Certificate of data destruction: what it must contain
A certificate of data destruction is the record that a specific storage device was sanitized or destroyed. It is only useful if it names each device by serial number and states the method, the verification result, the date and who did the work. A certificate that covers “one lot of drives” proves very little.
What the certificate is for
When an auditor, customer or regulator asks what happened to the data on a retired device, the certificate is your answer. It moves the question from “we believe it was wiped” to a dated record tied to one serial number.
The same document may be called a certificate of sanitization, a certificate of erasure or a certificate of destruction. The name matters less than the detail in it.
The details NIST calls for
NIST SP 800-88 describes what a sanitization record should capture for each piece of media. In practice that includes:
- Manufacturer, model and serial number of the media
- The media type, such as hard disk, SSD, phone or tape
- The outcome applied: Clear, Purge or Destroy
- The specific method and the tool used, including its version
- How the result was verified
- Who performed the sanitization and the verification, with date and location
What makes a certificate weak
- No serial numbers, or only a count such as “40 hard drives”
- A method described as “wiped” or “destroyed” with no standard named
- No verification result
- The computer's serial number but not the drive inside it
- Nothing that ties the certificate back to the pickup, such as a manifest or reference number
Drive serial and host serial
A laptop has its own serial number and so does the drive inside it. Your asset register usually tracks the laptop. The data lives on the drive. A complete certificate lists both and pairs them, so that the record matches your inventory and still proves what happened to the storage.
How long to keep it
Keep certificates with your asset disposal records for as long as your own retention policy requires. Organizations covered by HIPAA commonly keep them for at least six years, which is the retention period the rule sets for required documentation. Ask your compliance lead which period applies to you.
Questions to ask a vendor before pickup
- Will every drive be listed by serial number, including drives inside computers?
- Which NIST SP 800-88 outcome will be used for each media type?
- What happens to a drive that fails verification?
- Can I see a sample certificate before I sign?
Related
This guide is general information, not legal advice. More resources.