What is a certificate of destruction?
A certificate of destruction is the document a disposal or IT asset disposition (ITAD) vendor issues to prove that specific storage media or devices were destroyed. Handing drives to a vendor does not hand over responsibility for the data on them. If one of those drives later turns up for sale online, the organization has to show what happened to it, and the certificate is that evidence. It is also what auditors, regulators and customers ask to see when they check that a disposal policy is followed in practice.
What the certificate should contain
- A unique certificate number and the client's name or account.
- An itemized list of what was destroyed, by serial number and asset tag, or an attached serial list with a stated count.
- The media type of each item, such as HDD, SSD, tape or phone.
- The method, such as shredding to a stated particle size, disintegration, or degaussing followed by shredding, and the standard it follows, often NIST SP 800-88.
- The date, time and location, including whether destruction happened on site or at the vendor's facility.
- Names and signatures of the technicians and of any witness.
A certificate that says only "300 drives destroyed" proves very little. Without serial numbers, nobody can tell whether a particular drive was in the batch.
Example: reconciling a certificate
A hospital ships 120 drives to its vendor. The pickup manifest lists 120 serial numbers, and everyone who handled the sealed containers signed for them. Two weeks later the certificate arrives listing 118. The records analyst compares the lists, identifies the two missing serials and opens a possible-loss investigation before closing the disposal ticket. When every serial matches, the certificate number is recorded against each asset's inventory entry, which is marked as disposed rather than deleted.
Certificate of destruction vs. chain of custody
| Chain of custody | Certificate of destruction | |
|---|---|---|
| Proves | Who held the media, and when, on the way | That the media was destroyed, and how |
| Created | At every handoff, from pickup to the shredder | Once, after destruction |
| Signed by | Each person who takes custody | The vendor |
The two work together: custody records show nothing went missing in transit, and the certificate closes the trail. When media is wiped for reuse rather than destroyed, the equivalent record is usually called a certificate of sanitization; NIST SP 800-88 includes a sample form that records whether each item was cleared, purged or destroyed. Choosing a vendor with an independent certification, such as NAID AAA for data destruction, adds assurance that the process matches the paperwork.
Certificate of destruction on the CompTIA Security+ exam
Certificates of destruction belong to SY0-801 objective 4.2, which covers the asset life cycle through disposal and decommissioning. Wording such as "prove the drives were destroyed," "evidence for the auditor that the vendor shredded the media" or "documentation of final disposal" points to a certificate of destruction. The usual distractor is chain of custody, which tracks handling rather than the outcome. Others are the disposal policy, which says what should happen, and the vendor's contract or SLA, which only promises it. A certificate of destruction also appears in A+ Core 2 (220-1202) objective 2.9, as the proof an outside destruction or recycling vendor supplies.