Surplus IT equipment: disposal, data sanitization, and records

Reference article · 5 min read

A refresh ends with a room full of equipment that is out of service but still agency property, and still full of agency data. Clearing the room is not one decision. It is a property action governed by surplus rules, a data security action governed by policy and sometimes by state or federal requirements, and a recordkeeping action touching the asset inventory, software licenses, and retention schedules.

What follows is the sequence most agencies work through. Authority, approvals, and disposal rules differ by agency and change over time, so confirm the details with your property office, your records officer, and your counsel.

Declaring property surplus

Equipment usually cannot be sold, given away, or discarded on a department's own authority. Most agencies require a formal declaration that the property is surplus, meaning no longer needed for any agency purpose, then approval at a level tied to value.

A surplus request listing each item with asset tag, serial number, description, and condition.
An internal offer period so other departments can claim equipment before it leaves the agency.
Approval authority resting with a property officer, the finance director, or the governing body above a set amount.
Grant-funded equipment conditions. Items bought with federal funds carry disposition requirements under the federal Uniform Guidance, including possible reimbursement of the federal share above a fair market value threshold. State grants often add their own terms.
Limits on employee purchases. Many agencies restrict sales to staff to avoid conflict of interest.

Choosing a disposition route

Transfer to another agency. Often simplest, and in some states it runs through a state surplus property program. No revenue, but no resale effort.
Auction or resale. Public auction, an online government auction platform, or consignment. Proceeds normally return to the fund that bought the equipment, and sales are typically as is.
Donation. Schools, nonprofits, and community programs, where statute or ordinance allows it. Confirm the authority first, and document the recipient and the public purpose.
Trade-in. Value applied against a replacement purchase. The credit has to be recorded correctly, and the vendor's sanitization practices still need review.
Recycling. For equipment with no useful life. Use a recycler whose downstream handling you can verify.

Sanitization comes first

Nothing leaves under any route until the data is gone. Deleting files and quick formatting remove the pointers to data, not the data. NIST Special Publication 800-88, Guidelines for Media Sanitization, is the reference most agency policies adopt. It describes three levels.

Clear. Overwriting user addressable storage through normal read and write commands. Reasonable for magnetic hard drives headed to a controlled destination.
Purge. Methods that defeat laboratory recovery, including a drive's built in sanitize commands and cryptographic erase.
Destroy. Shredding, disintegration, incineration, or melting, so the media cannot be reused and the data cannot be recovered.

Cryptographic erase applies to media that encrypted everything it ever stored, such as self encrypting drives and current phones. Destroying the key leaves unreadable ciphertext, but only if encryption was active from first use and every copy of the key is gone.

Solid state drives and flash media need separate handling, because wear leveling keeps some blocks out of reach of ordinary overwrites. Use the device's sanitize command, cryptographic erase, or destruction.

Where criminal justice information, federal tax information, protected health information, or student records were stored, policy may dictate both method and documentation. Many agencies simply destroy that media rather than defend a lesser method later.

Commonly overlooked: copiers with internal drives, including leased units returning to the lessor; switches, routers, and firewalls holding configurations and credentials; phones still enrolled in device management; and loose tapes, USB drives, and spare drives in a cabinet.

Certificates and chain of custody

A certificate of destruction, also called a certificate of sanitization, records what was sanitized or destroyed, by what method, on what date, and by whom. Ask for serial level detail rather than a weight ticket. Require one when regulated data was involved, when the work happens off site, or when a contract says so.

Handling in between matters too: locked storage, sealed containers, and signed manifests at pickup and receipt. On site destruction removes transport risk at higher cost.

Records, licenses, and inventory

Retention outlives the hardware. If the only copy of a record sits on a device being retired, migrate it first, and check for litigation holds before anything is wiped.
Licenses usually do not transfer. Volume and subscription licenses are generally agency property and non transferable. Remove agency licensed software, reimage from clean media, and reclaim the seats.
Close out the inventory. Retire the asset with date, method, and disposition, then remove the device from endpoint management, patching, monitoring, backup, and network access.
Post the financial entry. The fixed asset ledger needs a disposal entry, and proceeds have to be deposited according to policy.
Follow environmental rules. Batteries, displays, and other components fall under state electronic waste and hazardous waste requirements.

What to ask a disposal vendor

Which certifications do you hold, such as R2 or e-Stewards, and who are your downstream processors?
Is sanitization performed on site or off site, and what is the chain of custody in between?
What documentation comes back, in what format, and at what level of detail?
How is resale revenue shared, and what is the fee when equipment has no value?
Will you accept the agency's terms on liability, insurance, breach notification, and audit rights?

Start by inventorying the room: what is there, what data touched it, how it was funded, and whether it has resale value. That list drives the paperwork, the sanitization method, and the route. HQT provides technology advisory and systems engineering services to state and local agencies, including asset lifecycle and media sanitization procedures.

Frequently asked questions

Is a factory reset enough before we surplus a laptop or phone?

On a current phone or tablet, where storage was encrypted from first use, a factory reset performs a cryptographic erase and is generally accepted. On a laptop it depends on whether full disk encryption was active and whether the reset actually invokes the drive's sanitize command; reinstalling the operating system by itself is not a sanitization method. Apply the method your policy assigns to that media type, verify that it reported success, and record the serial number and method.

When does an agency need a certificate of destruction?

Require one whenever media that held regulated or sensitive data is sanitized or destroyed by someone outside the agency, whenever the work happens off site, and whenever a contract, grant, or security policy calls for it. The certificate should list serial numbers, the method used, the date, and the responsible firm or individual. Keep it with the asset record, because it is often the only evidence available during a later audit or incident review.

Can we transfer our software licenses with a computer we sell or donate?

Usually not. Volume, subscription, and enterprise agreement licenses are generally agency property and cannot be assigned to a buyer or a donee. Remove agency licensed software and reimage the machine from clean media before it leaves, then reclaim the seats in your license records so you stop counting retired devices.

What happens to equipment we bought with grant funds?

Equipment purchased with federal funds is subject to disposition requirements in the federal Uniform Guidance, which can include following the awarding agency's instructions and reimbursing the federal share when fair market value exceeds the threshold in the regulation. State and pass-through awards often add their own conditions in the grant agreement. Check the award terms and consult your grants office before declaring the property surplus.

Should we destroy drives in house or use a vendor?

Both approaches are used. In-house sanitization keeps media under agency control and avoids transport risk, but it requires equipment, trained staff, and a documented verification step. A certified vendor brings capacity and documentation and can destroy media on site if the contract requires it. Many agencies do both: handle anything holding regulated data internally, and send bulk lower-risk equipment to a vendor.