Data Center Decommissioning in Georgia: Local Compliance and Asset Recovery

Introduction

The certificate of data destruction is the operator's primary documentary defense in a post-incident regulatory review. It is also, in our review of vendor profiles across the Compare ITAD directory, the document with the highest variance in what it actually means. When an enterprise in Georgia plans to decommission a data center — whether owned infrastructure in Atlanta or leased colocation space in suburban Fulton County — the operator is making a decision about what documentary record will exist three years later when an auditor or regulator asks what happened to every serialized device that left the facility.

Data Center Decommissioning in Georgia follows the same regulatory framework that applies nationwide. SEC Regulation S-P, the FTC Disposal Rule, and FINRA's recordkeeping requirements do not recognize state boundaries. A broker-dealer decommissioning infrastructure in Columbus, Ohio faces identical chain-of-custody documentation standards as one decommissioning in Columbus, Georgia. The enforcement record makes this clear: Morgan Stanley Smith Barney's 2016 data center decommissioning involved facilities in Poughkeepsie and Columbus, and the resulting SEC order cited failures in vendor oversight, subcontractor approval, and certificate-of-destruction documentation that cost the firm over $100M in cumulative regulatory, remediation, and notification expenses.

For operators planning decommissioning projects in Georgia, the question is not whether compliance requirements apply — they do — but whether the operator's vendor selection process and contract language will produce the documentary record that survives audit. Asset recovery opportunities exist, but only when the data destruction process is defensible enough that resale does not create regulatory exposure. The trade-off is structural: an operator can recover value from decommissioned hardware or can avoid the cost of physical destruction, but not both, unless the data destruction method and its documentation meet the standard an auditor will actually accept. Understanding how to evaluate data center decommissioning companies based on their verified capabilities rather than marketing claims is the first step in building that defensible record.

The Georgia market includes both enterprise-owned data centers and colocation facilities operated by national providers. Decommissioning owned infrastructure gives the operator direct control over asset custody from rack to loading dock. Decommissioning colocation space introduces a handoff: the operator must document what left the colo provider's facility, in whose custody, and under what contractual data destruction obligation. Both scenarios require the same chain-of-custody rigor, but the colocation scenario adds a layer of coordination that increases the risk of documentation gaps.

In the sections that follow, we examine the specific challenges Georgia operators face during decommissioning, the procedural steps that produce audit-defensible outcomes, and the contract language and vendor verification practices that reduce the risk of the failure modes documented in the Morgan Stanley case and in our editorial review of industry decommissioning projects over the past decade.

The Challenges of Data Center Decommissioning

Data center decommissioning is not a logistics problem with a compliance layer on top. It is a compliance problem that happens to involve moving equipment. The failure modes are structural, and they repeat across jurisdictions because the underlying mechanisms — vendor qualification, chain of custody, downstream accountability — are the same whether the facility is in Georgia, Ohio, or New York.

The Vendor Qualification Gap

The canonical failure in this domain is the 2016 Morgan Stanley decommissioning of two primary data centers. The firm retained a moving company — literally a trucking and storage operator — as the approved vendor for IT asset disposition services. That moving company had no capability to perform data destruction, a fact Morgan Stanley's own risk assessment documented before the contract was signed. The moving company subcontracted to an IT disposition firm, but Morgan Stanley never formally approved the subcontractor, never reviewed its controls, and never verified that the subcontractor remained in the engagement when the arrangement changed mid-project.

The question the auditor will ask is not whether your vendor has a certificate on file. The question is whether your qualification process was adequate to the risk, and whether you verified that the approved vendor was the entity actually handling the equipment. In the Morgan Stanley matter, devices containing unencrypted customer information were collected by the moving company, transferred to a subcontractor's warehouse, and — in at least one documented instance — sold to a third-party purchaser with hard drives still installed in their enclosures. No certificates of destruction were issued for resold devices, and no chain-of-custody documentation survived to prove what happened to approximately 4,900 pieces of equipment.

