Choosing the wrong ITAD vendor can result in data breaches, compliance failures, and environmental violations. This checklist covers the 25 most important questions to ask any ITAD vendor before signing a contract — and what the right answers look like.
Q1.Are you R2 certified?
Q2.Are you NAID AAA certified?
Q3.Do you hold ISO 27001 certification?
Q4.Are you HIPAA compliant with BAA available?
Q5.Can I verify your certifications directly with the certifying bodies?
Q6.When were your certifications last audited?
Q7.Do you have a compliance documentation package I can review?
Q8.What compliance frameworks do your Certificates of Destruction satisfy?
Q9.What data destruction methods do you use for HDDs?
Q10.What data destruction methods do you use for SSDs?
Q11.Do you provide individual Certificates of Destruction for every device?
Q12.Can I witness the destruction of my hard drives?
Q13.Do you use NSA EPL-listed degaussers?
Q14.How do you handle RAID arrays?
Q15.How do you track assets from pickup to destruction?
Q16.Do your personnel undergo background checks?
Q17.What insurance do you carry?
Q18.Do you use tamper-evident seals during transport?
Q19.Can I access my chain-of-custody documentation 24/7?
Q20.Do you have a zero-landfill policy?
Q21.Can I see your downstream vendor list?
Q22.How do you audit your downstream vendors?
Q23.Do you comply with the Basel Convention?
Q24.What is your pickup response time?
Q25.Do you assign a dedicated project manager?
Phoenix ITAD answers “yes” to every question on this checklist. We hold R2v3, NAID AAA, and ISO 27001 certifications, carry all four types of insurance, and provide complete chain-of-custody documentation for every engagement. Request our vendor qualification package to receive our full answers to all 25 questions.
If a vendor exhibits any of these warning signs during your evaluation, treat it as disqualifying. The risk of a downstream data breach, EPA violation, or failed HIPAA / SOX audit far outweighs any short-term cost savings.
Won't let you verify certifications directly with R2 (sustainableelectronics.org) or NAID (isigma.org).
Refuses to sign a Business Associate Agreement (BAA) for HIPAA-covered data.
Issues a single bulk Certificate of Destruction instead of serial-number-level documentation.
Can't or won't produce a downstream vendor list — R2v3 explicitly requires this transparency.
No tamper-evident seals, GPS-tracked transport, or background-checked personnel.
Quotes that seem too cheap — legitimate certified destruction has real cost; deep-discount vendors often illegally export e-waste.
Pressures you to skip witnessed destruction or onsite shredding when your policy requires it.
Carries only general liability — no cyber liability or professional liability coverage.
Can't provide a sample chain-of-custody report or client portal walkthrough before contract.
Last certification audit was more than 12 months ago, or 'pending renewal' for an extended period.
Verify R2v3 and NAID AAA certifications directly with the certifying bodies, require a signed BAA when ePHI is in scope, insist on serial-number-level Certificates of Destruction, review the vendor's downstream recycler list, and confirm they carry cyber liability — not just general liability — insurance. The 25-question checklist above walks through the full due diligence process.
A compliant ITAD vendor tracks every device by serial number from pickup to destruction using barcoded manifests, numbered tamper-evident seals, GPS-tracked transport, background-checked personnel, and a 24/7 client portal with signed pickup and receiving manifests plus a per-device Certificate of Destruction that ties back to the original manifest ID.