Data Center Decommissioning Checklist

This checklist applies to full facilities, colocation suites, cages, rooms, modular sites, disaster-recovery sites, edge locations, and large equipment refreshes. Scope each site according to ownership, lease terms, workload criticality, data sensitivity, electrical and mechanical design, and local requirements.

Data Destruction Inc. can support data center decommissioning, serialized media processing, witnessed destruction, custody, and final reporting after authorized owners release the assets.

Executive Decommissioning Gates

Do not collapse these decisions into one vendor work order.

Phase 1: Establish Governance and Scope

• [ ] Appoint an executive sponsor and accountable project manager.
• [ ] Define complete, partial, or phased decommissioning.
• [ ] Identify each site, room, cage, suite, rack, and support area.
• [ ] Define in-scope IT, network, storage, power, cooling, security, and facility assets.
• [ ] Document out-of-scope systems and physical boundaries.
• [ ] Identify site owner, landlord, colocation operator, utilities, and service providers.
• [ ] Establish budget, schedule, milestones, blackout dates, and change windows.
• [ ] Define rollback and incident authority.
• [ ] Identify legal, privacy, records, security, finance, procurement, tax, facilities, EHS, and insurance stakeholders.
• [ ] Define reporting, certificate, and retention requirements.
• [ ] Create a risk register and decision log.

Clarify what “decommissioning” includes

A project can involve only IT equipment, or it can include electrical distribution, UPS systems, batteries, generators, cooling, fire suppression, raised floor, cabling, security systems, lease restoration, and building turnover. Contract language should identify the boundary.

Phase 2: Build the Physical and Logical Inventory

Start with discovery, then reconcile the CMDB, asset register, rack elevations, network systems, storage tools, and physical inspection. No single source is sufficient.

Inventory physical assets:

• [ ] Servers, blades, chassis, and hyperconverged nodes
• [ ] Storage arrays, disk shelves, tape libraries, and backup appliances
• [ ] Routers, switches, firewalls, load balancers, wireless and telecom equipment
• [ ] Racks, rails, cable managers, KVM, and console systems
• [ ] PDUs, UPS units, batteries, busway, panels, and transformers
• [ ] Cooling and environmental-monitoring equipment
• [ ] Security cameras, access-control panels, and badge systems
• [ ] Spare parts, failed drives, staging shelves, and returns
• [ ] Removable media, tapes, optical discs, and USB storage
• [ ] Tools and vendor-owned equipment

Inventory logical assets:

• [ ] Applications and databases
• [ ] Virtual machines, containers, and images
• [ ] Storage pools, LUNs, volumes, snapshots, and replicas
• [ ] IP addresses, DNS, DHCP, VLANs, routes, and firewall rules
• [ ] Service accounts, certificates, keys, secrets, and tokens
• [ ] Monitoring, backup, management, and security agents
• [ ] Licenses, support contracts, and cloud connections
• [ ] Business owners, data owners, and technical owners

CISA’s asset-inventory guidance supports maintaining a structured, current record across the asset life cycle.

Phase 3: Map Dependencies and Critical Services

• [ ] Map application-to-server and application-to-storage relationships.
• [ ] Identify shared databases, file services, identity, DNS, time, messaging, and PKI.
• [ ] Identify network paths, load balancers, proxies, VPNs, and security controls.
• [ ] Identify backup, replication, archive, and disaster-recovery relationships.
• [ ] Identify OT, medical, laboratory, building, and physical-security dependencies.
• [ ] Review traffic flows and monitoring history.
• [ ] Confirm dependencies with owners.
• [ ] Identify undocumented and low-traffic services.
• [ ] Assign a migration or retirement route to each dependency.
• [ ] Define acceptance tests.

An idle-looking server or port can support a monthly job, emergency service, certificate endpoint, or legacy integration.

Phase 4: Classify Data and Resolve Retention

• [ ] Identify the highest confidentiality and regulatory category in each system.
• [ ] Locate personal, health, financial, payment, legal, client, defense, export-controlled, and proprietary data.
• [ ] Confirm records schedules.
• [ ] Confirm litigation, investigation, audit, and preservation holds.
• [ ] Identify authoritative copies and duplicates.
• [ ] Identify backups, tape sets, snapshots, replicas, caches, and exports.
• [ ] Approve migration, archive, expiration, or destruction.
• [ ] Document owner authorization.

Do not treat application retirement as data-disposition approval. Data can remain in storage arrays, backup systems, cloud replication, and removable media.

Phase 5: Design Migration Waves and Rollback

Sequence workloads according to dependencies, business impact, capacity, and recovery requirements.

• [ ] Group systems into migration waves.
• [ ] Define target platforms and capacity.
• [ ] Validate network, identity, security, backup, and monitoring in the target.
• [ ] Define data-sync and final-cutover methods.
• [ ] Define outage and communication plans.
• [ ] Set rollback criteria and decision time.
• [ ] Preserve required configuration and evidence.
• [ ] Test application and user workflows.
• [ ] Test backup and restore on the target.
• [ ] Obtain business-owner acceptance.
• [ ] Time-limit rollback copies and images.

A fallback copy is another data asset. Assign ownership, access, encryption, retention, and sanitization.

