Data Center Decommissioning Services: What's Included, What's Extra

Introduction

Data center decom services begin with a fundamental question: what does the vendor actually do, and what documentary proof will survive audit? The certificate of data destruction is the operator's primary documentary defense in a post-incident regulatory review. It is also, in our review of 35 vendor profiles, the document with the highest variance in what it actually means. When an organization engages data center decom services, the contract often treats physical asset removal and certified data destruction as a bundled offering—but the underlying capabilities are structurally different, and the failure modes are distinct.

In 2016, Morgan Stanley Smith Barney contracted with a moving and storage company to decommission two primary data centers in Poughkeepsie, NY and Columbus, OH. The engagement handled approximately 4,900 devices, some containing unencrypted customer PII and consumer report information. The moving company had no data destruction capability and was approved as a vendor without the use of a sub-vendor, yet it subcontracted to downstream processors that were never formally reviewed or approved by the customer. Hard drives that were supposed to be sanitized were sold at online auction with customer data intact. The cumulative regulatory and remediation cost exceeded $100M.

That case is the canonical reference for what happens when the vendor selection process does not verify the vendor's actual capability to perform the contracted service. In our editorial review of the operator landscape, the gap between what a contract says and what the vendor can actually execute is the most common structural failure in data center decommissioning services. The contract language, the RFP language, and the post-engagement documentation must all be designed to survive the question an auditor will ask: Who touched this asset, what did they do to it, and how do you know?

Data center decommissioning is not a one-time project—it is a recurring obligation with a documentary record that must hold up in audit. The operator's posture going into the engagement determines whether the resulting documentation is audit-defensible or whether it represents a latent compliance gap that will surface in the next regulatory review. This guide walks through what is included in a competent decommissioning engagement, what should be negotiated before the contract is signed, and what the documentary record must contain to survive discovery.

Prerequisites

Before engaging data center decom services, three upstream conditions determine whether the project will produce an audit-defensible record or a regulatory exposure. The first is a complete inventory — serialized, location-tagged, and classified by data-bearing status. The second is a written scope of work that names the destruction method, the chain-of-custody mechanism, and the documentary output. The third is vendor qualification that goes beyond certifications and confirms the operator has the technical capability to execute what the contract describes.

Inventory Completeness and Classification

The inventory is the control document. Every asset that leaves the data center must appear on a serialized list before any vendor sees the site. Data-bearing devices — servers, storage arrays, network appliances with persistent memory — require individual tracking. Non-data-bearing assets can be batched, but the distinction must be documented in the pre-engagement inventory, not retroactively.

The Morgan Stanley case demonstrated the failure mode: approximately 4,900 devices moved without a complete inventory, and the contractor delivered unwiped drives to an online auction. The SEC enforcement record describes devices that were never cataloged, never wiped, and never tracked through the downstream process. The regulatory cost exceeded $100M when the cumulative fines, remediation, and legal defense are totaled.

Vendor Qualification Beyond Certification

Certifications (R2v3, e-Stewards, NAID AAA) confirm that a vendor operates under an audited standard, but they do not confirm technical capability for a specific engagement. The qualification process must verify that the vendor has the equipment, the facility access, and the documented process to handle the asset types in your inventory.

The Morgan Stanley engagement contracted with a moving company that had no data destruction capability and subcontracted the work to an unapproved downstream processor. The contract described data destruction services, but the contractor had no technical means to perform them. The failure was structural: the RFP and vendor-selection process did not verify capability, only contractual representation.

Contract Language and Scope Definition

The contract must specify the destruction method (NIST 800-88 overwrite, degaussing, physical shredding), the chain-of-custody mechanism (serialized tracking, witness protocols, transport security), and the documentary output (certificates of destruction with device-level detail, audit logs, photographic or video evidence). Generic language — "secure disposal," "industry-standard methods" — does not survive audit.

The scope must also address subcontracting: if the primary vendor will use a downstream processor for any portion of the work, the contract must name the subcontractor, require approval, and extend the chain-of-custody and certification obligations to the downstream entity. In the Morgan Stanley case, the subcontractor was never approved, never audited, and operated outside the documented process. The regulatory review described this as a policies-and-procedures failure, not merely a vendor-performance failure.

