What a Certificate of Data Destruction Should Include

Most certificates of data destruction are a logo, a date, and a sentence saying the drives were destroyed. That document will not help you in an audit, and it will not help you after a breach.


A certificate is only worth something if it identifies specific devices, names the method used, and records who performed and verified the work. Here is what should be on it, and what to do if your provider's version comes up short.


What a certificate of data destruction is

It is the per-device record proving a specific storage device was sanitized or destroyed, by a specific method, on a specific date, by a specific person.


The federal standard for this is NIST Special Publication 800-88, Guidelines for Media Sanitization. NIST calls the document a Certificate of Sanitization, and provides a sample form organizations can model theirs on.


Important update: NIST SP 800-88 Rev. 1, the version most vendors and blog posts still cite, was withdrawn on September 26, 2025. It was superseded by Rev. 2, published the same day. The sample certificate moved from Appendix G to Appendix C and the fields changed. If a provider's materials still reference Rev. 1 as current, their documentation is a year behind.


The fields NIST's sample certificate records

From the sample form in Appendix C of NIST SP 800-88 Rev. 2:


Person performing the sanitization

Name, title, organization, location, phone, email.


Media information

Vendor or make, media type, model number, serial number, property number, source, classification, and whether the device was operational or damaged.


Sanitization details

Method (Clear, Purge, or Destroy), the specific technique used, the tools used including version number, verification and status, validation, and any notes.


Media destination and disposition

Where the device went: internal reuse, external reuse, recycling facility, manufacturer, or other, with details.


Signature

A signed attestation that the information is accurate, with a date, plus a concurrence section for the person verifying the work (name, title, organization, location, phone).


NIST also notes that organizations can record this electronically rather than on paper, and that electronic records are generally faster to search and more likely to be reliably retained if you need them later.


The four fields that separate a real certificate from a decorative one

1. Serial numbers

"47 hard drives destroyed" is not evidence. If you cannot tie the certificate to the specific devices that left your building, you cannot prove the drive in question was one of them.


2. The specific method

Clear, Purge, and Destroy are not interchangeable, and NIST treats them as distinct categories with different techniques behind each. "Securely destroyed" is marketing language. "Shredded" or "overwritten using [tool], verified" is a fact.


3. The tool and version

NIST's form asks for the tools used including version. This is what makes a wipe auditable. Software-based sanitization is only as good as the tool that performed it, and version matters.


4. Verification and a second signature

The form separates the person who performed the sanitization from the person who concurred. One person doing both, with no verification step recorded, is weaker documentation.


Why this matters outside of federal agencies

NIST 800-88 is written for federal systems, but it is the reference point private industry and auditors use.


If you are a healthcare practice, the HIPAA Security Rule requires policies and procedures covering the disposal of electronic protected health information and the media it is stored on. Your certificate is how you demonstrate those procedures were actually followed.


The same logic applies if you handle financial records, student records, legal files or employee data. The certificate is not paperwork for its own sake. It is the only artifact that exists after the drive is gone.


Red flags in a certificate

  • No serial numbers, just a device count
  • Vague method language with no technique named
  • No date, or a date that does not match the pickup
  • No named individual, only a company name
  • No disposition, so no record of where the material actually went
  • Issued before the destruction actually happened
  • Provider still citing NIST 800-88 Rev. 1 as the current standard


Questions to ask before you hand over the drives

  • Will the certificate list every serial number?
  • Which sanitization method will you use, and which technique?
  • If drives are wiped, what tool and version, and is verification recorded?
  • Who signs it, and is there a separate verification signature?
  • Will it state the final disposition of the material?
  • How long do you retain your copy of the records?
  • When do I receive it after pickup?


Any provider doing this properly will answer all seven without hesitating.


How long to keep it

Keep certificates at least as long as your retention policy for the data that was on the devices, and as long as any regulation covering your industry requires. Store them where you can actually find them. A certificate you cannot locate during an audit is functionally the same as not having one.


What OCM Recycle provides

OCM Recycle has handled electronics recycling and data destruction for Florida businesses since 2004, from our facility in Oldsmar.


Every data destruction job includes serial number tracking, a detailed final disposition report, and a certificate of data destruction. Drives that will not be reused are destroyed with our own equipment. Working drives are wiped to DOD standards using Active KillDisk, and we can process up to 45 drives at once.


Want to see what our documentation looks like before you commit? Ask and we will show you a sample. Call (813) 855-2233.


FAQ

What should a certificate of data destruction include?

Based on NIST SP 800-88 Rev. 2, it should record the person performing the sanitization, full media information including serial number, the sanitization method and technique, the tools used including version, verification and validation, the final disposition of the media, and a signed attestation with a separate concurrence signature.


Is a certificate of data destruction legally required?

No single law mandates the document itself, but regulations like HIPAA require policies and procedures for disposing of electronic protected health information and the media holding it. The certificate is how you demonstrate those procedures were followed.


What is the difference between a certificate of destruction and a certificate of sanitization?

They describe the same record. NIST uses the term certificate of sanitization because sanitization covers wiping and purging as well as physical destruction. The industry generally says certificate of destruction.


Does NIST 800-88 Rev. 1 still apply?

No. Rev. 1 was withdrawn on September 26, 2025 and superseded by Rev. 2, published the same day. The sample certificate form moved from Appendix G to Appendix C.



Do I need a certificate for every drive?

NIST's model is a per-device record. In practice many providers issue one certificate covering a job, with every serial number itemized on it. Either works as long as each device is individually identified.


Sources

  • NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025): https://csrc.nist.gov/pubs/sp/800/88/r2/final