What a defensible disposal record looks like.
Two practical guides for service providers — one for Canadian operations, one for United States operations. Each sets out the record your customers will ask you to produce, and the sanitization standard the certificate should cite in that region.
Disposal records in Canada
The standard Canadian certificates cite — CCCS ITSP.40.006 — the record a customer will expect behind it, and the privacy frameworks your customers most often operate under.
Disposal records in the United States
NIST SP 800-88 and its Clear / Purge / Destroy categories, the same record expectations, and the sector frameworks that most often drive a customer’s disposal questions.
The two streams are never mixed
Whatever the region, one distinction holds throughout both guides, because it is the distinction an auditor will test. A drive is a data-bearing item: it is sanitized and then physically destroyed, and it receives a Certificate of Destruction. A device — the laptop, desktop, or server itself — is recycled or returned to the customer, and it receives a Certificate of Device Disposal. A device is never described as wiped, sanitized, or destroyed. Each item, of either kind, carries its own signed record; records are never batched.
Bring your disposal process
A 30-minute walkthrough against the record you produce today.
Book a demo