For a deeper look at what the certificate itself must contain to satisfy regulatory and audit expectations, see Data Destruction Certificate: Key Elements and Auditor Expectations.

Pre-Engagement Risk Assessment

Before the vendor arrives on-site, the internal risk assessment must document the regulatory framework (GLBA, HIPAA, GDPR, SEC Regulation S-P), the data classification (PII, ePHI, consumer report information, proprietary data), and the retention and destruction obligations. This assessment drives the contract language, the vendor qualification criteria, and the acceptance criteria for the final deliverables.

The assessment must also identify the business units and legal entities that will rely on the destruction record. In a multi-entity organization, the certificate of destruction may need to satisfy auditors in multiple jurisdictions with different evidentiary standards. The vendor must understand these requirements before pricing the engagement, not after the work is complete.

What Do Data Center Decom Services Include?

Data center decom services are where the contract language meets the physical work. What follows is a step-by-step breakdown of the operator-grade process, structured to produce an audit-defensible record at each stage.

Step 1: Asset Discovery and Inventory

The inventory process separates data-bearing devices (servers, storage arrays, network appliances with configuration memory) from non-data-bearing infrastructure (power distribution units, cable management, empty racks). In the Morgan Stanley case, approximately 4,900 devices were handled, many non-data-bearing, but some containing unencrypted customer PII — and the failure to distinguish them in the chain of custody became the regulatory failure mode.

Step 2: Vendor Qualification and Subcontractor Approval

In the 2016 data center decommissioning engagement that became the regulatory case, the contracted moving company had no capability to provide data destruction services — it was strictly a logistics provider. The firm subcontracted to an IT asset processor, then that processor ceased involvement early in the engagement, and a second undisclosed subcontractor took over. The client had access to an inventory tracking database that showed the first processor was no longer providing services, but the contractual gap was never closed.

For ITAD services that include data destruction, the subcontractor approval process is the upstream control that prevents the downstream failure.

Step 3: Establish Chain of Custody from Removal to Destruction

Chain-of-custody documentation is the mechanism that links your inventory to the final destruction certificate. If the vendor's manifest shows 500 drives received but your inventory listed 520 drives shipped, the 20-unit gap is a documentary failure that the auditor will flag. If hard drives were moved in their cabinets rather than removed and tracked individually, as occurred in the Morgan Stanley decommissioning, the chain of custody is broken at the point of removal.

Step 4: Data Sanitization or Physical Destruction

The e-Stewards standard requires that all customer data be sanitized prior to departure from the processor's control, conforming at minimum to a published national standard for data security. For devices going to reuse, successful sanitization must be verified for 100% of physical memory locations. For devices going to destruction, verification includes photographic evidence or witnessed destruction with serial-level traceability.

Step 5: Certificate of Destruction Issuance and Validation

Certificates of Destruction were included in the Morgan Stanley contract to document the destruction of relevant devices, adding a layer of accountability. But when the inventory tracking database ceased operation early in the engagement and the subcontractor relationship changed without disclosure, the certificates no longer matched the physical reality. The documentary record collapsed, and the regulatory consequence followed.

For detailed guidance on what makes a certificate audit-defensible, see our breakdown of data destruction certificate components.

Step 6: Final Reconciliation and Audit Readiness

The reconciliation process is where gaps become visible. If your vendor cannot produce serialized certificates for every asset on your manifest, the failure is structural, not clerical. If the vendor's final report includes devices not on your original inventory, you have an upstream inventory control problem. Either way, the gap is your regulatory exposure.

Troubleshooting Common Issues

Data center decom services involve complex coordination across multiple vendors, asset types, and regulatory requirements. Even with a strong contract and qualified vendor, the process can surface failure modes that require immediate corrective action. The following troubleshooting scenarios address the most common issues that emerge during decommissioning engagements.

Vendor Changes Subcontractors Mid-Engagement

The primary vendor stops using the approved data destruction subcontractor without notifying you. You discover this when certificates of data destruction stop arriving, or when the chain-of-custody documentation references a facility you've never approved.

