Data Center Construction: Building a New Data Center and Retiring Old

Introduction

Building a new data center is a capital event. The budget, the timeline, and the technical architecture all get executive attention. The old data center — the one being retired — gets far less scrutiny, and that asymmetry is where the regulatory exposure sits. In our editorial review of vendor profiles and enforcement records, the pattern is consistent: operators focus on the new facility's uptime and the old facility's equipment disposal becomes a procurement afterthought.

The mechanics of decommissioning determine whether the organization has an audit-defensible record or a documentary void. When MSSB retired two primary data centers in 2016, the operator handed approximately 4,900 devices to a moving company, many containing unencrypted customer information. The subcontractor arrangement — moving company to IT reseller to secondary purchaser — introduced multiple chain-of-custody breaks. MSSB did not monitor the asset database, did not verify data destruction for resold devices, and did not retain certificates of destruction for a separate facility decommissioned the same year. The cumulative regulatory cost exceeded $100 million, and the failure mode was structural: the contract said one thing, the execution did another, and no one at the operator verified the gap in real time.

That case is the canonical reference because it names the specific failure points. RAID arrays transported with drives in place, contrary to the operator's own policy. Devices resold without certificates of destruction. No serialized tracking for what left the facility or where it went downstream. The new data center came online on schedule — the old one left a documentary record that could not survive regulatory review. For organizations planning a similar transition, the question is not whether to engage an ITAD vendor but whether the vendor's verified practices and the operator's internal controls together produce a decommissioning process that holds up in audit.

The following sections describe the structural requirements: what documentation must exist before the first asset leaves the old facility, what contract language survives subcontractor arrangements, and what the auditor will ask for when the timeline is no longer theoretical.

Problem Statement

Building a new data center means the old one has to go somewhere. That transition creates a documentary problem most operators underestimate until they are explaining it to a regulator. The equipment in the retiring facility contains customer data, configuration state, and in many cases unencrypted personally identifiable information across thousands of devices. The question is not whether you can move it all — the question is whether you can prove, three years later, that you moved it correctly.

In the 2016 decommissioning of Morgan Stanley Smith Barney's Poughkeepsie and Columbus data centers, the firm moved approximately 4,900 devices through a subcontractor arrangement that left no audit trail for a material portion of the inventory. The operator had policies in place — RAID arrays were not supposed to travel with drives intact, and certificates of destruction were required for data-bearing devices — but the contract structure and the oversight posture meant those policies did not survive the handoff. When devices containing unencrypted customer PII were later discovered in public resale channels, the firm had no certificates of destruction, no resale documentation, and in the case of the New York City data center decommissioned the same year, no records sufficient to identify what had been removed at all.

The Morgan Stanley case demonstrates three structural failure modes. First, the contract allowed the moving company to subcontract asset disposition without requiring the operator's direct visibility into the downstream processor's work. Second, the operator did not monitor the inventory database it had access to, which would have shown devices being resold rather than destroyed. Third, the operator's own policies — specifically the rule against transporting RAID array drives in their assembled shelves — were disregarded during transport, and the firm had no mechanism in place to detect that deviation in real time.

The complexity is not in the technology. RAID arrays stripe data across multiple drives, and reassembling those drives in the correct order makes the data accessible again. The firm's policies acknowledged this risk and specified that drives from a single array must not travel together, or if they do, must travel under secure transport. The failure was in the contract language and the oversight structure, which allowed a subcontractor to move entire shelves intact and then resell them without triggering any internal alert.

For operators planning a new data center build, this is the reference case. The cost of the decommissioning failure — measured in regulatory penalties, remediation, and reputational damage — exceeded $100 million in cumulative impact. The cost of the oversight mechanism that would have prevented it is a fraction of that figure. The trade-off is not whether you can afford the audit trail. The trade-off is whether you can afford to explain its absence when the equipment shows up at auction with your customer data still on it.

When evaluating your transition plan, the question to ask is not whether your vendor is certified. The question is whether the contract requires serialized chain-of-custody documentation, whether you retain the right to audit the downstream processor, and whether the certificate of destruction you receive at the end will identify every data-bearing device by serial number. If the answer to any of those questions is no, you are running the Morgan Stanley playbook, and the outcome is already documented.

Solution Steps for Transitioning

The transition from an old data center to a new one requires a documented process that survives audit. What follows is a sequential framework for managing equipment retirement during new construction, structured around the controls that hold up in regulatory review.

Step 1: Inventory Before Anything Moves

The inventory must include:

• Serial numbers for all storage devices (hard drives, RAID arrays, backup tapes)
• Asset tags and location codes
• Data classification labels (customer PII, ePHI, financial records, or non-data-bearing)
• Encryption status for each storage device

This step is not optional. If you cannot identify what left the building, you cannot prove what happened to it.

Step 2: Select Vendors with Verified Credentials

When evaluating vendors, confirm:

• Current certification status (not expired, not suspended)
• Scope of certification (does it cover data destruction and resale, or only one?)
• Downstream vendor qualifications if any work is subcontracted
• Insurance coverage adequate to the asset value and data risk

For enterprise IT teams managing large-scale transitions, data center decommissioning services vary significantly in what's included in the base scope versus what's billed as an extra.

Step 3: Document Transport and Chain-of-Custody

Chain-of-custody documentation must capture:

• Date and time of removal from the old facility
• Transport method and vehicle identification
• Receiving facility and authorized personnel
• Interim storage location if applicable
• Serialized asset list matching the baseline inventory

Step 4: Verify Data Sanitization with Method-Specific Evidence

Acceptable sanitization methods per R2v3 Core 7:

• Physical destruction: Shredding, crushing, or disintegration rendering the device non-functional
• Enhanced sanitization: NIST 800-88 compliant overwrite followed by physical destruction of the storage medium

The certificate must come from the entity that performed the work, not from a broker or logistics coordinator.

