In early 2025, a driver working on IT asset disposition (ITAD) jobs for Wisetek — an ITAD vendor subsequently acquired by Iron Mountain — pleaded guilty in federal court to stealing and reselling thousands of sensitive federal government devices over a thirteen-month period. The devices were taken from pallets of government-furnished equipment during routine disposition pickups, resold through unauthorized channels, and never reached the processing facility for sanitization or destruction.
The thefts were brazen, extensive, and carried out without detection for over a year. The incident exposed the single most critical vulnerability in the government ITAD lifecycle: the transit window between decommission and verified destruction, where physical custody of data-bearing assets passes from the agency’s controlled environment into the vendor’s logistics chain.
For federal IT asset managers and contracting officers, this incident underscored a fundamental truth: the compliance framework governing government ITAD is comprehensive, the standards are rigorous, and the penalties for failure are severe — but all of it is only as strong as the chain of custody that connects decommission to documented destruction.
The Federal ITAD Compliance Framework
Government IT asset disposition operates under a matrix of statutes, standards, and acquisition regulations that is more structured and more prescriptive than any private-sector equivalent. Understanding how these requirements interact — and where they create operational tension — is essential for agencies navigating the disposition process.
FISMA: The Governance Foundation
The Federal Information Security Modernization Act of 2014 provides the comprehensive framework for managing information security controls across all federal agencies. Under FISMA, agencies are required to continually report on their cybersecurity posture, and because hardware decommissioning is a critical endpoint in the data lifecycle, FISMA compliance inherently mandates the secure disposition of all IT assets.
FISMA doesn’t prescribe specific destruction methods. Instead, it establishes the governance obligation: your agency must demonstrate, through documented controls, that retired hardware containing federal data has been sanitized or destroyed to a defensible standard. The technical standard that operationalizes this requirement is NIST 800-88.
NIST 800-88 Rev. 2: The Technical Standard
NIST Special Publication 800-88 is the definitive federal standard for media sanitization. Published in its current form as Revision 2 in September 2025 (superseding the 2014 Rev. 1, which has been officially withdrawn), it categorizes sanitization into three levels: Clear, Purge, and Destroy. (For a detailed treatment of all three levels and the Rev. 2 updates, see our companion guide: NIST 800-88 Data Sanitization: What Every Organization Should Know.)
For federal agencies, several Rev. 2 changes are particularly consequential:
Program-level governance. Rev. 2 shifts focus from prescriptive technique tables to establishing a formal, agency-wide media sanitization program aligned with broader cybersecurity frameworks like NIST SP 800-53. This means your agency’s sanitization approach must be documented as an organizational program — not just a set of ad hoc procedures applied device by device.
IEEE 2883:2022 alignment. Rev. 2 delegates media-specific sanitization technique details to IEEE 2883:2022 and NSA-approved specifications. Agencies and their ITAD vendors must be working from the current IEEE standard, not legacy Rev. 1 technique tables, particularly for NVMe SSDs and embedded flash storage where Rev. 1 guidance was insufficient.
Verification vs. validation. Rev. 2 formally separates these concepts. Verification confirms the sanitization technique was executed. Validation confirms the outcome achieved the intended confidentiality protection. Both must be documented. This is a materially higher evidentiary bar than Rev. 1 required.
SSD-specific guidance. As agency storage infrastructure has migrated from magnetic hard drives to solid-state drives, the efficacy of legacy sanitization methods has diminished. Rev. 2 explicitly acknowledges that overwriting is less effective on SSDs and provides updated guidance that may dictate cryptographic erasure or physical destruction for solid-state media.
Controlled Unclassified Information (CUI) and NIST 800-171
Federal civilian agencies frequently process Controlled Unclassified Information — any information that law, regulation, or policy requires to have safeguarding or dissemination controls, excluding formally classified information. CUI is ubiquitous: it encompasses financial records, legal proceedings, infrastructure schematics, and sensitive internal communications.
The protection of CUI during ITAD — particularly when federal assets are transferred to private vendors for processing — is governed by NIST SP 800-171. Under requirement 3.8.3, agencies and their non-federal contractors must sanitize or destroy information system media containing CUI before disposal or release for reuse. The critical principle: your agency’s responsibility to protect CUI does not diminish when that information is transferred to a non-federal partner for destruction.
