Chain of Custody for IT Assets: Every Handoff, on Record.
What a chain of custody is, the nine handoffs it has to cover, what each record must contain, and a free template you can use with any vendor.
A chain of custody for IT assets is a signed record of every handoff a retired device goes through, from disposal approval to final recycling or resale. Each handoff records the serial numbers, date, time, place and a named person on both sides. It proves that the devices whose data was destroyed are the same devices that left your building, with no unexplained gap in between.
Use it with any vendor. The template below is free, with no email required.
Nine handoffs, one record.
Most vendors document steps 4, 7 and 8. The leaks tend to happen in steps 2, 3 and 5, so those are the ones to insist on.
| Event | What happens | Who records it | Minimum record |
|---|---|---|---|
| 1. Approval | Asset owner signs off the retirement list | Asset owner, IT | Asset tags, serials, reason |
| 2. Quarantine | Devices moved to a locked, access-logged area | IT or admin | Location, who holds the key, date in |
| 3. Pre-collection inventory | Serials checked against the list | IT and vendor | Serial list, drive serials if removed |
| 4. Handover | Devices packed and containers sealed | Your staff and vendor lead | Signed serial list, seal numbers, vehicle number |
| 5. Transport | Direct route to the facility | Vendor | Departure and arrival time, driver, seals intact |
| 6. Receipt | Seals checked, count and serials reconciled | Vendor receiving supervisor | Discrepancy report, even if nil |
| 7. Data destruction | Wipe, degauss or shred, per serial | Vendor operator | Method, result, date, operator per serial |
| 8. Final disposition | Resale, refurbishment or recycling | Vendor and authorised recycler | Outcome per serial, e-waste manifest, recycling certificate |
| 9. Close-out | Certificates matched to your register | Your IT or compliance team | Reconciliation note, exceptions log |
Six places the chain usually breaks.
The storeroom gap. Devices are approved for disposal, then sit for months in a room several people can open. Nobody logs who went in. When the pickup finally happens, the count is short by two and nobody can say when they went.
Count-only handovers. The vendor signs for "35 laptops". Later the certificate lists 35 serials, but nobody checks that they match the 35 that left.
Pooled drives. Drives are pulled from machines and dropped into one box without serials. The drive-to-device link is lost for good.
Unrecorded transport. Equipment moves in an unsealed vehicle with stops on the way, or through a subcontracted transporter nobody vetted.
Certificates issued before destruction. The certificate is dated the pickup day. Destruction happened later, or not at all.
Unresolved gaps. A missing device is noticed and never escalated. An exceptions log with every gap closed reads far better to an auditor than a clean-looking register nobody can explain.
Onsite destruction makes the chain shorter.
When drives are wiped or shredded at your premises, the transport stage carries no data at all. The chain still has to show the handover and the hardware's final disposition, but the riskiest part is gone.
That is why banks, insurers and hospitals often ask for onsite destruction of the most sensitive drives and send the rest offsite. See onsite vs offsite data destruction for how to split a batch.
Download the chain of custody template.
The template is a spreadsheet with one row per custody event per device, plus a seal register and an exceptions log. It works with any vendor, including us.
Free to use and share. If you publish it, a link back to this page is appreciated.
Questions, answered.
It is the unbroken, signed record of who held each retired device, from the moment it is approved for disposal until its data is destroyed and the hardware is resold or recycled. Every handoff is recorded with serial numbers, date, time, place and a signature from both sides.
Most disposal-related data leaks happen between handoffs: a laptop that sat in an unlocked storeroom, a drive pulled out and pooled with others, a van that stopped somewhere it should not have. A chain of custody shows exactly where each device was, so a gap can be found and explained.
Serial numbers. A count tells you 40 laptops left. Only serials tell you which 40, and whether the 40 that were destroyed are the same 40 that left your building.
It shortens the chain a lot, because the data is gone before the device leaves. You still need a record of the handover and the final disposition of the hardware, but the high-risk transport stage no longer carries data.
One named person from each side of the handoff: for example your IT or admin person and the vendor's collection lead at pickup, then the vendor's receiving supervisor at the facility. Signatures from people who were not present add nothing.
Last reviewed 30 September 2026. Sources: NIST SP 800-88 Rev. 2.
Want a chain of custody you do not have to build yourself?
Every PrivAce job is recorded at handover, moves under the Form 6 manifest and closes with a Certificate of Destruction. Serial-level records are added when your audit needs them.
