A certificate says a drive was erased. Chain of custody says which drive, whose it was, who held it, and when. Without the second, the first is a document about a serial number nobody can place.
Every asset we handle is logged at collection with its serial and your asset reference, sealed for transport, and signed for at each handover. The trail is recorded as the work happens rather than reconstructed at the end, because a trail assembled afterwards is exactly the kind an auditor is trained to distrust.
At the end you receive the custody record alongside the certificates, so the two documents refer to the same list of serial numbers.
The Risks This Removes
The Record Starts Too Late
Most custody trails begin when media reaches a processing facility. Everything before that — the cupboard, the trolley, the van — is undocumented, and that is the part somebody will ask about.
Counts That Do Not Match
Forty-two drives were collected and forty certificates came back. Without serials recorded at the point of collection there is no way to say which two, or whether there were ever forty-two.
Signatures Nobody Can Attribute
An illegible squiggle on a delivery note is not a handover record. If you cannot say who held the media at a given hour, the trail has a hole in it.
Collection from Anywhere You Operate
Head office, branches, warehouses and remote sites. Assets are logged where they are, not after they arrive somewhere else — which is the point at which most disposal records lose track of what was picked up.
One List, Two Documents
The custody record and the certificates are generated against the same set of serial numbers, so reconciling them is a match rather than an exercise. That is what makes a disposal defensible months later.
The Process, Step by Step
Logged at Collection
Each asset is recorded by serial and your own reference before it moves, and both parties sign the manifest.
Sealed in Transit
Media travels in tamper-evident, sealed containers. Seal numbers go on the manifest and are checked on arrival.
Signed at Every Handover
Each transfer of custody is signed and timestamped, so there is never a stage where responsibility is ambiguous.
What the Custody Record Covers
Everything that is picked up, whether or not it can be erased. The point of the record is that nothing falls outside it.
Tracked individually
- Hard drives, SSDs and NVMe by serial
- Servers and arrays by asset tag
- Laptops and desktops by asset tag and drive serial
- Phones and tablets by IMEI
- Tape cartridges by barcode
Tracked by sealed container
- Crates of removable flash media
- Optical media in bulk
- Small devices below individual-serial handling
- Each container under its own numbered seal
Recorded at every stage
- Collection from your premises
- Sealing and loading
- Transport and arrival
- Intake scan at the facility
- Processing and verification
- Destruction or release
How the Trail Is Kept
Logged Where It Is Picked Up
Serials are read at your premises, not on arrival at ours. The trail starts at the moment the media leaves your control, because that is the window that needs covering.
Numbered, Tamper-Evident Seals
Each container is sealed and the seal number goes on the record. A seal that arrives broken or renumbered is an incident, and it is a visible one.
Signed at Every Handover
Named, not initialled. Each transfer records who released, who received, and when — so any hour of the journey has somebody attached to it.
Your Reference Alongside Ours
Your asset tag travels next to the serial, so the record reconciles against your register rather than making you translate between two lists.
One List, Two Documents
The custody record and the certificates name the same serial numbers, and are checked against each other before handover.
Exceptions Are Recorded
A drive that arrives and cannot be found, a seal that does not match, a count that is short — written down and reported, not quietly resolved.
What the Custody Record Contains
A certificate says a drive was erased. The custody record says which drive, whose it was, who held it, and when. Neither is much use to an auditor without the other.
- Every asset by serial number, with your own reference beside it
- The date, time and address of collection
- The container and seal number each item travelled under
- Every handover: who released it, who received it, and when
- Arrival and intake scan at the processing facility
- The processing outcome for each asset, cross-referenced to its certificate
- Any exception — a mismatch, a shortfall, a broken seal — and what was done about it
- A closing reconciliation of everything collected against everything certified
- 100%Of Assets Logged at Pickup
Serial numbers are recorded at the point of collection, not on arrival. The gap between those two moments is the gap nobody can account for later.
- 0 unsealedContainers Moved Without a Numbered Seal
Every container is sealed and the seal number goes on the transfer note, so a broken seal is visible before the container is opened.
- 24/7Monitoring on the Facility
Access-controlled, camera-covered and logged, for the whole time your assets are inside it.
- 1 per consignmentTrail, End to End
Collection, transport, receipt, processing and outcome in one document, with your serial numbers running through it.
What the Standards Ask For
None of these requires a particular form. They require that movement and disposal be controlled, authorised and evidenced — which in practice means a record like this one.
ISO/IEC 27001, Annex A
Its controls cover the removal of assets from site and the secure disposal of media, and both are expected to be authorised and recorded. This is the record those controls are asking for.
When it appliesOrganisations certified to ISO 27001, and most enterprise customers auditing a supplier.
PCI-DSS Requirement 9
The most explicit of them: media holding cardholder data must be classified, its movement approved, and its distribution logged so it can be tracked. It asks for a custody trail almost in those words.
When it appliesAny environment that has processed or stored cardholder data.
HIPAA Security Rule
Requires a record of the movements of hardware and electronic media holding protected health information, and of the person responsible for them.
When it appliesHealthcare providers and the suppliers who move their equipment.
NIST SP 800-88 Rev. 2
Treats verification and documentation as part of sanitization rather than as an optional extra, and expects the record to identify the specific media that was processed.
When it appliesAny disposal programme written against NIST.
DPDP Act and GDPR
Both make you accountable for personal data handed to a processor. A custody record is how you show what you handed over and what came back — the accountability principle in a practical form.
When it appliesAny organisation using a third party to retire assets holding personal data.
R2v3 and e-Stewards
Recycling certifications require downstream tracking of the equipment a processor handles. A customer-facing custody record is what lets your own reporting line up with theirs.
When it appliesWhere your ITAD partner holds one of these, or your policy requires that they do.
Where People Go from Here
On-Site Sanitization
The arrangement where there is no transport window to document, because nothing holding data leaves.
Read moreCertificate of Destruction
The other half of the pair: what the per-asset document records.
Read moreITAD and Recyclers
High-volume intake where custody and grading run together.
Read moreFrequently Asked Questions
What does the custody record actually contain?
Asset serial and your reference, collection date and location, seal numbers, every handover with signatures and timestamps, and the processing outcome. It reconciles line for line with the certificates.
Can we avoid transport altogether?
Yes — on-site processing means the media never moves. Custody documentation still applies within your own premises.
What happens if a seal is broken on arrival?
The consignment is quarantined, you are notified, and the discrepancy is recorded. It is not processed until it is resolved.
How long are records retained?
Certificates and custody records are retained for the period your policy requires, and you receive your own copies regardless.
See the Paperwork First
We will show you a sample manifest and certificate set so you know exactly what you will be filing.