This requirement is undergoing significant tightening. Impending updates to the Federal Acquisition Regulation (FAR) and DFARS will standardize cybersecurity requirements across the executive branch. The proposed rules will mandate that all federal contractors handling CUI implement the full 110 security requirements of NIST 800-171 — a substantial compliance hurdle for ITAD vendors, requiring them to implement comprehensive security controls within their own processing facilities before they can legally accept civilian agency hardware.
Classified Data: NSA/CSS Requirements
For agencies and components within the Department of Defense and intelligence community, classified media disposition follows an entirely separate and far more prescriptive framework. Under NSA/CSS Policy Manual 9-12 and Executive Order 13526, classified media must be physically destroyed using equipment listed on the NSA Evaluated Products List (EPL).
The EPL specifies destruction methods and particle sizes by media type: paper must be shredded to 5 millimeters or smaller, magnetic hard drives require degaussing plus physical deformation, solid-state storage devices require disintegration to particles of 2 millimeters or smaller, and optical media requires disintegration. On-site witnessed destruction by personnel holding appropriate security clearances is typically mandatory. Classified media cannot leave a secured facility intact — it must be destroyed within the SCIF or similarly controlled environment.
Not sure where your agency stands? Take the free ITAD Readiness Assessment →
The GSA Surplus Property Disposition Hierarchy
Federal agencies cannot simply hand retired IT assets to a commercial recycler or sell them directly to a local vendor. The disposition of federal property follows a legally mandated process through GSA surplus property regulations, as prescribed by the Federal Management Regulation (FMR).
The disposition hierarchy is rigid and sequential:
Step 1 — Internal agency reutilization. The holding agency must first determine whether the asset can be reused within its own organization. A laptop retired from one office may serve another.
Step 2 — Federal agency screening and transfer. If the holding agency has no internal use, the asset is screened through GSA’s Personal Property Management System (PPMS) for transfer to other federal agencies.
Step 3 — State agency donation. Assets not claimed by federal agencies are offered to State Agencies for Surplus Property (SASPs) for donation to eligible state and local government entities, nonprofits, and educational institutions.
Step 4 — Public sale or auction. Assets not donated through the SASP channel may be sold to the public through GSA auctions.
Step 5 — Abandonment, destruction, or recycling. Only after the preceding steps have been exhausted may an asset be destroyed or recycled.
This hierarchy creates a fundamental operational tension for ITAD vendors servicing federal contracts. Vendors must support both the sanitization and subsequent remarketing or donation of assets to fulfill GSA’s mandate for reuse, while simultaneously guaranteeing that no residual CUI or PII remains on the devices. If an agency elects to donate sanitized laptops to a school district, the ITAD vendor must execute a verified NIST 800-88 Purge operation, produce a serialized Certificate of Sanitization, and preserve the physical integrity of the hardware and its storage media.
AbilityOne: The Mandatory Source Requirement
A consequential aspect of government procurement that directly impacts ITAD is the Javits-Wagner-O’Day (JWOD) Act and the U.S. AbilityOne Program. Under FAR Subpart 8.7, if an ITAD-related service — such as Secure Document Destruction, hardware recycling, or electronic end-of-life processing — is placed on the official AbilityOne Procurement List, federal customers are legally required to use that mandatory source. Contracting officers must check the Procurement List before considering commercial alternatives.
This mandate means that commercial ITAD vendors seeking federal contracts may be restricted from competing for certain categories of destruction services. Vendors must either focus on specialized services that exceed AbilityOne facilities’ capabilities (such as classified destruction requiring security clearances) or establish subcontracting relationships with AbilityOne providers.
Not sure where your agency stands? Take the free ITAD Readiness Assessment →
GSA MAS Procurement: How Agencies Source ITAD Services
The primary procurement vehicle for government ITAD services is the GSA Multiple Award Schedule (MAS). The MAS program allows federal, state, local, and tribal governments to purchase commercial products and services at pre-negotiated, fair, and reasonable prices from pre-qualified vendors.
