Table of Contents
Overview
Choosing the wrong ITAD company can lead to data breaches, compliance failures, environmental violations, and lost revenue from unrealized value recovery. Yet many organizations select their ITAD vendor based solely on price — the single worst criterion for this decision.
This guide provides 10 critical questions to ask any ITAD company before signing a contract. These questions are designed to quickly separate certified, responsible ITAD providers from operators who may put your organization at risk.
1. What Certifications Do You Hold?
The two essential certifications for ITAD providers are R2v3 (Responsible Recycling) and NAID AAA (data destruction). Both should be current, independently verifiable through official directories, and cover the specific services being provided to your organization. Don't accept expired certifications or claims of "pursuing certification."
2. What Data Destruction Methods Do You Use?
The vendor should offer multiple destruction methods aligned with NIST 800-88 Rev. 1: software-based data wiping (for devices being remarketed), degaussing (for magnetic media), and physical shredding (for maximum security). Ask about their verification process — how do they confirm successful sanitization?
3. How Do You Maintain Chain of Custody?
From the moment equipment leaves your facility until final destruction or remarketing, there should be an unbroken, documented chain of custody. Ask about GPS-tracked transport, serial-level asset tracking, locked containers during transport, and secure staging areas at their facility.
4. What is Your Value Recovery Process?
A quality ITAD provider should maximize the financial return on your retired equipment. Ask about their remarketing channels, testing and grading processes, and what percentage of equipment they typically remarket vs. recycle. Request sample financial recovery reports from previous engagements.
5. What is Your Environmental Compliance?
Ask about their zero-landfill commitment, how they manage focus materials (lead, mercury, batteries, CRTs), and whether they export any materials overseas. R2v3 certification requires rigorous downstream due diligence, but you should verify their specific practices.
6. What Insurance Do You Carry?
The vendor should carry adequate professional liability insurance, data breach / cyber liability insurance, and environmental liability insurance. Ask for certificate of insurance amounts and verify they are appropriate for the volume and sensitivity of equipment you'll be providing.
7. What Documentation Do You Provide?
Request sample documentation packages. Quality ITAD providers deliver: serialized Certificates of Destruction (with serial number, make/model, destruction method, date, and operator for each device), chain-of-custody logs, Certificate of Recycling, financial recovery statements, and ESG impact reports.
8. Where Do You Process Equipment?
Ask where equipment is physically processed. Equipment should be processed domestically in certified facilities, not shipped overseas. If the vendor uses subcontractors, ask about their downstream accountability — are subcontractors also R2v3 certified?
9. Do You Have Experience in My Industry?
Different industries have different compliance requirements. A vendor processing hospital equipment should understand HIPAA, HITECH, and BAA requirements. A vendor serving financial institutions should understand SOX, GLBA, and PCI-DSS. A vendor serving defense contractors should understand DoD 5220.22-M, ITAR, and CMMC.
10. Can You Provide References?
Ask for references from organizations in your industry and of similar size. Contact those references and ask about the vendor's reliability, communication, documentation quality, and any issues they've experienced. A quality ITAD provider will gladly share references.
Red Flags: When to Walk Away
- No certifications — or expired/unverifiable certifications
- Lowest price only — rock-bottom pricing often means corners are being cut on security and compliance
- No chain-of-custody — inability to document who has possession of your equipment at every point
- Vague destruction methods — can't clearly explain how data is destroyed and verified
- No insurance — or inadequate coverage amounts
- Refuses facility tour — certified facilities should welcome client visits
- Exports e-waste — shipping to developing countries without verified responsible processing
- No references — unwillingness to provide client references is a major warning sign
Phoenix ITAD welcomes all 10 of these questions. We are R2v3 and NAID AAA certified, headquartered in Scottsdale, Arizona, and process all equipment domestically in our certified facility. Contact us for a free assessment and detailed answers to every question on this list.