ITAD Certifications: What R2v3, NAID AAA and e-Stewards Cover

Four things get quoted interchangeably in ITAD tenders: R2v3, NAID AAA, e-Stewards and NIST SP 800-88. Three of them are certifications, issued by a body that audits a facility and puts its name to the result. The fourth is not.

The three that are certifications audit different things, and none of them audits all of what a buyer disposing of data-bearing equipment needs assured. This guide covers what each one actually certifies, the assurance level R2v3 Appendix B reaches, and how to read a certificate rather than a badge.

Three certifications and one guideline

Taking them in the order they usually appear on a vendor's website:

• R2v3 — the Responsible Recycling Standard, administered by Sustainable Electronics Recycling International (SERI). Covers the full lifecycle of electronics reuse and recycling. The broadest of the three, and the one most often treated as the floor.
• NAID AAA — administered by i-SIGMA. Covers secure destruction, audited unannounced, with separate endorsements by media type and by service.
• e-Stewards — administered by the Basel Action Network. Covers the same recycling ground as R2v3 with materially stricter export controls.
• NIST SP 800-88 Rev. 2 — a federal guideline for media sanitization, published by NIST. Defines Clear, Purge and Destroy. Certifies nobody.

Why the distinction changes what you can ask for

A certified facility has been assessed by a third party against a published standard, and the certificate names a scope: which location, which activities. You can look the certificate up in the issuer's register and read what it covers. A vendor that follows NIST SP 800-88 has told you about its own procedure. Both statements can be true, but only one of them has somebody else's signature on it.

So when a vendor cites the guideline as though it were a credential — and the phrase “NIST 800-88 certified” is common in ITAD marketing — there are two questions worth asking back. Which revision, given that the unqualified form now names two documents that disagree. And what independent evidence exists that the procedure was followed on your assets, given that nobody audits the claim.

R2v3: certified to what, exactly

Core Requirements and the appendices

R2v3 is not a single credential. A facility is certified to the Core Requirements and then to whichever process appendices match the work it actually does. Appendix A covers the downstream recycling chain and applies to every certified facility. The rest are optional and specific.

Two R2v3-certified vendors can therefore have very different operational capabilities. The certificate says which appendices apply; the badge on the website does not. If you are disposing of storage media, the appendix you care about is Appendix B, data sanitization.

What Appendix B actually certifies to

This is the part most buyers get wrong, and it is worth stating precisely because the gap is not obvious from the standard's own summary language.

Appendix B(13) requires sampling sufficient to demonstrate that data is “not recoverable by commercial software”. SERI's own guidance places commercial software “at a level between basic visual inspection for data and forensic laboratory analysis”. That is the Clear threshold. Purge, in both NIST SP 800-88 Rev. 2 and IEEE 2883-2022, is defined against state-of-the-art laboratory techniques.

Appendix B(11)(a) scopes the requirement to user-addressable locations. On solid-state media that does not reach overprovisioned blocks, metadata, cache or unallocated NVM — and NIST SP 800-88 Rev. 2 §4.5.2 names exactly that gap as a validation red flag.

A facility without Appendix B

The absence is not what it looks like either. A facility without Appendix B is not necessarily unable to destroy data — under SERI's own guidance, basic physical destruction can be performed under Core Requirement 7, and sanitization can be outsourced to a qualified downstream vendor.

What the absence of Appendix B means is that the enhanced controls, traceability and record-keeping of that appendix do not apply. A buyer who needs them has to ask where the work is actually done, and by whom.

NAID AAA: destruction under unannounced audit

NAID AAA is the narrowest of the three and the most directly aimed at the question a data-bearing disposition actually asks. It certifies the destruction process itself — operator screening, chain of custody, the destruction step, the record produced — rather than the recycling chain around it.

Its distinguishing feature is that audits are unannounced. A certified operator does not get to prepare for the assessment, which makes the certificate a statement about ordinary practice rather than about a good day.

