Statutory compliance and legal audit center
Written for compliance officers, risk managers, and counsel. Statutory citations, custody transfer mechanics, and what a certificate records.
NIST Special Publication 800-88 Revision 2
NIST SP 800-88 Rev. 2 superseded Revision 1 on September 26, 2025. It is the United States federal standard for media sanitization, recognized by federal agencies, the Department of Defense, and major audit bodies, and it defines three outcomes.
Method 1, NIST 800-88 Clear
Logical sanitization across every addressable storage location using standard read and write commands, which defeats recovery by operating system and forensic software tools. Suited to remarketable enterprise PCs and laptops.
Method 2, NIST 800-88 Purge (primary)
Cryptographic erase, ATA Secure Erase, NVMe Format with Crypto Scramble, or multi-pass overwrite, applied at the firmware level to meet the Purge outcome defined in NIST SP 800-88 Rev. 2.
Method 3, NIST 800-88 Destroy
Physical destruction on our hydraulic punch press. The drive chassis is breached and the platters or NAND packages are warped, fractured, and sheared.
Arkansas hazardous waste code, ADEQ Rule 23
Under Arkansas Pollution Control and Ecology Commission Rule 23, electronic items holding hazardous secondary materials (heavy metals, leaded CRTs, mercury cold-cathode lamps, lithium batteries) fall under universal waste management rules.
What the generator owes
Commercial generators keep written custody manifests showing that nothing reached a municipal landfill without authorization, and they stay liable for the material until that paperwork closes.
What we hand back
A countersigned Bill of Lading at your dock, a serialized manifest for the lot, and a disposition record showing where each category of material went.
Missouri commercial landfill ban, RSMo 260.350
Missouri Revised Statutes 260.350 through 260.434 and Missouri DNR rule 10 CSR 25 bar commercial businesses, healthcare institutions, and state agencies from putting computer towers, monitors, and server hardware into municipal solid waste.
What the statute exposes you to
State administrative penalties apply per violation for unlawful commercial disposal, and the generator, not the hauler, is the party the state looks at.
What we hand back
A weekly fleet route across Southeast Missouri, downstream refining for separated metals and boards, and a zero-landfill diversion certificate for the lot.
HIPAA Security Rule and GLBA Safeguards compliance
Where the federal privacy rules meet hardware disposal for covered entities, business associates, and financial institutions.
HIPAA ePHI disposal standards, 45 CFR 164.310(d)
45 CFR 164.310(d)(2)(i) requires covered organizations to have verifiable procedures for the final disposition of hardware holding Electronic Protected Health Information. Purge sanitization and physical punching both produce records a provider can put in front of an OCR inquiry.
- Formal Business Associate Agreements
- Serialized drive eradication audit trails
- Tamper-evident transport bin security
Gramm-Leach-Bliley Act Safeguards, 16 CFR Part 314
The FTC Safeguards Rule requires financial institutions to dispose of customer information no later than two years after the business purpose for holding it expires. Community banks, credit unions, and wealth managers receive custody documentation and wipe verification for every lot.
- Dual-custody signed transfer manifests
- SHA-256 cryptographic wipe verification
- Documented custody transfer on every lot
Serialized Certificate of Data Sanitization
Every lot processed through the facility receives a Certificate of Data Sanitization carrying the verified serial numbers, drive specifications, the sanitization method, and an authorized signature. The table below lists the fields a certificate carries. The values are illustrative.
Certificate fields
| Field | Example value |
|---|---|
| Issuer | NEA IT Services, Certificate of Data Sanitization, NIST SP 800-88 Rev. 2 |
| Certificate ID | NEA-2026-NIST-4K7P |
| Client identifier | Sample regional enterprise account |
| Sanitization protocol | NIST SP 800-88 Rev. 2 Purge, cryptographic erase with read-back verification |
| Serial number log | W300X97482, S300Y18491, WD-WCC4M28471, and so on |
| Downstream recovery | Zero-landfill, certified downstream refining route |
| Authorized signature | Operations lead, NEA IT Services |
| Cryptographic integrity | SHA-256: e3b0c44298fc1c149afbf4c8… |
Need this documentation for your own audit binder?
Dispatch schedules the pickup, the bench sanitizes to the outcome your policy requires, and the lot returns as a serialized certificate you can look up online. Qualifying corporate lots of 10 or more assets carry no invoice.