An auditor picks a retired hard drive from your asset register. Can you show what happened to it? The signed certificate says 48 drives were shredded. The batch certificate can’t tie that drive to the job without an item-level record, such as a serial number or asset ID log.
In 2026, there’s no single U.S. certificate format that applies across industries. Your certificate of destruction requirements depend on what you’re disposing of and what the applicable rules and your contract require. Start by making sure the certificate records what was destroyed, how, and when.
What is a certificate of destruction?
A vendor-issued certificate of destruction is a signed or electronically authenticated record confirming that the provider destroyed the listed records or media. An authorized internal team can issue a completion record for work done in-house. For an off-site job, the pickup receipt shows when the material left your site, the chain-of-custody record shows who had control of it along the way, and the certificate records when it was destroyed. Tie both dates to the same job number. See how chain of custody works from collection to destruction.
Certificate of destruction requirements to discuss with your vendor
A vendor certificate should identify who did the work, what was destroyed, when and where it happened, and which method was used. It should include a signed or electronic attestation and account for any exceptions. Use these fields as a starting point and add anything applicable law, agency policy, or your contract requires. Ask for a sample before the first pickup, and specify which logs or manifests the vendor should attach.
- Customer, provider, and job identifier. List the customer, the site the material came from, and the company or team that destroyed it. Include the certificate or job number used to link the paperwork.
- Material and quantity. List the type and quantity of material destroyed. For paper, that could be a box count, container count, or weight. Reference the manifest if you need to trace specific boxes. Attach a serial number or asset ID log if you need to account for individual devices.
- Actual destruction date and location. Record the date and site of destruction. If the job ran over several days, list the completion date and reference the batch dates if you need to trace individual loads.
- Method used. Name the process used, such as industrial paper shredding or physical shredding of hard drives. If your contract specifies a standard or particle size, record that specification and include any evidence the agreement requires.
- Attestation and exceptions. Include the authorized signer’s name, role, and signature or electronic approval. List missing, rejected, or pending items on the certificate or in a linked exception report. Keep those items open until you have a record of what happened to them.
For routine office paper pickups, your policy may only call for a count of the containers. When you retire a server, you may need to account for every drive. If you need proof for each drive, match the vendor’s serial numbers or asset IDs to your register before you close the job. See hard drive and media destruction documentation options.
What do laws and standards require in 2026?
Healthcare. HIPAA requires safeguards for disposal of protected health information and procedures for final disposition of electronic protected health information or the media that stores it. HHS also explains that a covered entity hiring a business associate for disposal must have an agreement requiring appropriate safeguards. The Security Rule’s six-year retention provision applies to documentation required under 45 CFR § 164.316(b)(1), measured from creation or the date the documentation was last in effect, whichever is later. Set your certificate retention period based on the obligations that apply to that record. HHS disposal guidance · HHS guidance on disposal vendors · 45 CFR § 164.316
Consumer reports. The FTC Disposal Rule requires covered organizations to take reasonable measures to protect against unauthorized access to or use of consumer information during disposal. Here, consumer information means records about an individual, in paper, electronic, or other form, that are consumer reports or are derived from them. The rule gives an outsourcing example that includes vetting the contractor before hiring and monitoring compliance with the contract. Keep your vendor evaluation and monitoring records with the contract and job documentation. 16 CFR Part 682 · How to assign responsibilities in a destruction contract
Public records. New England public agencies should check the applicable records schedule and approval process before releasing records. Massachusetts municipalities use Form RMU-2 to request permission for records that require it. Rhode Island agencies submit a Certification of Records Destruction before disposal and retain the approved form permanently. The approved form authorizes disposal. A vendor’s certificate documents completion after the job. Massachusetts Archives municipal records guidance · Rhode Island records management regulation, § 1.8
Electronic media. NIST’s media sanitization guidance, SP 800-88 Rev. 2, includes a sample Certificate of Sanitization in Appendix C. It covers media identifiers, the sanitization method and technique, verification and validation, and final disposition. The guidance addresses media destined for reuse as well as destruction. If your policy or contract calls for physical destruction, make sure the certificate records that outcome for the relevant assets. NIST SP 800-88 Rev. 2
Keep the destruction proof with the job record
For audit-ready documentation, keep a record of who approved the disposal and which retention schedule or other authority allowed it. Before releasing the material, confirm that any applicable holds have been cleared. File those records under the same job number as the pickup or transfer record, signed certificate, manifests or asset logs, and any follow-up on exceptions. Set the job file’s retention period using applicable laws, contract terms, and your records schedule. Restrict access to the file and identify materials by record series or asset ID.
Planning a records cleanout, recurring shredding, or a hard drive retirement? Tell us what you need destroyed and what your team needs back, such as an asset log or a certificate with contract-specific fields. Contact us to discuss your project.