The scope question applies here too, in a different shape. NAID AAA endorsements are granted by media type and by service: paper is a different endorsement from hard drives, hard drives from solid-state media, plant-based destruction from mobile destruction at your site. A certificate covering one does not cover the rest. If your disposal includes drives, phones and the storage inside networking equipment, check that the endorsements list reaches all three.

e-Stewards: where the material ends up

e-Stewards covers similar ground to R2v3 and diverges on export. The Basel Action Network built the standard around preventing hazardous electronic waste reaching jurisdictions with weaker enforcement, and it applies tighter restrictions on export and more demanding downstream due diligence than R2v3 does.

For an organization with a sustainability mandate, or one that has been asked where its retired equipment physically ends up, that is the certification that answers the question. It includes data security provisions, but they are not what distinguishes it, and a buyer whose driver is data assurance still has to ask the assurance-level question separately. The two certifications are compared in more detail separately.

Put plainly: choosing between R2v3 and e-Stewards is a decision about environmental and export posture. It is not a decision about how thoroughly your drives get sanitized.

NIST SP 800-88, now at Revision 2

What changed, and why it matters to a contract

Revision 1, published December 2014, was withdrawn on 26 September 2025 and superseded in its entirety by Revision 2 (September 2025). The substantive change for buyers is the removal of verification language. Rev. 2 §4.5.1 states that elaborate sampling after a clear or purge “is not necessary” unless organizational policy requires it, and the Appendix D change log records that almost all verification language was removed.

The practical consequence is narrow and sharp. A contract clause requiring work “verified per NIST 800-88” was, under Rev. 1, pointing at a described step. Under Rev. 2 it points at a deferral to your own policy. Per-asset evidence is still worth requiring — it is the only thing that makes a disposition record testable — but it is now the buyer's requirement rather than NIST's, and it has to be asked for as one.

Clear, Purge and Destroy

The three methods are assurance levels, defined by the capability of the adversary each is meant to defeat, not by a technique or a pass count:

• Clear applies logical techniques through the medium's standard read and write commands, to user-addressable locations. It protects against simple, non-invasive recovery.
• Purge applies physical or logical techniques that render recovery infeasible using state-of-the-art laboratory techniques.
• Destroy renders the medium physically unusable, and recovery infeasible by any known method.

The choice follows from the confidentiality of the data and the destination of the medium — not from the drive model, and not from a fixed number of overwrite passes. Pass count was always the less interesting variable; whether the technique reaches the whole medium is the one that decides the outcome.

Certification scope and asset scope are two separate questions

The failure that produces most of the confusion in this area is treating one question as the answer to the other.

A certification answers: has this organization, at this location, been assessed by a third party against a published standard, and what did that assessment cover. It is a statement about a facility, historical as of the audit date.

A disposition asks: was this asset handled, at which facility, to which assurance level, and what record exists. It is a statement about your equipment, on a date you can name.

Neither resolves into the other. A vendor can hold current R2v3 and route your drives to a subcontractor whose location is not in scope. A facility can be in scope for Appendix B and still deliver a batch certificate that cannot be reconciled against your asset register. In a tender the two belong on separate lines, with a third for the assurance level, because a bidder who satisfies one has not thereby satisfied the others.

Reading a certification portfolio

Four checks do most of the work, and all four are things you can do before speaking to the vendor.

Where certification portfolios fail an audit

Certificate scope mismatch

The vendor is certified; the facility that handled your equipment is not, or the activity performed on it falls outside the appendices listed. This is the most common finding and the easiest to prevent, because the scope is printed on the certificate you did not read.

Treating the guideline as a credential

“NIST 800-88 certified” describes nothing that exists. NIST does not certify facilities, does not validate tools, and does not publish a list of approved sanitization software. A vendor using the phrase is either being loose or does not know the difference, and both are worth establishing before the engagement rather than after.

Factory reset recorded as sanitization

A factory reset is a convenience feature, not a sanitization method. It commonly leaves filesystem metadata, configuration partitions and wear-levelling reserves intact, and on networking equipment device configuration frequently survives one. The log it produces is not wrong about what it did; it is silent about what it could not reach.

