How to Evaluate Data Center Decommissioning Companies

Introduction

The contract you sign with a data center decommissioning company is the primary documentary defense your organization will present to regulators if customer data surfaces in an unauthorized location. In our editorial review of 35 vendor profiles and multiple regulatory enforcement records, we have observed that the vendor selection process most enterprise IT teams run is not adequate to the risk. The failure mode is structural: organizations approve vendors based on capability representations that are not verified, then fail to confirm that the approved vendor is the entity actually performing the work.

The SEC's enforcement action against Morgan Stanley Smith Barney provides the canonical example. MSSB contracted with a moving company—an entity with no data destruction capability—to decommission two primary data centers containing thousands of devices with unencrypted customer information. The moving company subcontracted to an unapproved processor, then switched to a second unapproved processor mid-engagement without notification. MSSB did not obtain certificates of data destruction, did not maintain chain-of-custody documentation, and did not verify that the devices had been wiped. Nearly a year after project completion, an IT consultant in Oklahoma contacted MSSB to report that he had purchased hard drives containing the firm's customer data from an online auction site.

The regulatory findings in that case map directly to the evaluation criteria this guide addresses. MSSB's policies did not ensure that a qualified vendor was used. The firm did not review or approve subvendors. It did not follow its own requirements for documenting data destruction. It transported hard drives in their cabinets, contrary to internal policy, and sold drive shelves with the drives still in place. Each of these failures represents a decision point in the vendor evaluation process where the operator's posture should have been different.

For organizations managing multi-million-dollar decommissioning projects, the question is not whether the vendor can move equipment—it is whether the vendor's documentary controls will survive an auditor's review three years after the engagement closes. This guide provides a step-by-step framework for evaluating data center decommissioning companies against that standard, with specific attention to the mechanisms that fail most often in practice. For a detailed breakdown of what regulators expect from the destruction certificate itself, see our analysis of data destruction certificate components and auditor focus.

The evaluation process described in this guide assumes that your organization has already decided to decommission a data center and is now selecting the vendor who will perform the work. It does not address the upstream decision of whether to decommission, nor does it cover the technical process of data migration or application cutover. The focus is entirely on the vendor assessment: how to determine whether a decommissioning company has the controls, capabilities, and documentary practices needed to defend the engagement in a regulatory review.

Prerequisites

Before you begin evaluating decommissioning companies, you need three foundational elements in place. The first is internal clarity on what you're decommissioning and what regulatory obligations attach to it. The second is a documented understanding of what constitutes acceptable evidence that the work was performed to standard. The third is organizational alignment on who owns the vendor decision, who reviews the contract, and who monitors performance once the engagement begins.

Without these prerequisites, the evaluation process devolves into a price comparison exercise. That approach works fine for moving office furniture. It does not work when the devices being moved contain unencrypted customer PII, and the failure mode is a regulatory enforcement action rather than a missed delivery window.

Internal Asset Inventory and Risk Classification

You must catalog what is leaving your facility before any vendor sees the list. That catalog needs serial numbers, physical locations, and a binary classification: does this device contain, or did it ever contain, regulated data? If the answer is yes, or if you cannot confirm the answer is no, the device goes into the high-risk category.

The Morgan Stanley case turned on this exact failure. Devices that contained unencrypted customer information were treated as generic IT surplus because the internal inventory process did not classify them as data-bearing. When the moving company's undisclosed subcontractor sold those devices at auction without data destruction, the firm had no documentary record of what had been on them or where they had gone. The regulatory cost exceeded $100 million in cumulative settlements and remediation.

Documented Chain-of-Custody Requirements

You need written internal standards for what constitutes acceptable chain-of-custody documentation before you issue an RFP. At minimum, those standards should specify serialized asset tracking from the moment a device leaves your physical control until you receive a certificate of destruction or a resale receipt with a matching serial number.

The Morgan Stanley decommissioning contract required certificates of destruction for all data-bearing devices. Early in the engagement, the approved vendor stopped working with the subcontractor that provided those certificates. No certificates were issued for the remainder of the project. The firm's internal monitoring process did not flag the absence of certificates as a contract breach, because the monitoring process was not designed to verify that certificates were being delivered.

