A certificate of destruction is the signed record proving which storage media was sanitized or destroyed, by whom, when, where, and by what method. To satisfy an auditor or regulator, it must list each device by serial number, cite a recognized standard, and identify the vendor. A page reading "42 hard drives destroyed" does not.
The certificate is the only artifact that survives the process. The drives are gone, the technician has moved on, and the destruction happened months ago. Whatever the document says is the entire evidentiary record.
Why Must a Certificate of Destruction List Serial Numbers?
Serial numbers are what tie a specific device to a specific outcome. Serial-level itemization is the single feature that separates a useful certificate from a receipt.
Each item should appear with its manufacturer, model, serial number, and media type. Where the organization maintains its own tags, the asset identifier should appear alongside the serial, because the asset identifier is what the inventory record is keyed on and the serial is what the vendor can read off the device.
Quantity-only certificates cannot be reconciled. If forty-two drives left the building and the certificate says forty-two drives were destroyed, nothing connects any particular drive to any particular outcome. If one of those drives surfaces later, the certificate provides no basis for saying it was not one of yours.
The itemized list also enables the reconciliation that makes the whole process credible: comparing the serials on the outbound manifest against the serials on the certificate, line by line, and investigating any difference. That comparison is the control. The certificate is just the input to it.
Which Destruction Method Should the Certificate Name?
The certificate should name the sanitization or destruction method against a recognized standard, in terms that mean something outside the vendor's marketing.
NIST SP 800-88 provides the vocabulary — clear, purge, and destroy — and defines what each entails for each media type. A certificate stating that media was purged in accordance with the standard, and naming the technique used, is verifiable. One stating that media was "securely wiped using industry-leading methods" is not.
Method matters because it differs by media. Degaussing is effective on magnetic media and does nothing to solid state. Overwriting is valid for some devices and unreliable on flash with wear-leveling and over-provisioned cells. Physical destruction has particle-size requirements that vary by media type, and a shred size adequate for a spinning disk may leave recoverable flash packages intact.
Where destruction is physical, the certificate should state the final particle size or the destruction equipment used. This is what allows someone to assess later whether the method was appropriate for the media.
What Event Details Should a Certificate of Destruction Record?
The certificate should record who did the work, where, and when, specific enough to reconstruct the event.
Date and location of destruction, named. Not the date the certificate was issued and not the vendor's head office — the date the media was destroyed and the facility where it happened. Where destruction was performed on site, the certificate should say so.
The technician or operator who performed the work, identified by name or employee identifier, along with the name and title of whoever is attesting on behalf of the vendor. An unsigned certificate, or one signed by an unidentifiable person, is difficult to rely on.
The chain of custody between collection and destruction should be documented, whether on the certificate or in an attached record. Every transfer of possession, with date, time, and both parties identified. This is the same discipline that governs secure transport of equipment generally, and the gap between pickup and destruction is exactly where an unbroken record matters most.
Video or witness evidence, where the vendor provides it, should be referenced on the certificate with a retention period and a means of retrieval. A recording nobody can locate in two years is not evidence.
Reference the Vendor's Standing
The certificate should identify the issuing entity precisely and give a reader a way to assess it.
Full legal entity name and address, not a trading name. Where the destruction was subcontracted, the subcontractor should be named, because a certificate from a company that did not perform the work is attesting to something it did not witness.
Relevant certifications should appear with their numbers and validity dates — NAID AAA for destruction specifically, R2 or e-Stewards for the recycling chain. Those claims connect the certificate to an audited process, and verifying them is part of selecting the vendor in the first place.
Where material continued downstream after destruction, the certificate should say what happened to it. Destruction and disposal are separate events and a certificate covering only the first leaves the environmental question open.
How Long Should Certificates of Destruction Be Kept?
Keep them for the longest applicable obligation, and keep them where they can be found. A certificate that exists and cannot be located has the same evidentiary value as one that was never issued.
Retention for destruction and recycling records should match the longest applicable obligation, which is usually driven by sector regulation rather than by IT policy. Financial and healthcare requirements commonly run to six or seven years, and litigation hold can extend any of them indefinitely.
Store certificates linked to the asset records they cover rather than in a chronological folder of PDFs. The question that gets asked is almost never "what was destroyed in March"; it is "what happened to this specific device", and only the linked record answers it.
Reconcile on receipt, not at audit. A certificate that arrives with three serials missing is correctable in the week it arrives, while the vendor still has the records and the material may still be identifiable. Discovering the same gap two years later leaves nothing to do but document that it exists.