What happens: In the Morgan Stanley case, the moving company ceased working with the approved IT asset disposition vendor early in the engagement. The inventory tracking database went dark, and certificates of destruction stopped being issued. Morgan Stanley had access to the tracking system and could see the stoppage, but the internal escalation process failed. Approximately 4,900 devices were processed through an unapproved subcontractor, and unwiped drives containing customer PII eventually appeared at an online auction.

How to address it: Immediately halt all asset movement until you can verify the full downstream chain. Demand a written explanation of why the subcontractor changed, who the replacement is, and what their certifications are. If the replacement is not R2v3 or e-Stewards certified, or if they lack NAID AAA certification for data destruction, you are now in a non-compliant posture. Require serialized inventory reconciliation for every asset that moved through the unapproved channel. If any asset touched regulated data (ePHI, CUI, PII under state breach-notification law), assume breach notification timelines are now active and escalate to legal and compliance immediately.

Certificates Arrive But Don't Match the Inventory

You receive certificates of data destruction, but the serial numbers listed don't align with the assets you sent. Or the certificate lists batch counts ("450 hard drives") rather than serialized device identifiers.

What happens: Batch certificates are not audit-defensible for regulated data. HIPAA, GLBA, and state breach-notification laws expect serialized tracking. If an auditor or regulator asks to see proof that a specific device containing ePHI was destroyed, and your certificate lists only a batch count, you have no documentary defense.

How to address it: Reject the certificate and demand a corrected version with serialized asset identifiers that match your outbound inventory. Cross-reference the certificate against the chain-of-custody manifest from the day the assets left your facility. If the vendor cannot produce serialized certificates, they are not performing to the contract standard. Escalate to the vendor's account executive and copy your internal legal contact. If the vendor refuses to reissue serialized certificates, you are now in a position where you must either halt the engagement or accept audit exposure. For a detailed breakdown of what certificates must contain to survive audit, see our guide on data destruction certificate components and auditor focus.

Physical Destruction Vendor Has No R2 or e-Stewards Certification

You specified R2v3 or e-Stewards certification in the RFP, but during the engagement you discover the physical destruction subcontractor is not certified. The primary vendor is certified, but the shredding facility they use is not.

What happens: The certification gap creates downstream accountability risk. If the shredding facility resells metal to a smelter that exports to a non-OECD country, and that material ends up in a non-compliant processing stream, your organization is now exposed under the EPA's enforcement posture on e-waste exports. The R2v3 and e-Stewards standards require certified downstream processors; if your vendor's subcontractor is not certified, the chain is broken.

How to address it: Require the vendor to provide the shredding facility's R2v3 or e-Stewards certificate, or switch to a certified facility. If the vendor resists, the contract language controls. If your RFP and contract specified R2v3 certification for all downstream processors, the vendor is in breach. Demand a corrective action plan with a timeline, and require written confirmation that all future asset movements will use certified facilities only. If the vendor cannot comply, terminate the engagement and re-bid to a vendor with a fully certified downstream chain.

Asset Tracking System Goes Offline Mid-Engagement

The vendor's web-based asset tracking portal stops updating, or you lose access to the system entirely. You cannot see where your assets are in the processing pipeline.

What happens: Loss of visibility into asset location and status is a contract breach if the agreement specified real-time tracking. More importantly, if an incident occurs—assets are lost, stolen, or resold without data destruction—you have no documentary record to show regulators that you maintained oversight.

How to address it: Immediately contact the vendor and demand restoration of access. If the system is down due to a technical failure, require a written status report every 24 hours until access is restored. If the vendor cannot restore access within 48 hours, halt all asset movement and demand a full inventory reconciliation using an offline method (spreadsheet export, manual manifest). If the vendor cannot produce an inventory, you are now in a position where you do not know where your assets are. Escalate to the vendor's executive team and your internal legal contact. If the vendor cannot demonstrate asset location and custody within 72 hours, assume a loss event and begin breach-notification analysis.

Hard Drives Moved in Cabinets Instead of Individually

You specified that hard drives must be removed from server chassis and transported individually, but you discover the vendor moved entire racks with drives in place.