ITAD services typically fall under the Information Technology Category, specifically Special Item Number (SIN) 54151S for IT Professional Services. Contracting officers assign NAICS codes to categorize the acquisition — the applicable NAICS code determines the Small Business Administration size standard, which in turn affects eligibility for set-aside contracts.
The procurement channel significantly affects timeline. GSA Schedule procurements leverage pre-vetted vendors and standardized terms, enabling task order issuance and award in under 30 days through platforms like eBuy. Open-market procurements, by contrast, require full competitive bidding under FAR Part 15 — including statement of work development, multiple proposal review rounds, and contract negotiation — extending the timeline to four to six months.
For agencies preparing for ITAD procurement, several practical considerations apply: confirm whether AbilityOne mandatory source requirements apply to your specific ITAD needs before issuing a solicitation, verify that prospective vendors hold current R2v3 (or e-Stewards), NAID AAA, and ISO 27001 certifications, and ensure the statement of work specifies NIST 800-88 Rev. 2 compliance (not the withdrawn Rev. 1) with IEEE 2883:2022 technique alignment for modern storage media.
State and Local Government Considerations
State and local agencies operate under a different compliance framework than their federal counterparts, but the core challenges are analogous.
Public records retention laws govern when hardware can be destroyed. Premature destruction of records-bearing media can trigger criminal penalties in many jurisdictions. The Certificate of Destruction serves as a critical legal artifact — if a public records request or FOIA inquiry reveals that a municipality disposed of hard drives containing citizen tax data or law enforcement records, the CoD and serial number tracking logs become the agency’s primary legal defense.
State breach notification laws impose strict disclosure timelines — often 30 to 60 days — for data exposure events involving citizen PII. An undocumented or improperly executed disposition that results in data exposure triggers these notification obligations.
Budget constraints are more acute at the state and local level than in federal agencies. Many state and local ITAD programs rely on value recovery — reselling sanitized equipment — to fund the program itself. This makes the chain of custody during transit from the government building to the processing facility the most critical vulnerability, as it’s the point where data security and value recovery must be balanced.
Not sure where your agency stands? Take the free ITAD Readiness Assessment →
The 2025 Wisetek Incident: Lessons for Every Agency
The Wisetek driver theft case is now embedded in the government ITAD conversation the same way the Morgan Stanley case reshaped financial services. The lessons are structural:
Asset tracking must be continuous, not episodic. The thefts went undetected for thirteen months because the chain-of-custody process had gaps during the transit phase. Serialized asset tracking at the point of pickup — not just at facility intake — would have flagged the discrepancies immediately.
Vendor certifications do not prevent individual misconduct. Wisetek held industry certifications. The failure was not in the vendor’s documented processes but in the execution of physical controls during the highest-risk phase: transit. Agencies must verify that their vendors’ physical security measures — background checks, vehicle monitoring, tamper-evident seals, GPS tracking — are operationally enforced, not just documented.
The transit window is the primary vulnerability. Across both government and private-sector ITAD, the gap between decommission and facility intake is where the chain of custody is most vulnerable to diversion, theft, or loss. Agencies should require serialized inventory at the point of pickup, tamper-evident seals witnessed by agency personnel, GPS-tracked transport, and immediate inventory reconciliation at the vendor’s facility.
Where You Stand Matters
Federal ITAD compliance is governed by a framework that is procedurally rigorous, technically demanding, and actively evolving. The transition from NIST 800-88 Rev. 1 to Rev. 2, the tightening of CUI protection requirements under NIST 800-171, and the post-Wisetek emphasis on chain-of-custody integrity all create an environment where agencies must continuously evaluate whether their disposition practices meet current — not legacy — standards.
The agencies that navigate this environment effectively treat ITAD as an integrated component of their FISMA security program, not as a separate logistics function. They maintain documented, program-level sanitization policies. They procure ITAD services through structured vehicles that ensure vendor qualification. They demand serialized documentation that closes every gap between decommission records and destruction certificates. And they verify — through ongoing monitoring, not just initial due diligence — that their vendors’ operational practices match their certifications.
Ready to assess your agency’s ITAD readiness? SureDispose’s free assessment evaluates your current practices across regulatory exposure, compliance gaps, data sanitization standards, vendor documentation, and chain of custody — and connects you with certified providers experienced in federal requirements. Take the Assessment →
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.