Hard drives from decommissioned servers were sold to an electronics recycler without any sanitization, and a researcher later recovered customer data from them. Which control should the company adopt for future disposal?

Disposal and decommissioning must make data unrecoverable before media leave the organization's control. That means sanitizing drives with an approved method appropriate to the media type, such as overwriting, cryptographic erasure or purging, or physically destroying them by shredding or degaussing where appropriate, and obtaining a certificate of destruction or sanitization that documents what was done to each device. The certificate provides evidence for audits and regulators that customer data was handled correctly. Deleting files and performing a quick format removes file system references but leaves the underlying data on the media, which is exactly how the researcher recovered customer records. Encrypting a drive after it has been removed protects nothing already written in plaintext, because the existing data was never encrypted; only a drive encrypted throughout its service life can be cryptographically erased by destroying its key. Recording serial numbers supports tracking and chain of custody, which is helpful, but recording a drive does not remove any data from it. Exam caveat: solid-state drives handle overwrites differently from spinning disks, so the method must suit the media, and third-party disposal vendors should be contractually bound and verified. Operational check: for each retired drive, confirm a sanitization or destruction record exists with its serial number, method and date, and spot-check a sample of sanitized drives with recovery tools.