For a detailed breakdown of what belongs in a destruction certificate and what auditors expect to see, refer to our guide on data destruction certificate components and auditor focus.

Vendor Approval Authority and Contract Review Process

Before you evaluate any vendor, confirm in writing who has authority to approve the vendor, who reviews the contract for compliance with internal policy, and who is responsible for monitoring performance once the work begins. In large organizations, these roles often sit in different departments. When the roles are undefined, the vendor selection process defaults to whoever initiated the RFP, and the contract review defaults to whoever has time to read it.

The FTC Disposal Rule requires due diligence when engaging a third party to dispose of consumer information. That due diligence includes reviewing the disposal company's operations, obtaining references, and verifying that the company is certified by a recognized third party. The rule does not specify which internal role performs that due diligence, but it does require that someone perform it and that the organization can demonstrate it was performed.

Understanding of Subcontractor Risk

You must understand, before you evaluate any vendor, that the vendor you approve may not be the entity that performs the work. Subcontracting is standard in large decommissioning engagements. The risk is not that subcontracting occurs; the risk is that it occurs without your knowledge, without your approval, and without the subcontractor meeting the same standards you applied to the primary vendor.

In the Morgan Stanley case, the approved vendor was a moving company with no data destruction capability. The vendor's initial subcontractor was vetted by the firm and provided serialized asset tracking and destruction certificates. Early in the engagement, the moving company replaced that subcontractor with a different entity that had never been vetted, never been approved, and never provided destruction certificates. The firm was not notified of the substitution. The new subcontractor sold the devices at auction with data intact.

Your contract must require the vendor to disclose all subcontractors, obtain your written approval before engaging them, and provide the same chain-of-custody documentation for subcontracted work that you require from the primary vendor. If the contract is silent on subcontracting, the vendor has no obligation to tell you who is handling your assets.

Step-by-Step Guide to Evaluating Data Center Decommissioning Companies

The vendor selection process most enterprise IT teams run is not adequate to the risk. In our review of vendor profiles and regulatory enforcement records, the gap between what a vendor says they do and what their documented controls actually prove is the single largest failure mode in large decommissioning projects. The following framework gives you an operator-grade evaluation process that survives audit.

Step 1: Verify Core Capability Before Bidding

The documentary record starts here. If a vendor's proposal includes phrases like "working with our partners" or "leveraging our network," ask for the names of those partners and their certifications. If the vendor resists, that resistance is the answer.

Step 2: Map Subcontractor Relationships and Approval Process

In the Morgan Stanley decommissioning, the approved vendor stopped working with the disclosed subcontractor early in the engagement and began working with a second, undisclosed entity. The firm had no visibility into the substitution because its policies did not require subcontractor approval or chain-of-custody tracking at the entity level. That gap is what the auditor will ask about.

The cheapest vendor is the one whose paper trail you trust enough to hand the auditor without flinching.

Step 3: Define Chain-of-Custody Documentation Requirements

The Morgan Stanley case turned on missing CODs and broken chain-of-custody. The firm's policies required CODs, but the vendor stopped providing them partway through the project. The firm had access to an inventory database early in the engagement, but when the vendor switched subcontractors, that access disappeared. The firm did not notice — or did not act — until a consultant in Oklahoma emailed to say he had purchased hard drives at auction with customer data still intact.

For guidance on what makes a certificate audit-defensible, see our breakdown in Data Destruction Certificate: Key Elements and Auditor Expectations.

Step 4: Assess Data Destruction Methods and Standards Compliance

The vendor's answer here tells you whether they understand the technical work or whether they are reading from a compliance checklist. An operator-grade vendor will describe the failure modes — what happens when a drive reports a successful wipe but retains data in remapped sectors, what happens when a RAID array is disassembled before erasure and the configuration data survives.

Step 5: Evaluate Risk Classification and Policy Alignment

The Morgan Stanley case identified a policy failure: the firm's decommissioning policies did not classify projects by risk level, and therefore did not trigger heightened scrutiny for engagements involving unencrypted customer data. The SEC's order stated that "all decommissioning projects should have been catalogued as high risk" given the sensitivity of the data and the lack of encryption. The firm's policies, however, did not make that distinction.

