Colocation Decommissioning: When You're Leaving Someone Else's Data

Introduction

Colo decommissioning is the structured process of removing information technology equipment from a third-party data center when a lease ends, a migration completes, or a facility consolidation occurs. The process involves physical asset removal, data destruction, chain-of-custody documentation, and final disposition—each step carrying regulatory and operational risk that survives long after the last server leaves the cage.

In our editorial review of 35 vendor profiles and documented enforcement actions, the failure mode most operators underestimate is the gap between what the contract says and what the moving company actually does. When an enterprise exits a colocation facility, the IT assets leaving that building are the operator's responsibility until a certificate of destruction with serialized tracking says otherwise. The documentary record is the only defense that survives audit.

The 2016 Morgan Stanley data center decommissioning remains the canonical reference case. The firm contracted with a moving company to remove approximately 4,900 devices from two colocation facilities. The moving company introduced undisclosed subcontractors, ceased using the agreed inventory tracking system, and sold unwiped hard drives containing customer data at online auction. The cumulative cost exceeded $100 million when regulatory fines, legal settlements, and remediation expenses were tallied. For a detailed breakdown of what regulators expect in post-decommissioning documentation, see our guide on data destruction certificate components and auditor focus.

The Mechanism of Colo Decommissioning Risk

The risk in colo decommissioning is structural. The enterprise no longer controls physical access once assets leave the cage. The vendor's internal processes—inventory tracking, data wiping, subcontractor management—become the only controls between the operator and a data breach. When those controls fail, the enterprise learns about it from a consultant in Oklahoma who bought the drives on eBay, not from the vendor's project manager.

Regulators view colo decommissioning as a high-risk data lifecycle event. Devices removed from a data center often contain unencrypted customer information, and many operators transport entire storage arrays with drives still mounted in their enclosures. The SEC enforcement order against Morgan Stanley specifically cited the firm's failure to adopt written policies identifying decommissioning as high-risk, failure to document destruction of customer data, and failure to maintain chain of custody throughout the process.

This guide walks through the operator-grade process for colo decommissioning: the prerequisites that must be in place before any vendor touches an asset, the step-by-step procedures that create an audit-defensible record, and the troubleshooting patterns for the common failures that emerge when contract language meets operational reality.

Prerequisites

Before you start pulling equipment out of a colocation facility, the documentary record matters more than the physical work. In our review of enforcement actions, the operators who failed did so in the planning phase — they treated colo decommissioning as a logistics problem rather than a chain-of-custody problem.

Vendor Selection and Approval

The vendor you hire must be formally approved for data destruction services, not just moving and storage. In the 2016 Morgan Stanley case, the moving company contracted for the decommissioning engagement lacked the expertise to perform data destruction and was never approved for that scope. The result: approximately 4,900 IT assets moved through the chain with no certificates of data destruction and no inventory tracking after the first subcontractor dropped out.

Your vendor approval process must include:

Verification of certifications — R2v3, e-Stewards, or NAID AAA for data destruction, not general logistics credentials
Independent audit review — the FTC Disposal Rule explicitly calls for reviewing independent audits of the disposal company's operations
Reference checks — obtain credible references from operators who ran similar colo decommissioning projects, not generic client lists
Subcontractor disclosure — require written disclosure of any downstream processors before the engagement begins

If your vendor intends to use a subcontractor, that subcontractor must go through the same approval process. In the Morgan Stanley engagement, the moving company switched subcontractors mid-project without notice, and the replacement entity was never vetted or approved. The documentary gap that followed became the enforcement case.

Asset Inventory and Risk Classification

You cannot track what you have not counted. Before any vendor enters the colocation facility, catalog every asset by serial number, location, and data-bearing status. In the Morgan Stanley case, the lack of a maintained inventory tracking database after the first subcontractor exited meant the firm could not account for where devices went or whether data destruction occurred.

Your inventory must capture:

Serial numbers — individual device identifiers, not batch counts
Data-bearing classification — which devices held customer PII, consumer report information, or regulated data
Encryption status — which devices remained unencrypted and therefore required physical destruction or NIST 800-88 overwrite
Custody location — rack, cage, and physical position within the colocation facility

Risk classification drives the colo decommissioning method. Devices that contained unencrypted customer data or consumer report information must follow a higher standard than non-data-bearing equipment. The Morgan Stanley engagement failed this step: the firm's policies did not identify the decommissioning projects as high-risk despite the presence of unencrypted PII on many devices.

Contract Language and Chain-of-Custody Requirements

The contract with your colo decommissioning vendor must specify the documentary trail you expect at the end. Certificates of data destruction, serialized tracking, and custody handoffs are not vendor courtesies — they are contract deliverables. In the Morgan Stanley case, the contract outlined terms for inventory tracking and certificates, but the firm did not enforce those terms when the vendor's database access disappeared and certificates stopped arriving.