What happens: This is the failure mode that occurred in the Morgan Stanley case. Hard drives were transported in their cabinets and sold to a downstream purchaser with drives still present. The purchaser resold the drives at an online auction, and unwiped drives containing customer PII ended up in the hands of an IT consultant in Oklahoma. The SEC's enforcement order specifically cited the failure to remove drives from cabinets as a policy violation that contributed to the breach.

How to address it: Stop the engagement immediately. Demand a full accounting of which assets were moved in cabinets and where they are now. If any of those assets are already resold, you are now in a breach scenario. Require the vendor to retrieve the assets if possible, or provide documentation showing they were destroyed. If the vendor cannot retrieve the assets or prove destruction, assume the data is exposed and begin breach-notification analysis. For future engagements, specify in the contract that drives must be removed from chassis before transport, and require photographic or video documentation of the removal process at the pickup location.

Conclusion

The contract you sign with a data center decom services vendor is only as defensible as the controls you can verify after the trucks leave. In three decades of reviewing vendor engagements, the pattern is consistent: the operator who negotiates chain-of-custody documentation, serialized asset tracking, and certified data destruction upfront is the operator whose regulatory review stays quiet. The operator who accepts a bundled price and generic assurances is the operator who discovers, eighteen months later, that their drives were resold with data intact.

The Morgan Stanley case remains the canonical reference because it demonstrates every failure mode in sequence. A moving company was contracted to decommission two data centers. No qualified data destruction vendor was formally approved. Subcontractors were used without review. Inventory tracking ceased mid-engagement. Approximately 4,900 devices left the facility, including 53 RAID arrays containing unencrypted customer PII, and the documentary record could not account for their disposition. The cumulative cost exceeded $100 million, and the regulatory finding was unambiguous: the policies and procedures were not reasonably designed to ensure qualified vendors were used or that subvendors were reviewed and approved.

Your decommissioning engagement should answer the question the auditor will ask: where is every serialized asset, who touched it, what destruction method was applied, and what certificate supports that claim? If the vendor cannot produce that record on demand, the engagement is not audit-defensible. The cheapest bid is the one whose paper trail you trust enough to hand the regulator without flinching. Negotiate for that upfront, or pay for it later in discovery.

For a detailed breakdown of what makes a data destruction certificate audit-defensible, see our guide on Data Destruction Certificate: Key Elements and Auditor Expectations.

FAQ

What is included in data center decom services?Data center decom services typically include physical asset removal, serialized inventory tracking, chain-of-custody documentation, data destruction (via NIST 800-88 overwrite, degaussing, or physical shredding), and issuance of certificates of destruction. The scope must specify whether the vendor performs the data destruction in-house or subcontracts it, and whether the certificate lists assets individually or in batch.

How do I verify a vendor can actually perform data center decom services?Verify that the vendor holds R2v3, e-Stewards, or NAID AAA certification, then confirm they have the equipment and facility to handle your asset types. Request references from clients with similar regulatory requirements (HIPAA, GLBA, GDPR). Review sample certificates of destruction to confirm they list serialized assets, not batch counts. If the vendor will use subcontractors, require disclosure and proof of downstream certifications before signing the contract.

What should a data destruction certificate contain?An audit-defensible certificate lists every asset by serial number, the destruction method applied (overwrite standard, degaussing strength, shredding particle size), the date and location of destruction, and the identity of the processor. Batch certificates ("500 drives destroyed") do not satisfy regulatory expectations for data-bearing devices under HIPAA, GLBA, or state breach-notification laws.

What happens if the vendor changes subcontractors without approval?Any subcontractor change without written approval is a contract breach and a chain-of-custody failure. If assets moved through an unapproved processor, you cannot verify data destruction occurred. Halt the engagement, demand serialized reconciliation of every asset that touched the unapproved processor, and escalate to legal if any device held regulated data. The Morgan Stanley case demonstrates the regulatory consequence: $100M+ in fines and remediation when subcontractors changed without disclosure.

Can data center decom services handle devices with unencrypted data?Yes, but the contract must specify the destruction method and verification process. For devices with unencrypted PII, ePHI, or consumer report information, require NIST 800-88 compliant overwrite with 100% verification, or physical destruction with photographic evidence. Generic contract language ("secure disposal") does not satisfy regulatory expectations. The destruction method must match the data classification and your breach-notification obligations.