What a Certificate of Destruction Actually Proves: A Columbus Business Guide

Twenty old laptops go out the door on a pallet. A week later a PDF lands in your inbox with a logo on it and the words Certificate of Destruction. Most people file it and move on. But if your data ever turns up somewhere it should not, that document is the entire defence — and a surprising number of them would not survive ten minutes of scrutiny.

Here is what a Certificate of Destruction is, what a good one contains, and what to ask your e-waste vendor before you hand over a single device.

What is a Certificate of Destruction?

A Certificate of Destruction (CoD) is a formal record stating that specific equipment — and the data on it — was destroyed or sanitised on a specific date, by a named party, using a described method. It is the paper trail that turns "we recycled those" into something you can show an auditor, an insurer, or a client.

Critically, a CoD is a statement of fact about a defined batch of assets. A certificate that does not identify which devices it covers is not really certifying anything.

What a good Certificate of Destruction contains

What "NIST-compliant" actually means

When a vendor says NIST-compliant data destruction, they are referring to NIST Special Publication 800-88, Guidelines for Media Sanitization — the reference most US organisations point to. It defines three levels:

• Clear — overwriting data using standard read/write commands. Protects against casual recovery; appropriate when the device stays inside your organisation.
• Purge — methods such as cryptographic erase or firmware-level secure erase that defeat laboratory recovery techniques. This is the right level for most business equipment leaving your control.
• Destroy — physical shredding, disintegration or incineration. Reserved for the most sensitive media, or drives that cannot be verified as purged.

Two practical notes. First, SSDs and hard drives are not the same problem — old-fashioned multi-pass overwriting does not work reliably on flash storage, which is why cryptographic erase matters. Second, a drive that has failed and will not respond to commands cannot be purged; it has to be physically destroyed. Ask your vendor how they handle dead drives, because that is where data quietly survives.

Five questions to ask before you hand over equipment

1. Will I receive a Certificate of Destruction with serial numbers for every asset?
2. Which NIST 800-88 level do you apply — Clear, Purge, or Destroy — and how do you decide?
3. How do you handle drives that fail verification or will not power on?
4. Who physically handles the equipment between pickup and processing, and is that documented?
5. Where does the scrap material go, and can you show me that downstream chain?

A vendor who answers all five clearly is doing the work. If the answers get vague around question three, keep looking.

How it works with Strictli in Columbus

We handle IT asset disposition for businesses across Grove City, Dublin, Westerville, Hilliard, Gahanna, Reynoldsburg and the rest of central Ohio — and the pickup is free.

• Free business pickup. Tell us roughly what you have and we schedule a collection. No minimum pallet count, no disposal invoice.
• NIST-compliant data destruction, with the method matched to the media and the sensitivity of what was on it.
• Certificates of Destruction issued with asset detail, so you have something real to put in the audit folder.
• Free household drop-off at our Grove City location for personal devices — no appointment needed.
• Value recovery. Equipment with life left in it gets refurbished rather than shredded, and where there is resale value we share it back with you instead of quietly pocketing it.

This article is general information about data destruction practices, not legal or compliance advice. Requirements vary by industry and contract — check with your own counsel or compliance team about what your organisation needs.

Frequently asked questions

Is a Certificate of Destruction legally required?

There is no single law that says "you must obtain a CoD." What various regulations and contracts do require is that you protect data through its whole lifecycle, including disposal — and a Certificate of Destruction is the standard way businesses evidence that they did. Treat it as the documentation that supports your obligations rather than an obligation in itself, and confirm your specific requirements with your compliance team.

Can I just factory-reset the devices myself?

A factory reset is better than nothing, and on a modern encrypted phone or Mac it is genuinely strong. On older hard-drive-based PCs it is much weaker — a reset often leaves recoverable data behind. And either way, resetting devices yourself produces no documentation. Our guide on how to safely wipe your data before selling walks through doing it properly at home.

How much does business e-waste pickup cost in Columbus?

With Strictli, nothing. Pickup across the Columbus metro is free, and equipment with remaining value can earn money back rather than costing you a disposal fee. Here is exactly how free business e-waste pickup works.

What can Columbus businesses recycle with Strictli?

Computers, laptops, servers, networking gear, monitors, phones, tablets, drives and most other IT equipment. For a full list of accepted items — and what to do with the awkward stuff — see our 2026 guide to recycling electronics in Columbus and our overview of business recycling and ITAD services.