Independent supplier discoveryUS & UK launch markets / Evidence updated 2 Oct 2026
criticalsupply.Infrastructure starts here

Decommissioning · Reviewed 29 August 2026

Make every retired asset traceable.

A neutral requirement and evidence framework for data-centre decommissioning and IT asset disposition: define the baseline, rollback, media treatment, custody, downstream route and close-out before removal starts.

Browse decommissioning suppliers

Requirement basis

Plan the evidence before the equipment moves

NCSC guidance treats decommissioning as a lifecycle activity that begins with asset discovery, dependencies and a workable recovery plan. Build the buyer's baseline first so a removal count or certificate can be reconciled to the systems, media and obligations that actually left service.

Input 1

Asset baseline

Create a reconciled list of equipment, media, software, data, dependencies, ownership, location and current service. Include unknown or shared assets that could be missed by a rack-only survey.
Input 2

Service continuity

State migration dependencies, replacement acceptance, backup and archive needs, rollback conditions, maintenance window, change control and the checks required before any irreversible step.
Input 3

Data and media

Classify the information and each media type, then assign the approved sanitisation or destruction method, verification evidence, exception route and accountable decision owner.
Input 4

Custody and access

Define who may identify, disconnect, pack, hold, transport and receive each asset. Set secure holding, transfer records, discrepancy handling and escalation for sensitive or valuable equipment.
Input 5

Outcome and downstream route

Assign each item to redeploy, return, resale, donation, parts recovery, recycling or destruction. Name every downstream facility and the evidence required before the route changes.
Input 6

Acceptance and reconciliation

Set the asset-match tolerance, sanitisation record, weight or quantity evidence, value statement, downstream certificate, exception close-out and inventory update needed for final sign-off.

Evidence matrix

Assign each record to an accountable owner

Evidence set

Controlled scope

Minimum comparison record

Approved asset register, dependency map, photographs where appropriate, ownership and removal boundary

Accountable input

Owner, operator and project lead

Evidence set

Continuity and rollback

Minimum comparison record

Migration acceptance, backup and archive record, rollback test, outage plan and irreversible-action hold point

Accountable input

Service owner and change authority

Evidence set

Data disposition

Minimum comparison record

Media inventory, classification, selected method, tool or process result, verification and exception record

Accountable input

Security and data owner

Evidence set

Physical custody

Minimum comparison record

Named handlers, access approvals, seal or container identifiers, timed transfers, receiving checks and discrepancies

Accountable input

Supplier and site security

Evidence set

Material and value route

Minimum comparison record

Reuse test, destination, permits or certification where applicable, downstream records, resale statement and residual treatment

Accountable input

Supplier and environmental lead

Evidence set

Close-out

Minimum comparison record

Input-to-output reconciliation, certificates, exceptions, inventory updates, lessons and retained evidence index

Accountable input

Project owner and assurance

Assurance routes

Use each source for the claim it supports

Media and custody

Match treatment to the risk and outcome

NIST and NCSC frame sanitisation as a risk-based programme, not a universal pass phrase. Record the information sensitivity, media, intended reuse or disposal outcome, selected method, result, verification and exception. NCSC also calls for secure holding and proportionate transfer tracking when assets are sensitive or valuable.
Downstream route

Check the facility and the evidence boundary

EPA recommends certified electronics recyclers for unwanted business electronics, while current UK Environment Agency guidance identifies approval, permitting, reuse-testing and downstream records within the WEEE route. Verify the specific site, service scope, material route and jurisdiction; a logo or certificate alone does not settle package-specific compliance.

Offer comparison

Keep security, circularity and value on one record

01

Reconcile every asset

Compare how each bidder will prove that items found, removed, received and routed are the same population, including discrepancies and late discoveries.
02

Separate claims from evidence

A destruction certificate, sanitisation log, recycler certification and downstream record answer different questions. Require the evidence set attached to each outcome.
03

Keep reuse and risk together

Compare data risk, functional testing, repair, transport, resale channel, residual waste, value sharing and failed-reuse handling—not headline recovery value alone.

Build the research set

Connect the package to the directory

Use the filtered records to identify organisations for further research, then issue the same controlled baseline and evidence matrix to every candidate. Directory inclusion is not proof of secure handling, legal compliance, downstream control, recovery value, capacity or availability.

Decommissioning & Circular IT suppliersOperations & Maintenance suppliers
Operate & MaintainUpgrade & Exit

Primary references

Sources used for this guide

UK National Cyber Security Centre — Decommissioning assets
Current guidance connects asset discovery, tested rollback, secure holding, proportionate transfer tracking, sanitisation evidence and inventory updates across the decommissioning lifecycle.
UK National Cyber Security Centre — Secure sanitisation and disposal of storage media
Media handling should be selected against the sensitivity of the data and the intended outcome, with verification that the chosen process completed as required.
NIST — Guidelines for Media Sanitization
The September 2025 revision provides a current foundation for a risk-based media-sanitisation programme, applicable techniques, verification and disposal controls.
US Environmental Protection Agency — Certified Electronics Recyclers
EPA recommends certified recyclers for unwanted business electronics and explains what R2 and e-Stewards certification can evidence about environmental, worker-safety, security and downstream practices.
UK Environment Agency — WEEE reuse and treatment
Current guidance identifies approval, permitting, reuse-testing, downstream-control and record-keeping evidence relevant when reviewing a UK electronics treatment route.

Sources checked 29 August 2026. Requirements vary by information sensitivity, media, asset, intended outcome, material, market and contract; confirm the applicable security, data, environmental, safety and legal controls with the responsible specialists.