If your vendor's proposal does not acknowledge the risk level, they are not thinking about the regulatory exposure.

Step 6: Conduct On-Site Facility Inspection

A facility visit answers the question that no proposal can: does this vendor actually do the work they are describing, or are they a front office that farms it out? In our review of vendor profiles, the operators with the strongest documentary controls are the ones who welcome facility audits and treat them as a selling point. The operators who resist or delay are the ones whose paper trail does not match their pitch.

Step 7: Review Insurance and Indemnification Terms

In the Morgan Stanley case, the firm's contract with the moving company did not include data-breach indemnification language, and the moving company's insurance did not cover the regulatory penalties or the remediation costs. The firm bore the full cost.

Step 8: Test the Vendor's Incident Response and Notification Process

The Morgan Stanley breach was discovered not by the vendor or by the firm's internal controls, but by an external consultant who purchased hard drives at auction and emailed the firm. The discovery happened nearly a year after the decommissioning was complete. That delay — and the lack of any vendor-initiated notification — is the failure mode that turns a containable incident into a regulatory case study.

Step 9: Define Performance Metrics and Audit Rights

Audit rights are meaningless if you do not exercise them. In the Morgan Stanley case, the firm had access to an inventory database early in the engagement, but when that access disappeared, the firm did not escalate. The contract gave the firm the right to audit; the firm's internal process did not require anyone to use it.

Troubleshooting Common Issues

The vendor evaluation process surfaces failure modes that most enterprise IT teams do not see until after the contract is signed. These are not edge cases — they are documented, recurring patterns in regulatory enforcement records and post-incident reviews. The question is not whether these issues will emerge, but whether your evaluation framework catches them before they become your problem.

Undisclosed Subcontracting and Vendor Substitution

The most common failure mode is the vendor you evaluated is not the vendor who performs the work. In the Morgan Stanley case, the approved vendor was a moving company with no data destruction capability. The moving company subcontracted to an IT asset disposition firm, which was never vetted or approved. That subcontractor then ceased work mid-project and was replaced by a second unapproved subcontractor — and the enterprise did not know until devices appeared for sale online with customer data intact.

The fix is contractual and procedural. Require the vendor to disclose all subcontractors in writing before work begins. Require that every subcontractor meet the same certification and insurance thresholds as the prime vendor. Require that any change in subcontractor triggers a contract amendment and a new approval cycle. If the vendor resists, that resistance is diagnostic — it tells you the vendor does not control the downstream process.

Missing or Incomplete Chain-of-Custody Documentation

The second recurring issue is the gap between what the contract requires and what the vendor delivers. The contract specifies serialized tracking, certificates of data destruction for every device, and audit-defensible chain-of-custody records. The vendor delivers batch-level summaries, unsigned certificates, and no proof that the devices listed on the certificate are the devices that left your facility.

In the Morgan Stanley decommissioning, the enterprise had access to a tracking database during the early phase of the project. When the subcontractor changed, the database access disappeared. No certificates of destruction were issued for the devices processed after that point. The enterprise did not escalate the missing documentation until devices appeared for sale — nearly a year after the project closed.

The troubleshooting step is to define the documentary record you need before the RFP goes out. Specify the format, the required fields, the signature authority, and the delivery timeline for certificates of destruction. Specify that payment is contingent on receipt of compliant documentation. Then enforce it — if Week 2 of the project delivers incomplete records, stop the project in Week 3 until the gap closes. Waiting until the end of a 4,900-device decommissioning to discover the vendor cannot produce the required paperwork is not a troubleshooting failure; it is an oversight failure.

Inadequate Risk Classification and Policy Gaps

The third issue is structural: the enterprise's own policies do not classify data center decommissioning as a high-risk activity. The devices contain unencrypted customer data, the project involves physical transfer of custody to an external party, and the regulatory exposure is measurable in the tens of millions of dollars. But the internal approval process treats it as a facilities move, not a data governance event.

The Morgan Stanley enforcement order identified this explicitly: the enterprise failed to adopt written policies that recognized the high level of risk associated with decommissioning unencrypted devices. The policies did not require review and approval of subvendors. The policies did not ensure that a qualified vendor — one with actual data destruction capability — was selected in the first place.