The Chain-of-Custody Failure Mode

Morgan Stanley's written policies required removal of hard drives from enclosures before transport. The policy was not followed. Drives were moved in their cabinets, and the cabinets were sold with drives in place. The firm's policies also required certificates of destruction and documented chain of custody for all devices containing customer information. Neither was obtained. The contract contemplated an asset report, a disposition report, and CODs for destroyed devices. Morgan Stanley received none of these for the majority of the equipment.

This is the structural problem: the documentary record is the only thing that survives regulatory review, and the operator who signs the contract is rarely the operator who verifies the documentation. The project team assumes the vendor will deliver the required certificates. The vendor assumes the client will ask for them. The engagement closes, the invoice is paid, and eighteen months later the question arrives from a regulator or an auditor: prove the drives were destroyed.

The Asset Recovery Trade-Off

The Morgan Stanley contract contemplated resale of functional equipment, with 60–70 percent of resale proceeds returning to the firm. Resold devices were to be wiped and documented in an inventory database that Morgan Stanley could access directly. Early in the engagement, the subcontractor ceased providing database access and stopped issuing CODs. Morgan Stanley did not request the resale proceeds, did not monitor the database, and had no direct contact with the subcontractor during the decommissioning process.

This is the trade-off that enterprise IT teams rarely price correctly: asset recovery adds financial return, but it also adds downstream risk. Every device that is resold rather than destroyed is a device that must be tracked through an additional custody transfer, verified as wiped to a documented standard, and audited for compliance with the destruction policy. The operator's posture on resale — whether resale is permitted at all, under what conditions, with what documentation — is a risk decision, not a cost-optimization decision.

For organizations evaluating data center decommissioning companies, the lesson is that the cheapest bid is often the one with the thinnest documentary controls. The question is not what the vendor says it will do. The question is what evidence will exist, in your possession, if the engagement is reviewed three years later by a regulator who does not trust vendor self-reporting.

Steps for Effective Data Center Decommissioning in Georgia

The process of data center decommissioning in Georgia requires a documented, sequential approach that survives audit. The operator's posture at contract signing determines what happens when the project goes sideways — and in our review of enforcement records, projects go sideways when the chain of custody breaks or the vendor relationship isn't what the contract says it is. The following steps reflect what holds up under regulatory scrutiny.

Vendor Selection and Contract Structure

The Morgan Stanley case demonstrates what happens when contract terms and operational reality diverge. The firm contracted for one set of controls and received another — and the regulatory cost exceeded $100 million when all enforcement actions and remediation were totaled.

Asset Inventory and Data Classification

Execution and Oversight

The question the auditor will ask is not whether you hired a vendor — it is whether you can prove, with serialized records, that every device was sanitized or destroyed. If you cannot answer that question with a document, you have a problem.

Asset Recovery and Financial Reconciliation

For organizations operating in Georgia, understanding the full scope of data center decommissioning costs — including the audit-defensible documentation layer — is essential to realistic budgeting and risk management.

Tips and Tricks for Successful Decommissioning

The Morgan Stanley case demonstrated that the gap between policy and practice is where regulatory exposure lives. The firm had written procedures; what it lacked was operational discipline to enforce them. In data center decommissioning in Georgia or anywhere else, the following tactics reduce the distance between what the contract says and what actually happens on the loading dock.

Verify sub-vendor relationships before the engagement begins

Moving Company was approved as a vendor without sub-vendor oversight, and MSSB never formally reviewed IT Corp A or IT Corp B. When the primary contractor switched sub-vendors mid-engagement, no one at MSSB knew. Require your prime contractor to disclose all sub-vendors in writing, verify their certifications independently, and include contract language that prohibits substitution without your written approval. If the vendor cannot name the downstream processor before you sign, the engagement is not ready to begin.