Step 5: Reconcile the Inventory Against Final Disposition Records

The reconciliation produces a final report documenting:

• Total devices processed by category
• Sanitization method and certificate reference for each serial number
• Resale disposition and wiping records where applicable
• Any devices returned to the organization or transferred to another facility
• Unaccounted devices with explanation and remediation steps

This report becomes part of the permanent record for the decommissioning project. In regulated industries, it may be subject to examination for years after the physical transition is complete.

Tips and Tricks for a Smooth Transition

The gap between what the contract says and what actually happens on the loading dock is where most data center transitions fail. In our review of documented enforcement cases, the recurring pattern is not that operators chose bad vendors — it is that they stopped watching after the contract was signed.

Maintain Direct Visibility Into the Destruction Process

The Morgan Stanley case turned on a simple fact: the firm had access to a vendor database that tracked every device through collection, wiping, and resale, but no one at the firm monitored it. When devices containing unencrypted customer data were resold with drives still in place, the first notification came from an external discovery, not an internal control.

Direct database access is not decoration. It is the mechanism that lets you confirm serialized chain-of-custody before the auditor asks for it. If your vendor does not offer it, that is a structural gap in your documentary defense.

Document Device Types and Data Protection Levels Before Collection Begins

In one documented case, the operator lacked sufficient records to identify the number or types of devices removed from a decommissioned data center. No certificates of destruction were retained. When regulators asked what had been processed, the answer was effectively "we do not know."

The underlying control here is not complex: catalog what you have before anyone touches it. Serial numbers, device types, and data classification status go into a spreadsheet that becomes the baseline for reconciliation. If a device held customer PII, mark it. If it held proprietary technical data under a different internal access policy, mark that too. Different data protection levels may require different sanitization methods, and the decision tree starts with accurate inventory.

Separate Transport and Destruction Responsibilities Where Risk Justifies It

RAID arrays present a specific structural risk: the controller stripes data across multiple drives, and reassembling a majority of those drives in the correct order can reconstruct the dataset. One firm's internal policies acknowledged this risk and required that drives from a single array not be transported together, or that secure transport methods be used. During the actual decommissioning, the contractor moved entire shelves with drives in place, then resold the shelves to a third party with drives still installed.

The failure mode was not that the policy was wrong — it was that no one verified compliance with it. When the contract allows resale of non-data-bearing devices, confirm in writing which devices qualify and how data-bearing components will be removed before resale. If your risk profile requires it, specify that drives be removed from enclosures before transport, and require photographic or video documentation of the removal process at the collection site.

For high-risk environments, consider splitting the engagement: one vendor for logistics and transport, a second vendor for destruction, with serialized handoff documentation at each stage. The added cost is the price of an audit-defensible paper trail.

Verify That Sanitization Methods Match Your Data Classification

NIST SP 800-88 (now at Revision 2, which supersedes the 2014 Revision 1) establishes that sanitization decisions must account for both organizational control and data protection level. A device that held engineering source code and a device that held customer PII may both be marked confidential, but the regulatory frameworks governing their destruction are different, and the sanitization method must match the higher standard.

If your vendor offers software-based overwrite for magnetic drives, confirm that the method is NIST-compliant and that the tool generates per-device reports. If the vendor uses physical destruction, confirm the method (shredding to a specified particle size, degaussing, or crushing) and verify that it is appropriate for the media type. Shingled Magnetic Recording (SMR) drives, for example, have documented incomplete-erasure failure modes with certain software methods, and the safer path for high-risk data is physical destruction.

For a detailed breakdown of destruction methods and when each is appropriate, see our guide to hard drive data destruction methods.

Retain All Documentation in a Centralized, Auditor-Ready Format

Certificates of destruction, transport logs, inventory reconciliation spreadsheets, and vendor correspondence all go into a single folder structure organized by decommissioning project and date. When a regulator or auditor asks what happened to a specific serial number, the answer should be retrievable in minutes, not weeks.

The documentary record is your primary defense in a post-incident review. If you cannot produce it, the regulatory presumption is that the control did not exist.

Conclusion

Building a new data center is an opportunity to get the retirement of the old one right. The Morgan Stanley case sits on the desk of every enterprise IT lead who has read it, and for good reason: the cost of getting decommissioning wrong exceeds the cost of the new facility in ways that don't show up in the capital plan. The mechanism is always the same — devices leave the building without a documented chain of custody, without verified destruction, and without anyone on the operator's side who can answer the auditor's question about what happened to the drives.

The contract language, the RFP language, and the documentary record are the three controls that survive discovery. If the vendor you retained subcontracted the work to a reseller who moved RAID shelves with drives still in place, and you have no record of what those devices contained, you own the exposure. The certificate of destruction is not a receipt — it is the operator's primary documentary defense in a post-incident regulatory review, and in our review of 35 vendor profiles, it is the document with the highest variance in what it actually means.

The operator's posture in a data center transition comes down to whether the team running the new build treated the old retirement as a compliance deliverable or as a logistics footnote. Enterprises that separate the two functions — capital construction on one side, ITAD on the other — consistently produce better outcomes than those that treat decommissioning as a facilities task. The question the auditor will ask is not whether you built the new data center on time. The question is whether you can produce serialized chain-of-custody records for every device that left the old one.

For enterprise IT leads managing a data center transition, the upstream process matters more than the downstream processor. The vendor you select is less important than the contract terms you negotiate, the inventory you produce before the first device leaves the floor, and the audit trail you can hand to your legal team without flinching. Operator-grade ITAD is not about finding the cheapest vendor — it is about selecting a vendor whose documentary controls you trust enough to defend in discovery.