Most enterprise buyers assume a certificate of destruction means the job was documented properly. In practice, it usually means the endpoints were documented (i.e., equipment was picked up and equipment was destroyed) and everything in between was assumed vs. recorded. 

We see this gap constantly on the vendor side of ITAD engagements, and it tends to hold up fine… until it doesn’t. For example, an audit asks for the transport record between disconnection and the processing facility. A breach investigation needs to know exactly who had physical possession of a specific drive on a specific date. And a regulator wants serial-level proof, not a summary statement. Those are moments when organizations discover their chain-of-custody documentation was actually just two data points with a huge gap in the middle. 

Chain of custody and the missing middle

Chain of custody is an unbroken, timestamped record of every point at which physical control of an asset changed hands, from the moment it’s disconnected to the moment it’s destroyed or resold. Most vendor-provided templates aren’t built to capture that. They capture pickup and they capture final disposition, because those are the two moments a vendor can point to with confidence. The transport leg, the interim storage, the handoff between a primary processor and any downstream subcontractor—that middle section is where documentation typically thins out, and it’s also where equipment is most vulnerable to loss, tampering, or simple record-keeping error. 

What a template should actually require

If you’re building or evaluating a chain-of-custody template, whether for a request for proposal (RFP) or an existing vendor relationship, it should require, at minimum, the following:

1. Serialized, asset-level tracking. If a single device goes missing, batch tracking won’t reveal it until someone asks the wrong question.
2. Timestamped custody transfer at every handoff. Each time an asset moves, it should generate its own timestamped record, not just one at pickup and one at destruction.
3. A named individual or role accountable at each stage. Instead of “the vendor,” it should be a specific person or role responsible for that leg of custody. That just means there’s someone to ask when a gap shows up.
4. Certificates of destruction tied to individual serial numbers. A blanket certificate covering a shipment isn’t proof enough that any particular asset was destroyed.
5. Visibility into downstream subcontractors. Many ITAD vendors don’t perform every step in-house. If your vendor’s chain of custody ends at their own loading dock and a subcontractor takes it from there, that’s a documented handoff into an undocumented process. Domestic, in-house processing, rather than exporting materials overseas or routing them through third parties, closes this gap by design rather than requiring it to be documented after the fact. 

Specify before the relationship starts

The strongest version of this documentation is something that belongs in the RFP itself, before a vendor is selected. A requirement, not an afterthought. By the time an organization is asking a vendor to backfill custody records, the window to do it accurately has usually already closed. It’s the kind of standard that’s easy to write into a contract and hard to retrofit after the fact.

One structural way to shrink the “missing middle” in the first place is to reduce the number of handoffs it contains. On-site data destruction (i.e., physically destroying drives or wiping them to DoD standards at the customer’s own facility) removes the transport and interim-storage legs from the equation entirely. Fewer handoffs means fewer opportunities for the record to thin out.

Evolution E-Cycling builds chain-of-custody documentation into every engagement from the first point of contact, with serialized tracking and certificates of destruction that include serial numbers and asset tags for every device processed. R2v3 and RIOS certified, start to finish. Organizations building their next ITAD RFP are welcome to reach out. The template is worth getting right before the equipment leaves the building.