Coretek 360

Chain of Custody for Examiners: A Bank ITAD Use Case

How a bank retired teller workstations and branch servers with every asset documented from dock to disposition, and value returned, before its GLBA exam.

The Coretek 360 logo

By Coretek 360

Company page

Use casePublished 17 min read

The words Chain of Custody for Examiners over teal and silver waves on a black background

Written and reviewed by the ITAD team at Coretek 360, whose facility is audited to R2v3 and RIOS. The engagement below is drawn from bank projects of this type with identifying details removed; no client figures are reported. About the company.

A bank preparing for its Gramm-Leach-Bliley Act (GLBA) examination needed more than a recycling receipt. A generation of teller workstations, branch servers and laptops was coming out of service across its branches, every one of them had held customer account data, and its examiners would ask three things about each device: where it went, how its data was destroyed, and who had it in between. The compliance team also wanted the hardware to return money to the budget instead of costing money to remove.

The Federal Deposit Insurance Corporation (FDIC) counted "more than 76,000 domestic offices operated by more than 4,400 FDIC-insured" institutions as of June 30, 2025 (FDIC, 2025), and every one of them holds hardware that will retire. Regulators have penalized banks that handled that moment badly. The Office of the Comptroller of the Currency (OCC) assessed a $60 million civil money penalty against two national bank subsidiaries of the same group in 2020 for "failure to exercise proper oversight of the 2016 decommissioning of two Wealth Management business data centers" (OCC, 2020), and the Securities and Exchange Commission (SEC) ordered a large broker-dealer to pay $35 million in 2022 after it "failed to properly dispose of devices containing its customers' PII" (personally identifiable information) (SEC, 2022). This use case shows how the bank's IT asset disposition (ITAD) was run so the file was complete before the examiners asked for it. The service behind it is described at financial services ITAD.

Key Takeaways

  • Examiners working from the FFIEC Information Security booklet expect a disposal log with the responsible party, date, media type, hardware serial number and method for each item of sensitive media, plus transit controls and contract terms with the disposal firm.
  • The 2023 Interagency Guidance says a bank's use of a vendor "does not diminish its responsibility", so the ITAD provider's custody records, certificates and reports belong in the bank's own oversight file.
  • Reconciling the hardware to the fixed asset register before pickup, logging serials at the dock and again at intake, and wiping to NIST SP 800-88 with verification gave the bank one record per device from branch to disposition.
  • Wiping instead of shredding by default kept working units whole, so the bank booked resale proceeds against hardware carried at zero while failed drives and older servers went to R2v3 certified downstream recycling.

In this article:

What the examiners would ask for

Examiners would ask for four things: an inventory of the retiring hardware, a disposal log with five fields for each item, evidence that the media was secured in transit, and a contract and oversight file for the disposal vendor. The expectations come from the Federal Financial Institutions Examination Council (FFIEC) Information Security booklet of September 2016 and from the Interagency Guidance on Third-Party Relationships issued by the Federal Reserve Board, the FDIC and the OCC in June 2023.

The FFIEC booklet is specific about the disposal record. It says "The institution should have appropriate disposal procedures for paper-based and electronic information," and it names the log: "Management should log the disposal of sensitive media. Logs should record the party responsible for disposal, as well as the date, media type, hardware serial number, and method of disposal." On vendors, "Contracts with third-party disposal firms should address acceptable disposal procedures," after due diligence on the firm's background checks and controls (FFIEC, 2016).

The same booklet covers the trip between the branch and the facility. Its section on transit of physical media lists four controls: "Procedures to verify the identity of couriers," "Tracking of shipments to provide early indications of loss or damage," "Security reviews or independent security reports of receiving companies," and "Use of nondisclosure agreements for couriers and third parties." Appendix A turns these into examination items (FFIEC, 2016):

  • Item 6 asks whether management "effectively maintains an inventory(ies) of hardware, software, information, and connections."
  • Item 16.e looks for procedures "for the secure destruction or wiping of hard drives being returned to vendors or donated."
  • Item 18.e checks for "appropriate disposal procedures for both paper-based and electronic information."
  • Item 18.f checks for "the security of physical media, including backup tapes, containing sensitive information while in transit."