The troubleshooting step is to audit your own internal policies before you evaluate any vendor. Does your vendor approval process require certification verification for ITAD work? Does it require that subcontractors be vetted and approved before they touch your assets? Does it require that certificates of destruction be reviewed and archived as part of project closeout? If the answers are no, the vendor evaluation process will not save you — the structural gap is upstream of vendor selection.

Non-Competitive Bidding and Single-Source Auctions

The fourth issue is procurement mechanics. In one documented case, the decommissioning vendor attempted to sell hard drives to a downstream processor in an auction with no other bidders. The downstream processor had data destruction capability but was never asked to perform those services — the assumption was that the devices had already been wiped. They had not been.

This is a failure of process transparency. If the vendor is auctioning your assets, you need to know who the buyers are, what their capabilities are, and what happens to the devices after the sale. If the vendor cannot or will not provide that information, the vendor does not control the downstream chain — and you have no documentary defense if those devices reappear with data intact.

The fix is to require full downstream disclosure in the RFP. Specify that the vendor must identify all buyers, all processors, and all final disposition methods before the sale occurs. Require that every downstream entity meet the same certification standards as the prime vendor. If the vendor's business model depends on selling devices into an opaque secondary market, that model is incompatible with regulatory chain-of-custody requirements — and you should know that during evaluation, not during discovery.

Devices Sold with Data Still Intact

The final failure mode is the one that triggers regulatory enforcement: devices sold or discarded with customer data still readable. In the Morgan Stanley case, hard drives were transported in their cabinets, sold to a downstream buyer with drives still in place, and resold again to an IT consultant in Oklahoma who contacted the enterprise to report that he had access to unencrypted customer data.

This is not a single-point failure. It is a chain of failures: the vendor did not perform the contracted data destruction, the enterprise did not verify that destruction occurred, the enterprise did not maintain serialized chain-of-custody records, and the enterprise did not discover the failure until a third party reported it. The cumulative cost exceeded $100 million in fines, remediation, and reputational damage.

The troubleshooting step is to verify destruction before devices leave your control — or verify that the vendor's destruction process is audit-defensible and that you will receive serialized certificates for every device. If the vendor cannot provide that level of documentation, or if the vendor's process depends on downstream buyers performing destruction that the vendor does not directly control, the risk is unacceptable for any project involving customer data.

For a detailed breakdown of what makes a certificate of destruction audit-defensible, see Data Destruction Certificate: Key Elements and Auditor Expectations.

Conclusion

The documented failure modes in large-scale decommissioning projects share a common structure: undisclosed subcontracting, inadequate chain-of-custody documentation, and a contractual posture that does not survive audit. The Morgan Stanley case is instructive not because it is unique, but because it made public what regulatory reviewers see routinely in post-incident examinations — vendors approved for capabilities they did not possess, subcontractors substituted without notice, and certificates of destruction issued for processes that never occurred.

In our editorial review of vendor profiles and the documentary record from enforcement actions, the operator's posture that holds up in audit is built on three structural controls: verified vendor capability before contract execution, serialized chain-of-custody tracking from asset tag to certificate, and contractual language that prohibits undisclosed downstream processing. The RFP language, the contract terms, and the operational controls must align — what you specify, what you sign, and what the vendor executes must be the same process.

The cheapest bid is not the lowest-risk bid when the documentary gap exposes the enterprise to regulatory enforcement, breach notification costs, and reputational damage that exceeds the project savings by two orders of magnitude. The vendor selection process for large data center decommissioning projects is not a procurement efficiency exercise; it is a risk-transfer mechanism, and the transfer only works when the vendor's verified capabilities, contractual commitments, and operational controls are audit-defensible. For operators managing multi-site decommissioning engagements, the data destruction certificate components and auditor focus areas provide a reference framework for what the documentary record must contain to survive regulatory review.

The question the auditor will ask is not whether you hired a vendor — it is whether you verified the vendor's capability, monitored the process, and retained the documentary proof that the contractual obligations were met. If the answer to any of those questions is no, the vendor selection process was inadequate to the risk, and the enterprise owns the failure mode.