ITAD · Operations

Data Center Decommissioning: A Step-by-Step Guide for IT Leaders

Standard Mobile Company ResearchApril 5, 20269 min read

Every data center has an expiration date. Lease terms end. Hardware reaches end of life. Workloads migrate to the cloud or to a newer facility with higher power density. When that day arrives, the difference between a well-executed decommission and a chaotic one is measured in hundreds of thousands of dollars—and potentially millions in liability.

Yet most IT organizations have never decommissioned a data center. They have provisioned thousands of servers but never systematically unplugged, tracked, sanitized, and dispositioned them at scale. The process is part project management, part logistics, part compliance exercise, and part financial recovery operation. Get any one of those wrong, and you have a problem.

This is the playbook.

6–18 mo
Typical data center decommission timeline (planning through final disposition)

Phase 1: Planning and Asset Discovery

Decommissioning starts months before anyone touches a server. The planning phase determines whether the project will be a controlled operation or an expensive scramble.

Build the Asset Inventory

You cannot decommission what you cannot account for. The first step is a complete physical audit of every asset in the facility: servers, storage arrays, networking equipment, PDUs, cabling, UPS systems, and anything else with a serial number or asset tag.

If your CMDB (Configuration Management Database) is accurate, this is straightforward. If it is not—and in our experience, approximately 30–40% of enterprise CMDBs have significant discrepancies with physical reality—the audit will surface ghost assets, untagged equipment, and hardware that was supposed to be decommissioned years ago but never was.

Asset CategoryKey Data to CaptureWhy It Matters
ServersMake, model, serial, CPU, RAM, storage configDetermines resale value and data sanitization requirements
Storage arraysModel, capacity, drive type (HDD/SSD/NVMe), controllerStorage drives are the highest data-risk assets
NetworkingSwitches, routers, firewalls, model, port count, IOS versionCisco and Juniper equipment holds significant secondary value
Power infrastructurePDUs, UPS systems, generatorsOften overlooked; PDUs and UPS have resale markets
CablingFiber type, copper category, patch panel inventoryCopper cabling has commodity scrap value; fiber can be reused

Classify Every Asset

Once the inventory is complete, every asset needs a disposition classification:

  1. Relocate. Hardware moving to another facility. Requires logistics planning but no data sanitization beyond transport security.
  2. Remarket. Hardware with secondary-market value. Will be sanitized, tested, and sold through ITAD channels.
  3. Harvest. Hardware with no unit resale value but with valuable components (RAM, CPUs, GPUs, drives) that can be pulled and sold individually.
  4. Recycle. Hardware with no resale or component value. Will be sent to certified e-waste recyclers for materials recovery.
  5. Destroy. Assets containing data that, per policy or regulation, must be physically destroyed rather than wiped. Typically applies to drives from classified or highly regulated environments.

This classification drives every downstream decision: logistics routing, data sanitization method, value recovery projections, and recycling compliance documentation.

Establish the Timeline

Data center decommissions are almost always driven by a hard deadline—a lease expiration, a consolidation milestone, or a regulatory requirement. Work backward from that date:

Phase 2: Data Sanitization

This is the phase where liability lives. Every data-bearing device—every hard drive, SSD, NVMe, tape, and flash module—must be sanitized to a standard that will survive an audit, a regulatory inquiry, or a lawsuit.

NIST 800-88: The Standard That Governs Everything

The National Institute of Standards and Technology’s Special Publication 800-88 (Guidelines for Media Sanitization) defines three levels of data sanitization:

MethodWhat It DoesWhen to Use It
ClearOverwrites data using standard read/write commands. Data is not recoverable through standard data recovery tools.Low-sensitivity data. Assets being redeployed internally.
PurgeRenders data unrecoverable using techniques beyond standard recovery (cryptographic erase, block erase, degauss for magnetic media). Device can be reused.Most enterprise decommissions. Standard for remarketing.
DestroyPhysical destruction rendering the device unusable (shredding, disintegration, incineration, melting). Data is irrecoverable and the device is destroyed.Classified/top-secret data. Regulatory requirement. Drives that cannot be purged.

For most enterprise data center decommissions, Purge is the appropriate standard. It allows hardware to be resold while meeting compliance requirements for HIPAA, GDPR, SOX, PCI DSS, and most other frameworks. Clear is insufficient for external disposition. Destroy eliminates resale value and should be reserved for assets where regulations or internal policy mandate it.

The single most expensive mistake in data center decommissioning is destroying hardware that could have been purged and resold. The second most expensive mistake is purging hardware that should have been destroyed.

Chain of Custody Is Non-Negotiable

Data sanitization without chain of custody is security theater. Every data-bearing device must be tracked from the moment it is removed from a rack to the moment a certificate of data destruction is issued. This means:

If your ITAD provider cannot produce a per-serial-number certificate of data destruction for every data-bearing device they handled, they are not an ITAD provider. Find one who can.

Phase 3: Physical Decommission and Removal

With data sanitized and documented, the physical work begins. This phase is pure logistics, but it is logistics at a scale that most IT teams are not accustomed to managing.

