The data center decommissioning process has seven phases: plan the scope and deadline, inventory and reconcile every asset, migrate workloads and shut systems down (with a holding period before anything is pulled), choose how each data-bearing device will be sanitized, physically remove and ship the hardware under chain of custody, recover value from what can be resold, and close out by reconciling serial numbers against certificates.
1. Plan the scope and the deadline
Start with the date that can't move, usually a lease end, a colocation contract or a refresh go-live, and work backwards. Most delays come from access, approvals and data decisions, not from the physical work.
- Define scope: which sites, rooms, racks or cages, and which equipment stays
- Confirm the hard deadline and any notice periods in leases or colocation contracts
- Name an owner for each area: IT operations, security, facilities, finance and procurement
- Agree the budget and how recovered value will be credited or reported
- List approvals you need, such as change control, security sign-off or asset write-off
- Check building rules early: loading dock hours, elevator reservations, insurance certificates and escort requirements
2. Inventory and reconcile every asset
An accurate inventory drives everything after it: data handling, freight, pricing and the final reconciliation. Pull what you have from your CMDB or asset system, then walk the floor, because the two rarely match.
- Record asset tag, manufacturer, model, serial number and location (site, room, rack, U) for each device
- Capture part numbers and key configuration: CPUs, GPUs, memory modules, drives and network cards
- Flag every device that stores data, including servers, storage arrays, switches with configs, and loose drives
- Photograph labels on anything you can't identify. A label photo is often enough to price it
- Note condition and anything missing or known to be faulty
- Reconcile the walk-through against your records and resolve the differences before removal starts
Use our IT asset inventory template to capture all of this in one sheet.
3. Migrate workloads and shut systems down
- Confirm workloads, data and services have moved and been tested on the new platform
- Take and verify final backups, and decide how long they are retained
- Remove systems from DNS, load balancers, monitoring, backup jobs and alerting
- Revoke credentials, certificates and service accounts tied to the hardware
- Cancel or transfer support contracts, warranties and software licenses
- Update the CMDB status so nobody brings a retired system back online by mistake
- Power down in a planned order
- Hold retired systems isolated or powered down for an agreed period before removal, then label each device as cleared
- For virtual servers, delete snapshots, templates, backups and detached volumes, and release IPs and licenses
Hold before you pull
Leave retired systems isolated or powered down for an agreed holding period before anything is removed. If something undocumented still depended on a server, someone will notice while it can still be switched back on. Teams often call this a scream test. Agree the length of the hold and who can approve ending it early.
Virtual and cloud servers
Retiring a virtual machine doesn't retire its data. Delete snapshots, templates, backups and detached volumes, release IP addresses and licenses, and remove the VM from monitoring. The physical hosts underneath still go through the full checklist.
4. Decide how each device's data will be sanitized
The NIST guidelines for media sanitization (SP 800-88, revised in September 2025) group methods into three levels. Choose per device, based on the sensitivity of the data and whether you want the hardware to be reused or resold.
| Level | What it means | Hardware afterwards |
|---|---|---|
| Clear | Logical techniques, such as overwriting, that protect against simple, non-invasive data recovery | Can be reused or resold |
| Purge | Techniques such as cryptographic erase or block erase that make recovery infeasible even with advanced lab methods | Can usually be reused or resold |
| Destroy | Physical destruction, such as shredding or disintegrating, so the media can't be used again | Media has no resale value |
- Write down which level applies to each device type, based on your data classification policy
- Decide whether sanitization happens on-site, off-site, or both
- Remember drives inside servers, arrays and appliances, not just loose drives
- Match the technique to the media type: reformatting or deleting files is not sanitization
- Reset network gear, BMCs and controllers, and pull SD cards and USB boot media
- Require a record for each device with its serial number, method used and verification result
- Keep a chain-of-custody record from the moment devices leave the rack
Match the method to the drive
Deleting files or reformatting a drive is not sanitization. The right technique depends on the media:
| Media | Typical approach | Watch for |
|---|---|---|
| Hard drives (HDD) | Overwrite with a verified tool (Clear), the drive's sanitize command where supported (Purge), or shred | Degaussing also destroys the drive, so it can't be resold |
| SATA and SAS SSDs | The drive's built-in sanitize function, such as block erase or cryptographic erase, run with a verified tool | Overwriting alone is unreliable on SSDs because of wear leveling and spare capacity |
| NVMe drives | NVMe sanitize (block erase or cryptographic erase), confirming the drive supports it | Boot drives on M.2 slots and add-in cards are easy to miss |
| Self-encrypting drives | Cryptographic erase, which destroys the encryption key | Confirm encryption was always on and the drive's implementation is trusted |
| Failed or unsupported drives | Physical destruction, since software methods can't run | Record serial numbers before destruction |
| Network gear and controllers | Reset to factory defaults and clear stored configurations and credentials | Switches, firewalls, BMCs (iDRAC, iLO), SD cards and USB boot media hold data too |
Whatever the method, verify the result and record it against the serial number. Current guidance (NIST SP 800-88 Rev. 2) points to industry standards such as IEEE 2883 for device-specific techniques, so check that your tools and providers follow current versions.