Batch certificates against a serialized register

A certificate covering “47 hard drives” cannot be matched to an asset register listing 47 serial numbers. If the two cannot be reconciled, the register is the thing an auditor will test and the certificate is the thing that fails. What a defensible certificate contains is worth settling before the first collection, not after.

Undisclosed downstream subcontractors

Sanitization outsourced to a downstream vendor is permitted and often sensible. An undisclosed one is the problem, because it breaks the chain of custody at exactly the point the record needs to be continuous. A subcontractor is not a mark against a vendor; failing to name one is.

Frequently asked questions

Is there such a thing as NIST 800-88 certification?

No. NIST SP 800-88 is a guideline. There is no certifying body, no register, and no audit. A vendor can document that its procedures follow the guideline, and that documentation is worth reading, but it is the vendor's own account of its own practice. Independent assurance has to come from a certification that does have an auditor behind it, or from evidence you specified and received.

Does R2v3 certification mean my vendor performs a Purge?

No. Appendix B(13) certifies to the Clear threshold by its own stated assurance level — data not recoverable by commercial software. Purge is defined against state-of-the-art laboratory techniques. If you need Purge, specify it contractually as a separate requirement alongside the certification.

R2v3 or e-Stewards — which is better?

They answer different drivers rather than sitting on a scale. R2v3 is the wider baseline and the one more commonly required in procurement. e-Stewards is stricter on export and downstream environmental controls. Neither answers the sanitization assurance-level question on its own.

Does a vendor need both R2v3 and NAID AAA?

Not necessarily, and holding both is not automatically better than holding one with the right scope. What matters is whether the facility handling your media is covered for the activity performed on it. R2v3 with Appendix B at the processing location may fully answer your requirement; R2v3 without it, at a location that subcontracts sanitization to an undisclosed third party, does not — however many logos are on the website.

What does an unannounced audit add?

It changes what the certificate is evidence of. A scheduled audit tests whether the process can be performed correctly. An unannounced one tests whether it usually is. For destruction specifically — where the failure mode is a step skipped under time pressure rather than a procedure nobody wrote down — that is the more useful test.

The vendor's certificate doesn't list appendices. What now?

Ask, and check the issuer's register rather than accepting the answer. Where a register publishes the scope, it is authoritative. Where it does not, the honest position is that the scope is unread — which is different from, and should not be recorded as, no restrictions.

Which revision of 800-88 should my contract cite?

Revision 2, named explicitly. Anything drafted before September 2025 that says “NIST 800-88” without a revision number needs reopening, particularly any clause that used the standard as its authority for verification. Those clauses no longer have one.

Does certification cover the company or the facility?

The facility. This is the single most useful thing to internalise about all three certifications, because vendor marketing is written at the company level and certificates are issued at the location level. Ask which processing location does the work, and whether it is owned, leased or subcontracted.

Conclusion

The four names in this article are not four grades of the same thing. R2v3 audits a recycling operation and, through Appendix B, a sanitization process at the Clear threshold. NAID AAA audits destruction, unannounced, by media type. e-Stewards audits where the material goes. NIST SP 800-88 Rev. 2 audits nothing at all — it gives you the vocabulary to say what level of assurance you need.

Which makes the buyer's job a matter of asking three questions rather than collecting logos. Which facility does the work. What is that facility certified for, per the issuer's register rather than the vendor's website. And what assurance level is being applied to your assets, named explicitly and evidenced per asset, because as of Revision 2 the standard no longer asks for that evidence on your behalf. Vendor selection is the wider version of the same problem.

Related reading

R2v3 e-Stewards Comparison: Which ITAD Certification is Right for You?

R2v3 Certification Guide: ITAD Standards Explained (2026)

R2v3 Certification: The Ultimate Guide to Costs and Easy Verification

Data Disposition: Linking Information Lifecycle Management to ITAD