Rack-by-Rack Methodology

Decommission rack by rack, not device by device. Each rack is treated as a discrete project with its own checklist:

  1. Power down and disconnect. Graceful shutdown of all devices, disconnect from power and network. Label all cables if any hardware is being relocated.
  2. Unrack hardware. Remove devices from top to bottom (weight distribution). Inspect each device against the asset inventory. Flag any discrepancies immediately.
  3. Stage by disposition. Relocate devices to designated staging areas: remarket, harvest, recycle, or destroy. Each staging area should have its own chain-of-custody log.
  4. Decommission infrastructure. Remove cabling, PDUs, and rack furniture. Inspect for any remaining assets (KVM switches, console servers, monitoring probes).
  5. Clean and inspect. Remove the rack itself if required by the lease. Inspect the floor tile area for water sensors, cable trays, and other infrastructure that may need to be returned to the landlord.

Logistics and Freight

A single data center rack can contain 2,000+ pounds of equipment. A 500-rack facility decommission involves moving over a million pounds of hardware. This requires:

40–70%
Typical value recovery rate on enterprise hardware that is 3–5 years old

Phase 4: Value Recovery

This is where decommissioning transforms from a cost center into a revenue event. Hardware that has been properly inventoried, sanitized, and documented is ready for the secondary market.

What Holds Value (and What Doesn’t)

Asset TypeTypical RecoveryKey Value Drivers
GPU accelerators (A100, H100)$8,000–$22,000/unitModel generation, VRAM, cooling type
Current-gen servers (Dell R760, HPE DL380 Gen11)$3,000–$12,000/unitCPU spec, RAM config, drive complement
Previous-gen servers (Dell R740, HPE DL380 Gen10)$800–$3,500/unitStill strong demand in mid-market and international
Enterprise networking (Cisco Catalyst/Nexus)$200–$8,000/unitModel, port density, SmartNet eligibility
Enterprise SSDs (NVMe, SAS)$50–$400/driveCapacity, interface, endurance remaining
DDR4 RDIMMs (32GB/64GB)$15–$60/moduleSpeed, manufacturer, volume
DDR5 RDIMMs (32GB/64GB)$45–$180/moduleEarly secondary market, strong demand
Older servers (5+ years)Scrap/component value onlyCPUs and RAM can be harvested; chassis recycled

A well-executed decommission of a 200-rack data center with hardware averaging three to four years old can return $2–$5 million in value recovery. That number depends on hardware mix, market conditions, and the competence of the ITAD partner managing the remarketing.

Timing Matters

Hardware depreciates. A server that is worth $4,000 today may be worth $2,500 in six months if a new generation launches or if a hyperscaler dumps similar hardware onto the secondary market. Speed of disposition directly impacts recovery. This is another reason why planning starts months before the first rack is powered down—pre-negotiated remarketing agreements with ITAD partners mean hardware can be listed for sale within days of sanitization, not weeks.

Phase 5: Documentation and Compliance Closeout

The decommission is not complete when the last truck leaves the loading dock. It is complete when the documentation package is finished and audit-ready.

The Documentation Package

The Mistakes That Cost the Most

After participating in dozens of enterprise data center decommissions, the most common and most expensive mistakes follow a predictable pattern:

  1. Starting too late. Attempting to decommission a 500-rack facility in 60 days because the lease termination was not taken seriously until it was imminent. Rush jobs increase labor costs, reduce value recovery (no time to remarket), and create compliance gaps.
  2. Incomplete asset inventory. Discovering 200 untagged servers during physical decommission that were never in the CMDB. Each one requires ad-hoc classification, sanitization, and documentation.
  3. Destroying resalable hardware. Sending three-year-old Dell PowerEdge servers to a shredder because it was “easier” than sanitizing and remarketing them. A single rack of destroyed-but-resalable servers can represent $20,000–$80,000 in forfeited value recovery.
  4. Inadequate data sanitization documentation. Wiping drives without per-device certificates. If you cannot prove data destruction per serial number, the sanitization may as well not have happened from a compliance perspective.
  5. Using an uncertified vendor. Hiring a moving company or a general e-waste hauler instead of a certified ITAD provider. No chain of custody, no certificates, no compliance, and significant liability exposure.
A data center decommission is a compliance event, a financial event, and a logistics event. Treat it as only one of those, and you will fail at all three.

When to Bring in a Partner

Very few enterprises have the internal resources to manage a full data center decommission. The question is not whether to engage an ITAD partner but when. The answer is: during Phase 1, not Phase 3.

An experienced ITAD provider will help with asset classification, provide market-based value recovery estimates, handle data sanitization with proper documentation, manage logistics and freight, and execute remarketing through established secondary-market channels. They have done this hundreds of times. Your IT team, in most cases, has done it zero times.

The right partner does not cost money—they recover it. Value recovery from remarketing should significantly exceed the cost of ITAD services for any facility with hardware less than five years old. If your ITAD partner is not demonstrating positive ROI on the engagement, you have the wrong partner.

Decommissioning a data center or looking for enterprise hardware?

We provide end-to-end ITAD services and source decommissioned enterprise equipment globally.

Get in Touch →