One point of vocabulary matters here: the FFIEC booklet never uses the phrases "chain of custody" or "certificate of destruction." Its words are "log the disposal," with the five fields above. A provider's custody record and per-drive certificates are how a bank produces that log; the examiner is checking for the fields, not the label.

The 2023 Interagency Guidance sets the oversight standard around the vendor. "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house."

The guidance then names what the contract and the bank's own file should contain. It expects ongoing monitoring that lets the bank "confirm the quality and sustainability of a third party's controls and ability to meet contractual obligations." Contracts should stipulate that the vendor's work "is subject to regulatory examination and oversight, including appropriate retention of, and access to, all relevant documentation and other materials," and generally include "provisions for periodic, independent audits of the third party and its relevant subcontractors." The bank's own file should hold "Executed contracts" and "Risk and performance reports required and received from the third party as part of ongoing monitoring" (Interagency Guidance, 2023).

Credit unions answer to the National Credit Union Administration (NCUA) under Part 748 Appendix A, whose objectives include the proper disposal of member and consumer information and which asks each credit union to select service providers with due diligence, bind them by contract to the same objectives, and monitor them by reviewing audits, summaries of test results or equivalent evaluations (NCUA, current CFR text).

ExpectationWhere it comes fromWhat the record looks like
Inventory of hardwareFFIEC Information Security booklet, Appendix A item 6Serialized list of retiring assets reconciled to the fixed asset register before pickup
Secure destruction or wiping of hard drivesFFIEC II.C.11 and Appendix A item 16.eSanitization method recorded against each drive serial, with verification and the handling of failed drives
Disposal logFFIEC II.C.13(c)Responsible party, date, media type, hardware serial number and method of disposal for every item
Security of media in transitFFIEC II.C.13(d) and Appendix A item 18.fWho took custody at the dock, shipment tracking, the receiving facility's security review or certification, nondisclosure terms
Contract terms with the disposal firmFFIEC II.C.13(c) and II.C.20; Interagency Guidance, 2023Executed contract naming disposal procedures, access for the institution or an auditor, and retention of documentation
Ongoing monitoring of the vendorInteragency Guidance, 2023Reports received from the provider, certificate scope, audit findings and how they were resolved
Service provider oversight (credit unions)NCUA Part 748 Appendix A, III.DDue diligence file, contract, and audits or test-result summaries from the provider

The "independent security reports of receiving companies" line is the one a provider's certifications answer; see RIOS certification and R2v3 certification pages.

Reconciling to the fixed asset register

The work began with the bank's fixed asset register, not with a truck. The bank's IT team and the provider listed each branch's retiring hardware by serial number and matched it to the register before pickup, then marked the devices that had held customer account data, financial records or confidential business information for sanitization. Both sides were working from one list, agreed in writing, before anything moved.

That order matters because of how sanitization records are judged later. NIST Special Publication 800-88 Rev. 2 (September 2025) says an organization can best tell how well it sanitizes media when it keeps records at three points: when the media enters service, when it leaves the place it was last used, and when it reaches its post-sanitization destination (NIST calls the media ISM, information storage media). It then warns: "If there is a breakdown in tracking at locations other than the post-sanitization destination, sanitization records will only show that specific ISM were sanitized and not whether the organization is effectively sanitizing all ISM that have been introduced into the operating environment" (NIST, 2025). A stack of certificates proves that the drives on the certificates were wiped. Only the reconciliation to the register proves that no drive was left out.

The inventory is also the first item on the examiner's list, Appendix A item 6, and it is where the OCC's 2020 case turned: the two national bank subsidiaries "failed to maintain appropriate inventory of customer data stored on the decommissioned hardware devices" (OCC, 2020).