Your contract must include:

Certificate of data destruction (COD) for every data-bearing device — issued after destruction, not after transport
Chain-of-custody documentation — serialized tracking from the colocation cage to final disposition
Subcontractor approval clause — written notice and approval required before any downstream handoff
Audit access — your right to inspect the vendor's facility and records during and after the engagement

Without these clauses in the contract, you have no documentary defense when the auditor asks where the devices went. The question the auditor will ask is not whether you hired a vendor — it is whether you can prove what that vendor did with each serialized asset.

Due diligence includes reviewing an independent audit of the disposal company's operations and monitoring compliance with the contract throughout the engagement.

FTC Disposal Rule, 16 CFR 682

Internal Approval and Compliance Review

Colo decommissioning is not an IT-only decision. Before the project begins, route the plan through your compliance, legal, and information-security functions. In our editorial review of vendor profiles, the operators who document this approval step survive audit; the operators who treat it as a procurement formality do not.

Your internal approval process should confirm:

Regulatory obligations — which data-protection rules apply (SEC, FINRA, HIPAA, GDPR, FTC Disposal Rule)
Retention requirements — whether any data on the decommissioned devices must be preserved for litigation or regulatory hold
Insurance and indemnity coverage — whether your vendor's liability limits match the exposure
Notification timelines — what triggers a disclosure obligation if the chain of custody breaks

For a detailed breakdown of what must appear in the certificate of data destruction and what auditors focus on, see our guide to data destruction certificates and auditor expectations.

The approval record is part of the audit trail. If the colo decommissioning later becomes the subject of a regulatory inquiry, the documented internal sign-off demonstrates that the decision was deliberate and that the risks were assessed in advance.

Step-by-Step Guide to Colocation Decommissioning

An infographic illustrating the step-by-step guide to colo decommissioning when leaving someone else's data center.

The following sequence assumes you have completed the prerequisite work — asset inventory, contract review, and vendor selection. Each step has a clear documentary output. The question the auditor will ask is not whether you followed the contract, but whether you can prove what happened to each serialized asset.

Step 1

Establish chain-of-custody tracking

Before any vendor touches hardware, implement serialized tracking. Every server, storage array, network device, and tape must have a unique identifier logged in a database the operator controls. The vendor's inventory system is supplementary — your system is the source of truth. In the Morgan Stanley case, the firm lost visibility when the moving company stopped using the approved subcontractor's tracking database. The documentary record disappeared, and the firm could not account for thousands of devices.

Step 2

Verify vendor credentials and subcontractor approval

Confirm that your selected vendor holds current R2v3 or e-Stewards certification and that their facility is listed on the certifying body's public registry. If the vendor intends to use subcontractors for any portion of the work — transport, data destruction, downstream processing — those subcontractors must be named, vetted, and approved in writing before the engagement begins. The contract must specify that undisclosed subcontracting is a material breach. In the 2016 data center decommissioning, the moving company switched subcontractors mid-engagement without notice, and the replacement entity was never vetted.

Step 3

Remove data-bearing devices from enclosures

Hard drives, SSDs, and other data-bearing media must be removed from their chassis, racks, and shelves before transport. Moving storage arrays with drives in place creates two failure modes: the drives are not individually tracked, and they can be sold or transferred as part of the enclosure without data destruction. During one documented colo decommissioning, hard drive shelves were transported with drives still installed, then sold to a third party with the drives in place. The drives were later discovered at auction, unwiped.

Step 4

Obtain certificates of data destruction for every serialized asset

The certificate of data destruction is the operator's primary documentary defense in a post-incident regulatory review. Each certificate must list the device by serial number, describe the destruction method (NIST 800-88 overwrite, degaussing, physical shredding), and include the date and location of destruction. Batch certificates that cover multiple devices without serialized detail do not survive audit. In the enforcement record, the absence of certificates of destruction was cited as a direct violation of the firm's own policies and the FTC Disposal Rule. For a detailed breakdown of what auditors expect, see Data Destruction Certificate: Components & Auditor Focus.

Step 5

Reconcile inventory before final pickup

Before the vendor removes the last rack, reconcile your internal inventory database against the vendor's pickup manifest. Every serialized asset must have a corresponding line in the vendor's records. Discrepancies — missing serials, unaccounted devices, or items listed as picked up but not logged — must be resolved before the vendor leaves the facility. The colocation provider's access logs and security footage can corroborate pickup timing, but they do not replace serialized reconciliation.

