A financial institution’s security perimeter does not end at the data center door. It extends fully to every vendor that touches customer data on its way out — and an IT asset disposition vendor touches more of it, in less controlled conditions, than almost any other service provider on the risk register. That is why financial services ITAD vendor due diligence has moved from a procurement checkbox into the domain of board-level third-party risk management.
Why Is ITAD a Third-Party Risk Management Concern?
IT asset disposition (ITAD) — the secure process of retiring, sanitizing, and routing end-of-life technology — is the point at which data-bearing hardware physically leaves an institution’s controlled environment. The vendor taking custody is, by the nature of the work, handling production data outside the security controls that normally govern it.
Federal banking regulators have been unambiguous about what this means for liability. The June 2023 Interagency Guidance on Third-Party Relationships — issued jointly by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency — established that a bank’s use of a third party does not diminish its responsibility to operate in a safe and sound manner or to comply with applicable laws. The guidance applies to all banking organizations and covers the full third-party lifecycle: planning, due diligence, contract negotiation, ongoing monitoring, and termination.
Translated to ITAD: if a disposition vendor loses a pallet of drives in transit, suffers a facility breach, or sells devices that were supposed to be destroyed, the regulatory and financial liability rests with the originating financial institution. The OCC has penalized banks that failed to inventory decommissioned hardware or blindly trusted moving companies and downstream vendors without independent verification. A vendor’s Certificate of Destruction is evidence, not exoneration.
State regulators have layered their own requirements on top. The New York State Department of Financial Services Cybersecurity Regulation, codified at 23 NYCRR 500, mandates written policies for secure disposal of nonpublic information. Section 500.11 specifically requires covered entities to implement policies ensuring the security of information systems accessible to, or held by, third-party service providers — which directly encompasses ITAD vendors.
This is the governance backdrop for financial services ITAD vendor due diligence. What follows is what a defensible diligence package looks like in practice.
What Should a SOC 2 Report Tell You for Financial Services ITAD Vendor Due Diligence?
A Service Organization Control (SOC) 2 Type II report, issued under American Institute of Certified Public Accountants standards, is the baseline for any vendor handling sensitive financial data. It evaluates the operational effectiveness of a vendor’s internal controls over a defined period — typically six to twelve months — against the Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy.
Type II matters more than Type I. Type I is a point-in-time attestation of control design. Type II tests whether those controls actually operated effectively over time. For an ITAD vendor, only Type II should count.
The existence of a SOC 2 Type II is not the end of the diligence. The scope is. Three questions before accepting one as meaningful:
First, does the scope include the physical facilities and processes where data-bearing assets are sanitized and destroyed? SOC 2 reports from ITAD vendors sometimes cover only corporate IT systems, not the operational floor where drives are actually wiped, shredded, and documented. A SOC 2 that doesn’t include the destruction facility is irrelevant to the risk you are transferring.
Second, are the Trust Services Criteria in scope limited to Security, or do they include Confidentiality and Privacy? Confidentiality is the criterion that speaks directly to customer data on retired assets. Security alone is insufficient.
Third, what did the auditors find? Read the exceptions section, not just the opinion letter. A clean opinion with zero tested exceptions is common and tells you little. Exceptions that were identified, documented, and remediated tell you how the vendor responds when controls fail — which is the question that matters when your customer data is in their facility.
Beyond SOC 2, NAID AAA certification — specific to data destruction operations — should be non-negotiable. ISO 27001 is a baseline for international operations. Institutions with healthcare-adjacent data frequently require HITRUST CSF on top, which prescriptively maps controls to HIPAA, HITECH, ISO 27001, and NIST standards.
Unclear whether your current ITAD vendor’s SOC 2 scope actually covers your risk? Take the free ITAD Readiness Assessment →
What Insurance Floors Should You Require?
Insurance does not prevent a breach. It determines who pays for one. For ITAD, insurance coverage is both financial protection and a proxy signal for the vendor’s own risk posture — underwriters have already done diligence the institution would otherwise replicate.
Minimum coverage floors typical for financial services ITAD vendor due diligence programs:
Cyber liability and technology errors & omissions: $5 million to $10 million for mid-market programs. Larger regional and national institutions frequently require $25 million or higher. The policy should name the financial institution as an additional insured and explicitly cover data breach response, regulatory defense, and third-party claims arising from the vendor’s handling of client data.
Commercial general liability: $2 million per occurrence, $5 million aggregate minimum.
Auto liability: $1 million minimum, higher for vendors using their own transportation fleet. Transit is where the highest custody risk concentrates.
Workers’ compensation: Statutory limits, with a waiver of subrogation in favor of the financial institution.
Crime and employee dishonesty: $1 million minimum. This is the often-missed line — it covers internal theft, which is a real vector in ITAD and is not covered by cyber liability alone.
Request certificates of insurance annually, not just at onboarding. Coverage lapses during the contract term are a common audit finding in Interagency Guidance-aligned TPRM programs.
What Contract Terms Transfer Risk Properly?