Require serialized chain-of-custody documentation

MSSB's policies required Certificates of Destruction and asset tracking, but the firm did not obtain CODs for resold devices and did not monitor the inventory database IT Corp A maintained. Chain of custody must be serialized—each device tracked individually, not in batches—and the documentary record must survive the engagement. Request asset reports at pickup, disposition reports at completion, and CODs for every device containing data, whether destroyed or wiped. If the vendor cannot produce a serialized manifest matching your pre-decommissioning inventory, the chain is broken.

Audit the physical process, not just the contract

MSSB's contract specified that hard drives would be removed from shelves before transport, but witnesses confirmed the drives remained in their cabinets during the move and were sold to another purchaser still in place. Contract language is the floor, not the ceiling. Conduct site visits during the engagement—watch devices being loaded, verify that drives are removed from enclosures before they leave your facility, and confirm that the vendor's physical process matches the procedure you approved. What you do not observe, you cannot defend in a regulatory review.

Demand real-time access to tracking systems

IT Corp A provided MSSB with direct access to its inventory database, but no one at MSSB monitored it. When IT Corp A ceased providing services and the database went dark, MSSB had the information it needed to intervene—it simply did not look. Require read access to the vendor's tracking system and assign someone to review it weekly during the engagement. If CODs stop appearing, if disposition status stops updating, or if the database goes offline, you have early warning of a process failure rather than discovering it in a post-incident investigation.

For a detailed framework on evaluating vendor capabilities and certification posture, see How to Evaluate Data Center Decommissioning Companies.

Reconcile financial settlements to verify asset disposition

MSSB's contract entitled the firm to 60–70 percent of resale proceeds, but it does not appear MSSB ever requested or received the remainder of the resale amount from Moving Company. Financial reconciliation is not just revenue recovery—it is verification that the vendor actually processed the assets as claimed. If you are owed resale proceeds and the vendor cannot produce an accounting, the devices may not have been resold through the agreed channel. Reconcile expected payments against actual receipts, and treat unexplained variances as a signal to audit the physical disposition.

Conclusion

Data center decommissioning in Georgia is not a logistics problem with a compliance checklist attached. It is a compliance problem where the logistics must be defensible. The Morgan Stanley enforcement action, which resulted in over $100 million in cumulative costs, demonstrates what happens when the documentary record cannot support the operator's assertions about what happened to customer data. The question is not whether your vendor says they destroyed the drives. The question is what evidence you can hand an auditor three years later when they ask you to prove it.

The failure modes are structural. A moving company approved as a decommissioning vendor without sub-vendor oversight. Hard drives transported in their cabinets and resold with data intact. Certificates of destruction that were never delivered, or delivered for devices that were actually resold. A chain of custody that existed on paper but broke the moment the devices left the loading dock. These are not edge cases — they are the documented outcome when the contract, the vendor qualification process, and the ongoing oversight do not align with the actual risk.

Practical Takeaways for Georgia Operators

If you are decommissioning a data center in Georgia, the compliance requirement is the same whether you are in Atlanta, Augusta, or Columbus. You must be able to prove, with serialized records and signed certificates, that every device containing customer data was accounted for and destroyed in a manner consistent with your written policies. That means vendor qualification that goes beyond the RFP response, sub-vendor approval that is documented and enforceable, and chain-of-custody tracking that survives audit. It also means asset recovery strategies that do not conflict with data destruction obligations — resale is acceptable only when the wiping process is documented, verified, and covered by a certificate that specifies the method and the outcome.

The cost of getting this wrong is not just the fine. It is the cost of the breach notification, the regulatory examination, the customer litigation, and the reputational damage that follows when the headline reads that your firm lost control of unencrypted customer data during a data center move. The cost of getting it right is a qualified vendor, a defensible contract, and the discipline to enforce the terms when the project is underway. For a detailed breakdown of what decommissioning projects actually cost and where the budget should go, see our guide on Data Center Decommissioning Cost: A Realistic Breakdown.

In our editorial review of vendor profiles and regulatory enforcement records, the pattern is consistent. The operators who survive audit are the ones who treated the decommissioning contract as a compliance document, not a procurement formality. That is the standard that applies in Georgia, and it is the standard that will be tested if something goes wrong.