See what a certificate of data destruction should include before you accept one.
5. Remove, pack and ship
- Schedule de-racking, cable removal and packing around access windows
- Protect floors, doorways and elevators, and keep exit paths clear
- Pack hardware so it arrives in the condition it left in. Loose GPUs and memory need anti-static packaging
- Seal and number pallets or containers, and list contents against serial numbers
- Use tracked freight and record who handled each shipment and when
- Confirm the receiving count matches what shipped
On-site work like this can be its own project. A buyer who coordinates de-racking, packing and freight as part of the purchase keeps it from landing on your team.
6. Recover value from what can be resold
Retired hardware often has more value than expected, especially recent servers, GPUs and high-capacity server memory. Value is usually higher when components stay matched and complete.
- Separate equipment with resale value from true end-of-life equipment
- Keep GPUs, HGX baseboards, heatsinks and brackets together where possible
- Keep memory modules grouped by part number, not mixed in bins
- Get a written offer that states what it's based on and the date of the market it reflects
- Agree how payment, timing and any condition adjustments will work before hardware ships
Selling GPUs or server RAM? See what we look for in GPUs, DDR5 and DDR4.
7. Close out and document
- Reconcile serial numbers on certificates and receiving reports against your original inventory
- Chase down any device that is missing from the paperwork
- File certificates, chain-of-custody records and settlement documents where auditors can find them
- Update the CMDB and fixed asset register, and record write-offs
- Do a final walk-through of the space and return badges, keys and access
- Note what slowed you down, so the next decommission goes faster
Frequently asked questions
What is IT decommissioning?
IT decommissioning is the process of retiring IT systems and equipment: migrating what they run, shutting them down, sanitizing their data, physically removing the hardware and documenting where everything went. Data center decommissioning applies the same process to a room, cage or entire facility.
What is a scream test in decommissioning?
A scream test is a holding period where a system is isolated or powered down, but not removed, before final decommissioning. If anything still depends on it, someone notices while it can still be switched back on. It catches dependencies that documentation missed.
How long does a data center decommission take?
It depends on size, access and how much data handling is involved. A single room or a few racks can often be planned and cleared in a few weeks. Full sites can take months. Access windows, approvals and data decisions usually set the pace more than the physical work.
What is the difference between decommissioning and ITAD?
Decommissioning is the process of taking systems out of service and physically removing them. IT asset disposition (ITAD) covers what happens to the equipment afterwards: data sanitization, resale, recycling and the paperwork that proves it. Most projects need both.
Do I need to wipe drives before selling servers?
Every drive needs to be sanitized or destroyed, and reformatting doesn't count, but your team doesn't have to do it in-house. Many sellers have it done as part of the sale, on-site or off-site, with a record for each drive. What matters is a verifiable record tied to each serial number.
Can hardware be resold after its data is destroyed?
Yes, if the data was cleared or purged rather than physically destroyed. Servers, GPUs, memory and network gear can be resold once storage is sanitized or removed. Only media that was physically destroyed loses its resale value.
What should I keep after a decommission?
Keep your final inventory, chain-of-custody records, certificates of sanitization or destruction tied to serial numbers, freight records and settlement documents. Store them where your auditors and finance team can find them.
Sources
This guide is general information, not legal or compliance advice. Requirements depend on your industry, contracts and the data involved, so confirm specifics with your security, compliance or legal team.