Certificate of destruction
A signed record that specific media or records were sanitised or destroyed, stating what was processed, by which method, when and by whom, kept as evidence for audit and chain of custody.
A certificate of destruction is the documentary evidence that a disposal actually took place. It is commonly issued by a destruction vendor, or completed internally, after media, equipment or paper records have been sanitised or destroyed. NIST SP 800-88 Rev. 2 (2025), the current revision, recommends completing a certificate of sanitisation for each item of storage media that is sanitised, in line with the organisation’s policies, and includes a sample form. Fields commonly recorded include the media type and serial number, the sanitisation method (clearing, purging or physical destruction), the method and tool used, how the result was verified, the date, and the names of the people who verified and validated the result.
The certificate completes the record that the chain of custody begins. Together they support defensible disposal, letting the organisation show auditors or a court that information was disposed of under policy rather than lost. A certificate is evidence, not a guarantee: it is only as reliable as the process behind it and the organisation’s checks on the vendor.
Exam relevance: questions in this area tend to turn on proof. When a scenario involves outsourced disposal, the expected answer is likely to include obtaining a certificate of destruction and keeping it with the retention records. Candidates are also expected to see that the certificate documents media sanitization and does not replace it.