Three hundred and forty laptops came off a three year lease last spring. A logistics firm collected them over four days, signed a manifest, and returned them to the lessor. I signed the manifest myself and thought no more about it until an auditor asked a direct question: where is the certificate confirming those machines were wiped, and what does it say?
There was no certificate. The lease agreement committed the lessor to sanitisation in line with industry practice, a phrase that survives in contracts precisely because it can mean anything, and our own process ended at the loading bay. We had a careful chain of custody for the machines and none at all for what was on them.
The details got worse the longer we looked. Twenty-eight of the devices were never returned by their users and were eventually billed to us as losses, which means twenty-eight disks are somewhere. Whole-disk encryption was standard on anything issued after 2021 and not on the batch before it. There was a store cupboard of retired equipment going back years, kept because no one wanted to be the person who threw away a working machine. And nobody had considered the multifunction printers at all, four of which had gone back on a separate lease with drives that had been caching scanned documents, including the ones the finance team scans.
The point that stayed with me is structural. Disposal is the only stage of the asset lifecycle where our data leaves the premises by design, and it is the stage with the least process, the smallest budget and the lowest status. Everything else we do is about keeping data in.
We changed the order of operations. Sanitisation now happens while the equipment is still ours, verified and recorded per serial number before anything is collected. Certificates of destruction are reconciled against the asset register, and the register entry closes on the certificate rather than on the collection note. Anything containing storage counts, which means printers, appliances, network equipment and the contents of that cupboard. Lost devices are a security incident with a report, not a finance adjustment.
We were thorough about how equipment arrived. Nothing we owned had ever been checked on the way out.
– Serguey Shinder
Top comments (0)