSC-authorized California facilities.
5. Reporting
Final documentation package:
- Final asset manifest (every device with serial number and disposition status)
- Certificates of data destruction (per device)
- Recycling certificates
- Summary report for management or compliance filing
ITAD vs. E-Waste: The Comparison
| | E-Waste Recycling | ITAD |
|---|---|---|
| Data destruction | Optional / basic | Core requirement |
| Documentation | Basic receipt | Full chain of custody |
| Asset tracking | Usually none | Per-device tracking |
| Compliance focus | Environmental | Environmental + data security |
| Typical client | Residents, small biz | Businesses, enterprises |
What to Ask an ITAD Provider
"Do you provide serial-number-level certificates of data destruction?" Correct answer: Yes. Any other answer means the documentation won't hold up in an audit.
"What NIST 800-88 level do you apply?" Correct answer: Purge for functioning drives, Destroy for failed drives.
"Are you DTSC-authorized?" Correct answer: Yes, we process through DTSC-authorized downstream facilities.
"What is your policy for drives failing post-wipe verification?" Correct answer: Escalated to physical destruction. This confirms they actually do verification.
"How long do you retain records?" Correct answer: Minimum 3 years; best practice 7 years.