Custody from the dock onward

At each branch, the pickup crew logged every serial number at the dock before the hardware left the bank's control. The equipment then traveled in tracked vehicles under a documented chain of custody and was logged again on receipt at the facility, so the pickup manifest and the intake record agreed to the unit. Any gap would have shown the day the truck arrived, not at the end of the project.

Each of the FFIEC's four transit controls had a matching record. The pickup manifest identified who took custody at the dock, with a time and a signature, which answers "Procedures to verify the identity of couriers." Tracked vehicles and the dock-to-intake comparison answer "Tracking of shipments to provide early indications of loss or damage." The facility's R2v3 and RIOS audit status served as the "Security reviews or independent security reports of receiving companies." Confidentiality terms in the executed contract covered "Use of nondisclosure agreements for couriers and third parties" (FFIEC, 2016).

The SEC case shows the same leg without those records: the broker-dealer "hired a moving and storage company with no experience or expertise in data destruction services" and "failed to properly monitor the moving company's work" (SEC, 2022). The bank's pickups were run as a data-bearing move from the first branch; the service is described at white glove pickup.

Destroying the data, keeping the hardware

At the facility, technicians wiped each drive that had held customer data to NIST 800-88 and verified the wipe, recording the method against the drive's serial number. Drives that failed verification, and the ones the bank asked to be destroyed outright, they shredded instead, logged by serial number first.

NIST SP 800-88 Rev. 2 defines three sanitization methods. Clear "applies logical techniques to sanitize data in all user-addressable storage locations of an ISM for protection against simple, non-invasive data recovery techniques." Purge techniques "make the recovery of target data infeasible using state-of-the-art laboratory techniques but preserves the ISM in a potentially reusable state." Destroy techniques "render target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the ISM"; shredding is one of them. NIST states a preference: "When possible, the purge sanitization method should be used instead of the clear sanitization method." It also cautions that "Pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data" (NIST, 2025).

The 2025 revision also retired an old habit. Its change log says "The 'clear' method was clarified such that multi-pass overwrite is not needed. This counters the obsolete DoD 5220.22-M language that mandates a certain number of overwrite passes and patterns" (NIST, 2025). The 2016 FFIEC booklet still says overwriting "may have to be performed many times"; in practice the newer NIST text governs the method, and the FFIEC booklet governs what the examiner expects to see recorded.

Shredding is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it.

Wiping rather than shredding by default kept the workstations and laptops whole. Once their drives were verified clean, the facility tested, refurbished and resold the units with life left in them through its sales channels, and the value came back to the bank itemized by serial number. The older servers and anything that failed testing went to R2v3 certified downstream recycling, documented to the same standard. That sequence follows the R2v3 standard itself: SERI's summary of R2v3 says Core 2 "Focus remains on reuse before other management strategies" and Core 7 "Requires all R2 Facilities to develop a detailed Data Sanitization Plan" (SERI, 2021).

The per-drive certificate carried weight because a bank cannot assume every retired drive was encrypted. In IBM's 2026 data breach cost study, "Only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit" (IBM, 2026), and the SEC found the broker-dealer in its 2022 order had "failed to activate the encryption software for years" (SEC, 2022). For a drive that was never encrypted, the verified wipe record is the only evidence that the customer data on it is gone. See certified data destruction and asset value recovery.

What the bank kept

The engagement closed with the records its examiners would look for:

  • A certificate of sanitization for every drive (the document most providers call a certificate of data destruction), naming the NIST 800-88 method and the date
  • A final serialized disposition report tying each asset to its custody record, sanitization method and outcome, resale or recycling
  • A settlement itemizing the value returned from each refurbished unit by serial number
  • The vendor oversight file the Interagency Guidance describes: the executed contract, the provider's certificate scope, the right-to-audit terms, and the reports received from the provider

NIST says what each certificate should hold: "Following sanitization, a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies." If the records need to be referenced later, "electronic records will likely provide the fastest search capabilities and the best likelihood of being reliably retained" (NIST, 2025).