Step 6

Verify data destruction completion and obtain final reporting

Within the contracted timeline, the vendor must provide final reporting that includes certificates of destruction for all data-bearing devices, disposition records for non-data-bearing assets, and a reconciliation report matching your original inventory. Review the certificates for completeness — missing serials, generic descriptions, or unsigned documents are red flags. If the vendor subcontracted any portion of the work, the certificates must identify the performing entity and their certification status.

The cheapest vendor is the one whose paper trail you trust enough to hand the auditor without flinching.

Internal evaluation framework

Common Missteps During Execution

Three patterns recur in failed colo decommissioning engagements. First, the operator assumes the vendor's inventory system is sufficient and does not maintain an independent record. When the vendor's system fails or the vendor substitutes subcontractors, the operator has no fallback. Second, the operator treats non-data-bearing devices — power supplies, chassis, cables — as low-risk and does not track them individually. Regulators do not accept that distinction; if a device was in a data center, it must be accounted for. Third, the operator accepts batch certificates or summary reports instead of serialized certificates. Batch documentation does not satisfy the FTC Disposal Rule's requirement for reasonable measures, and it does not hold up in discovery.

Troubleshooting Common Issues

A diagram showing common issues during decommissioning and their solutions.

The documented failure modes in colo decommissioning cluster around three mechanisms: vendor substitution without notice, loss of chain-of-custody documentation, and the gap between contracted scope and executed work. Each of these has a specific fix, and each fix requires operator discipline rather than vendor promises.

Vendor Substitutes a Downstream Processor Without Authorization

The primary vendor brings in a subcontractor not listed in your approved-vendor registry and does not notify you until after the move is complete — or you discover it months later when an auditor asks for the full chain.

What to do:

Verify that your contract explicitly prohibits undisclosed subcontracting and requires written pre-approval for any downstream processor.
Require the vendor to submit subcontractor credentials (R2v3, e-Stewards, NAID AAA) and insurance certificates before work begins.
If substitution has already occurred, demand documentary proof that the substitute processor maintained chain-of-custody and issued serialized certificates of data destruction. If that proof does not exist, treat the engagement as a control failure and escalate internally.
For future colo decommissioning engagements, include a contractual right to audit the vendor's processor relationships on 48 hours' notice.

Certificates of Data Destruction Are Missing or Incomplete

You complete the colo decommissioning, the vendor invoices you, and weeks later you realize you have no serialized certificates of destruction — or the certificates you received cover only a fraction of the asset count.

What to do:

Before final payment, reconcile the certificate inventory against your departure manifest. Every serialized asset that left the cage must appear on a destruction certificate with a matching serial number, destruction date, and method.
If certificates are missing, halt payment and demand them in writing with a defined deadline. The vendor's obligation to document destruction does not expire when the truck leaves the loading dock.
If the vendor cannot produce certificates, document the gap in writing and treat it as a reportable control deficiency. Depending on your regulatory posture, you may need to disclose the incident to your primary regulator or to affected data subjects.
For high-risk assets (those containing ePHI, cardholder data, or consumer report information), consider commissioning an independent forensic review to determine whether any devices entered secondary markets without sanitization.

The absence of a certificate is not a paperwork problem — it is evidence that you cannot demonstrate compliance with your data-disposition obligations. Auditors and regulators interpret missing certificates as presumptive failures unless you can provide an alternative documentary trail. For guidance on what proper certificates should contain, see our article on enterprise data destruction standards for corporate IT.

Inventory Tracking Stops Mid-Engagement

The vendor's tracking database goes dark halfway through the colo decommissioning, or access is revoked without explanation, and you lose real-time visibility into asset location and processing status.

What to do:

Immediately contact the vendor's project lead and demand restoration of database access. If access is not restored within 24 hours, halt all further asset transfers until visibility is re-established.
If the vendor cannot or will not restore access, assume the engagement has deviated from the contracted process and initiate your escalation protocol. This may include on-site inspection, third-party audit, or termination with cause.
Document the timeline of the access loss and any gaps in the chain-of-custody record. This documentation becomes part of your post-engagement audit file and may be required in regulatory review.
In parallel, review your contract to determine whether loss of tracking access constitutes a material breach. If it does, exercise your termination rights and engage a backup vendor to complete the work under full documentary control.

The Morgan Stanley case turned on exactly this failure mode: the IT asset processor's inventory-tracking database was no longer used early in the engagement, and certificates of destruction ceased being issued, but the colo decommissioning continued without those controls in place.

Hard Drives Are Transported Still Mounted in Enclosures

Your policy requires individual drive handling, but the vendor loads entire RAID shelves or storage arrays onto trucks with drives still seated, creating both a chain-of-custody gap and a physical-security risk.

