A decommissioning checklist that survives an audit

Decommissioning goes wrong in the same handful of places, almost every time. Not because it is technically hard — de-racking a server is not hard — but because the paperwork and the reconciliation are treated as an afterthought.

This is the checklist we run on every decommissioning and migration job. Use it as-is or adapt it; the sequence is what matters.

Before anything is touched

1. Full inventory with serial capture. Every asset recorded by serial, make, model and location before removal. This is the baseline the whole job reconciles against.
2. Media inventory as a separate list. Drives, tapes, SSDs and any removable media listed individually. Media is where audits go wrong, so it is tracked at drive level, not device level.
3. Sanitisation policy agreed in writing. Which method for which media class — cryptographic erase, degauss or physical destruction — and what evidence you will receive. NIST SP 800-88 gives you the vocabulary; the written agreement is what protects you.
4. High-risk items flagged. Licensed hardware, assets under finance agreement, anything with export controls, anything holding personal data. These get named owners.
5. Rollback position defined. For migrations: what happens if batch three fails at 04:00. Written down before the window opens.

During removal

1. Reconciliation at every handover point. Assets counted when they leave the rack, when they are packed, when they are loaded, when they arrive. A discrepancy found at the van is a conversation; found three weeks later, it is an incident.
2. ESD and transport standards. Anti-static packaging, shock and tilt indicators on sensitive equipment, and packing that survives being handled by people who have never seen the asset list.
3. Chain of custody signed at each transfer. Who had it, when, and what they did with it. This is the document your security team will ask for.

Evidence and closure

1. Per-drive sanitisation evidence. Serial, method, timestamp, operator, and a verification result. Batch certificates are weaker than per-drive records and auditors know it.
2. Certificates of destruction and recycling. Issued per batch with serial ranges, from the facility that actually performed the work.
3. Reconciliation report. What left, what arrived, what was destroyed, what is unaccounted for. If the last column is not zero, the job is not finished.
4. Facility reinstatement. Containment closed, cable routes cleared, penetrations sealed, floor tiles replaced. The vacated space should look untouched.

The one question that finds problems

Ask your provider this: *"If one drive went missing tomorrow, what document would tell us where it was last seen?"*

If the answer is a batch certificate, you do not have a chain of custody. If it is a signed transfer record with a timestamp and a name, you do.