What a certificate of sanitization should record

Field (NIST SP 800-88 Rev. 2, Section 4.6)What to look for on the certificate
ManufacturerDrive maker, as read from the drive at intake
ModelDrive model designation
Serial numberThe drive serial, matched to the dock log and the intake record
Organizationally assigned media or property numberThe bank's fixed asset tag for the host device
Media typeHard disk or solid state drive
Media sourceThe teller workstation, branch server or laptop the drive came from, by its serial
Pre-sanitization confidentiality categorization (optional)The bank's own marking from the register, such as customer account data
Sanitization method (clear, purge, destroy)Clear or purge, as the technique applied to that drive type warrants; destroy for shredded drives
Sanitization techniqueThe wipe technique applied to that drive type (NIST's examples are degauss, overwrite, block erase and cryptographic erase), or shred
Tool used, including versionThe sanitization software and its version, as the tool reports it
Verification methodHow the wipe was verified and the result
Individuals performing verification and validationThe technician's name, position, date, location, contact information and signature

For the compliance team, every retired device had one record that ran from the branch dock to its final disposition, ready for the examination. For finance, the fixed asset register closed out with proceeds booked against hardware that had been carried at zero. For the branches, the storerooms were empty.

Frequently asked questions

Does GLBA require a certificate of destruction, or just proper disposal?

GLBA requires proper disposal under a documented safeguards program; no rule names a "certificate of destruction." The FTC's Safeguards Rule, which applies to non-bank financial institutions, requires "procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used" to serve the customer (16 CFR 314.4). Banks and credit unions answer to the Interagency Guidelines and NCUA Part 748 instead, and the examiners who apply them use the FFIEC booklet, which asks for a disposal log with five fields per item (FFIEC, 2016). A certificate per drive is the practical way to produce that log.

What should a certificate of sanitization include for a bank audit?

NIST SP 800-88 Rev. 2 lists the minimum: manufacturer, model, serial number, the organization's property number, media type and source, the sanitization method and technique, the tool and its version, the verification method, and the name, title, date, location, contact information and signature of the person who verified the work (NIST, 2025). Keep the certificates electronic and searchable by serial number so a sample request from an examiner can be answered the same day.

Where does chain of custody start and stop in IT asset disposal?

It starts when a device leaves the place it was last used and ends at its documented post-sanitization destination, the two outer tracking points NIST describes alongside the record made when the device first entered service (NIST, 2025). Between those points the FFIEC's transit controls apply: courier identity, shipment tracking, a security review of the receiving company and nondisclosure terms (FFIEC, 2016).

How long should a bank keep disposal logs and certificates?

None of the rules or guidance cited in this article sets a retention period for disposal records. The 2023 Interagency Guidance asks that contracts provide for "appropriate retention of, and access to, all relevant documentation and other materials" so that examiners can review the vendor's work (Interagency Guidance, 2023). Keep the records under the institution's own records retention schedule, and make sure the ITAD contract obliges the provider to retain and produce its copies for at least as long.

Is wiping acceptable, or must drives be shredded?

Wiping to NIST 800-88 with verification is acceptable, and it is the method NIST prefers where the media can be reused: "When possible, the purge sanitization method should be used instead of the clear sanitization method," and the 2025 revision confirms that "multi-pass overwrite is not needed" (NIST, 2025). Destroy methods, including shredding, remain the answer for drives that fail verification, cannot be wiped, or that the institution designates for destruction under its own data classification.

Before the next examination

The bank walked into its examination with every question about its retired hardware already answered: an inventory reconciled to the register, custody from the dock to the facility, a verified NIST 800-88 record per drive, and a disposition report that named where each serial number ended up. Finance had proceeds to book, and the branches had their storerooms back. If an examination or a branch refresh is coming, send Coretek 360 the retiring inventory and you will get back a custody plan and a residual value estimate through the contact page.

Sources

Have a project like this one?

Tell Coretek 360 what you are retiring and we will plan the pickup, the sanitization, and the report around it.

Get a quote

Newsroom