The service agreement is where financial services ITAD vendor due diligence either works or doesn’t. Nine contract provisions should appear in every agreement:
Right to audit. Not just a right to request a SOC 2. A right to conduct or commission an independent audit of the vendor’s facility, processes, and records, with reasonable notice and at the institution’s expense. Some vendors resist this. Insist.
Subcontractor disclosure and approval. Named in advance, subject to institution approval, with flow-down of all contract terms to the subcontractor. The Morgan Stanley pattern — detailed below — was enabled by the bank’s lack of visibility into what downstream parties did with the devices.
Chain-of-custody documentation. Per-device serial tracking, scan-in/scan-out at every transfer point, reconciled manifest tied to the institution’s asset inventory, with specific timing requirements for manifest delivery. Batch-level documentation is insufficient.
Witnessed destruction option. For core banking infrastructure, hedge fund algorithmic trading servers, or any asset class where the institution requires absolute verification, the contract should permit a designated bank representative to observe shredding or pulverization on-site, or — more commonly — mandate a vendor-provided real-time video feed that the institution retains as auditable evidence.
NIST 800-88 Revision 2 compliance standard. The September 2025 revision formally deprecates multi-pass overwriting for modern flash media and establishes cryptographic erase as the default for self-encrypting drives. Contracts still specifying Rev. 1 need to be updated; it is withdrawn.
Serialized Certificates of Destruction. One per device, cross-referenced to the source department and the asset inventory. Aggregated “batch destruction” letters are not compliant with FFIEC examination expectations or with the documentation standards regulators look for in enforcement investigations.
Breach notification timing. Generally 24 to 72 hours from vendor knowledge of an incident, with defined content requirements, followed by cooperative investigation and coordinated customer notification. The 60-day state notification clocks start running whether the vendor has notified you or not.
Indemnification and defense obligations. The vendor defends, indemnifies, and holds the institution harmless against third-party claims, regulatory fines, and legal defense costs arising from the vendor’s negligence. This provision is where the insurance floors connect — the vendor’s policy needs to actually cover what the contract says they’ll pay.
Exit and data return provisions. What happens to in-process inventory, documentation, and any remaining custody if the relationship ends. Termination is a life-cycle stage explicitly called out in the Interagency Guidance; most contracts still treat it as an afterthought.
Want to benchmark your ITAD contract against financial services TPRM expectations? Take the free ITAD Readiness Assessment →
What Did the Morgan Stanley Case Establish?
The Morgan Stanley matter is the reason ITAD now sits inside the third-party risk perimeter rather than alongside it. The facts, briefly:
In 2016, during the decommissioning of two wealth management data centers, Morgan Stanley contracted a standard moving and storage company with no ITAD expertise or certifications. Over roughly five years, thousands of devices containing unencrypted customer data were sold to unauthorized third parties and ultimately auctioned on public internet sites. A separate 2019 hardware refresh discovered that 42 additional servers were missing entirely and could not be reconciled to any inventory record.
The enforcement cascade:
- OCC, 2020: $60 million civil money penalty, citing “unsafe or unsound practices” related to failure to oversee subcontractors or maintain an appropriate inventory of customer data.
- SEC, 2022: $35 million, with the Commission publicly calling the systemic security lapses “astonishing.”
- NY Attorney General, 2022: $6.5 million.
- Consumer class action: settled at approximately $60 million.
Total cumulative exposure: over $161.5 million, plus a multi-year Corrective Action Plan, reputational damage, and five years of regulatory examination overhang.
Three operational lessons regulators have since applied to other institutions:
First, the vendor category matters. Hiring a moving company to do data destruction is not equivalent to hiring a NAID AAA-certified ITAD operator. The OCC penalty language singled out this specific category error as an unsafe practice.
Second, chain-of-custody gaps compound. The 2019 missing-servers discovery exposed the fact that the bank had no reliable inventory reconciliation process for the 2016 decommissioning. Each year of undetected gap expanded the liability surface.
Third, vendor oversight is continuous. SOC 2 reports, facility audits, certification renewals, insurance certificates, and destruction reporting need calendar-driven review — ongoing monitoring is an explicit lifecycle stage in the Interagency Guidance, not a passive obligation.
Where You Stand Matters
Board audit committees now expect ITAD oversight at the same level as any other material vendor relationship, and regulators examine for it the same way.
Mature financial services ITAD vendor due diligence is documented, certification-backed, insurance-floored, contractually rigorous, and continuously monitored. It treats the ITAD vendor as a material third-party relationship, not a disposal service.
The institutions that get this right will not see their ITAD program appear in an enforcement order. The ones that don’t are writing the next case study the industry cites.
Ready to assess your organization’s ITAD readiness? SureDispose’s free assessment evaluates your current practices across SOC 2 scope, insurance coverage, contract terms, chain-of-custody documentation, and ongoing monitoring — and connects you with certified providers matched to financial services TPRM requirements. Take the Assessment →
Further reading:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
- NY DFS 23 NYCRR Part 500 Cybersecurity Regulation
- OCC Press Release — Morgan Stanley $60M Penalty (2020)
- NAID AAA Certification Directory
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.