What to do:

Stop the engagement immediately and require the vendor to return all devices to the cage for proper disassembly and serialized handling.
Revise your statement of work to specify that drives must be removed from enclosures at the point of origin and inventoried individually before transport. Include photographic documentation requirements for high-value or high-risk arrays.
If transport has already occurred with drives in place, demand proof that the receiving facility maintained physical security and that no drives were separated from their enclosures before sanitization. If that proof does not exist, treat the devices as potentially compromised.
For future colo decommissioning engagements, include contract language that makes drive-in-enclosure transport a material breach with immediate termination rights and liquidated damages.

This is not a theoretical risk. In the 2016 Morgan Stanley decommissioning, hard-drive shelves were moved with drives in place, and the downstream processor sold the shelves to another purchaser with drives still present, leading to unwiped devices entering the secondary market.

The Vendor Cannot Provide Chain-of-Custody Documentation After the Fact

Months after the colo decommissioning, an auditor or regulator requests full chain-of-custody records, and the vendor tells you those records were never created or have been purged under their retention policy.

What to do:

Document the vendor's statement in writing and obtain a signed attestation that no chain-of-custody records exist. This attestation becomes part of your audit file and shifts some (though not all) of the documentary burden to the vendor.
Assemble whatever alternative documentation you have: departure manifests, gate logs, transport invoices, and any email correspondence confirming asset counts and processing timelines. This will not satisfy the full chain-of-custody requirement, but it demonstrates that you attempted to maintain control.
Notify your internal audit and compliance teams immediately. Depending on your regulatory posture, you may need to file a voluntary disclosure with your primary regulator before the gap is discovered in examination.
For future engagements, specify in your contract that the vendor must retain chain-of-custody records for a minimum of seven years and must provide copies to you within 48 hours of any request.

The cheapest vendor is the one whose paper trail you trust enough to hand the auditor without flinching. If you cannot obtain that paper trail after the fact, the cost of the engagement is not the invoice — it is the cost of the regulatory response.

For a detailed breakdown of what auditors expect to see in destruction documentation, see Data Destruction Certificate: Key Elements and Auditor Expectations.

Conclusion

Colo decommissioning is not a logistics exercise with a compliance checkbox at the end. It is a documentary process where the operator's posture under regulatory review depends entirely on what survives audit. The Morgan Stanley case demonstrated that approximately 4,900 IT assets moved through a decommissioning engagement with no certificates of data destruction, no vetted subcontractor approval, and no chain-of-custody tracking — a failure mode that cost the firm more than $100 million in cumulative enforcement, remediation, and reputational damage. That outcome was not a technology failure. It was a procurement and oversight failure.

The step-by-step framework outlined in this guide — inventory before bidding, contract language that names the downstream processor, serialized chain-of-custody documentation, and final certificate verification — reflects the standard that regulators expect and the documentary record that holds up in post-incident review. Enterprise IT teams running colo decommissioning projects carry the same regulatory exposure as the data center operator who owned the facility. The contract does not transfer liability; it creates a shared obligation to document what happened to every serialized asset.

In our editorial review of vendor profiles and colo decommissioning engagements, the operators who run audit-defensible projects share a common posture: they treat the certificate of data destruction as the primary deliverable, not the logistics coordination. They verify subcontractor certifications before the first asset leaves the cage. They require serialized tracking, not batch manifests. And they confirm that the downstream processor named in the RFP is the processor named in the certificate — because that alignment is what the auditor will check first.

For enterprise IT leads planning a colocation exit, the data destruction certificate is the document that defines whether the colo decommissioning holds up under scrutiny. The vendor selection process, the contract language, and the chain-of-custody mechanics all serve that single outcome: a certificate you can hand the regulator without flinching. That is the standard. Anything less is a documented gap waiting for discovery.

FAQ

What is colo decommissioning?

Colo decommissioning is the structured process of removing IT equipment from a third-party data center, requiring documented chain of custody, verified data destruction, and final asset disposition to meet regulatory obligations.

Why is chain of custody critical in colo decommissioning?

Chain of custody provides the audit-defensible documentary record proving what happened to each serialized asset after it left the colocation facility. Without it, operators cannot demonstrate compliance if a data breach or regulatory inquiry occurs.

What certifications should colo decommissioning vendors hold?

Vendors performing data destruction must hold R2v3, e-Stewards, or NAID AAA certification. General logistics credentials do not qualify a vendor for data-bearing asset handling.

Can a vendor use subcontractors during colo decommissioning?

Subcontractors may be used only if they are disclosed in writing before the engagement, vetted through the same approval process as the primary vendor, and hold equivalent certifications. Undisclosed subcontracting is a material breach.

What should a certificate of data destruction include?

Each certificate must list the device by serial number, describe the destruction method (NIST 800-88 overwrite, degaussing, or physical shredding), and include the date, location, and performing entity. Batch certificates without serialized detail do not satisfy regulatory requirements.