Phase 6: Migrate, Validate, and Release Source Systems

• [ ] Complete final synchronization.
• [ ] Quiesce applications in approved order.
• [ ] Migrate data, configuration, permissions, and required metadata.
• [ ] Validate record counts, hashes, database checks, or application integrity where available.
• [ ] Validate user, API, batch, monitoring, backup, and recovery functions.
• [ ] Document gaps and accepted exceptions.
• [ ] Complete rollback window.
• [ ] Obtain application, data, security, and business approval.
• [ ] Release source systems for retirement.

Migration completion does not sanitize the source.

Phase 7: Remove Network, Identity, and Cloud Trust

• [ ] Drain and remove load balancer entries.
• [ ] Remove DNS records and aliases.
• [ ] Release or document IP space.
• [ ] Remove routes, VLANs, firewall rules, ACLs, NAT, VPN, and zero-trust policy.
• [ ] Remove machine, service, and privileged accounts.
• [ ] Revoke certificates, API keys, SSH keys, tokens, and shared secrets.
• [ ] Remove domain and identity-provider registrations.
• [ ] Remove monitoring, EDR, SIEM, vulnerability, backup, and management enrollment.
• [ ] Close cloud links, replication, and direct-connect services.
• [ ] Rotate credentials shared with retained systems.
• [ ] Update incident-response and continuity documentation.

Local disk sanitization does not revoke copied credentials or external trust.

Phase 8: Plan Safe Shutdown and Isolation

Coordinate IT shutdown with electrical, mechanical, security, and site procedures.

• [ ] Approve method of procedure and change record.
• [ ] Establish command, communication, and stop-work authority.
• [ ] Identify live systems that must remain protected.
• [ ] Identify electrical sources and lockout/tagout responsibilities.
• [ ] Confirm UPS, battery, generator, and emergency-power state.
• [ ] Confirm cooling and airflow requirements during staged shutdown.
• [ ] Protect fire detection and suppression coverage.
• [ ] Define emergency response.
• [ ] Schedule qualified electricians, facilities personnel, riggers, and technicians.
• [ ] Confirm loading dock, elevator, floor loading, and route restrictions.
• [ ] Brief all personnel and vendors.

Only authorized, qualified personnel should isolate electrical and mechanical systems.

Phase 9: Power Down and Disconnect in Sequence

• [ ] Stop remaining workloads.
• [ ] Confirm no active sessions or writes.
• [ ] Complete approved final backups or exports.
• [ ] Shut down operating systems and storage correctly.
• [ ] Shut down network and management systems only after dependents are clear.
• [ ] Isolate production network connections.
• [ ] Isolate power under the approved procedure.
• [ ] Label disconnected circuits and cables.
• [ ] Record final status.
• [ ] Confirm no service outage outside scope.

Avoid indiscriminate cable removal. Fiber, power, and copper paths can serve retained equipment in another rack or suite.

Phase 10: Identify Every Data-Bearing Component

Data can reside outside visible server and storage drive bays.

Inspect:

• HDD, SATA SSD, SAS SSD, and NVMe media
• M.2, SATADOM, SD, microSD, USB, and compact flash
• RAID, HBA, controller, and battery-backed cache
• BMC and management-controller storage
• Switch, firewall, router, and appliance flash
• Tape cartridges and library components
• Optical media
• Security-camera and access-control storage
• Copier and office-equipment drives
• Failed, spare, and vendor-replacement drives
• Storage embedded in test, cooling, power, and building systems

Obtain Statements of Volatility where component persistence is unclear. See Hidden Storage in Network and Office Equipment.

Phase 11: Assign Clear, Purge, or Destroy

Use NIST SP 800-88 Rev. 2 as the current program framework, then apply current technology-specific procedures and vendor evidence.

For each medium record:

• Data classification
• Media technology
• Operational or failed condition
• Encryption state
• Reuse or release destination
• Required Clear, Purge, or Destroy result
• Selected technique
• Tool or equipment
• Verification and validation method
• Exception route

Healthy media can qualify for reuse when the approved method and evidence support it. Failed, unsupported, inaccessible, reuse-prohibited, or rejected media can require Destroy.

The End-of-Life Server Decommissioning Checklist provides server-level controls.

Phase 12: Sanitize or Destroy Media

For logical sanitization:

• [ ] Record make, model, serial, firmware, capacity, and interface.
• [ ] Use the approved media-specific technique.
• [ ] Record tool and version.
• [ ] Capture completion status, errors, and anomalies.
• [ ] Verify and validate the result.
• [ ] Quarantine failures.

For physical destruction:

• [ ] Route HDDs to suitable HDD equipment.
• [ ] Route SSDs, NVMe, and flash to solid-state equipment.
• [ ] Route tapes and optical discs to approved media-specific equipment.
• [ ] Define output before processing.
• [ ] Inspect remnants.
• [ ] Reprocess rejected output.
• [ ] Record equipment, operator, location, and witness.

Degaussing does not work on SSDs or other flash media. Coarse damage does not automatically establish Destroy.

Data Destruction Inc. supports data wiping, hard-drive shredding, SSD destruction, and media shredding.

Phase 13: Preserve Serialized Chain of Custody

A chain-of-custody process should connect:

• Site, room, rack, and asset
• Chassis and component serial numbers
• Container and seal
• Removal team
• Internal transfer
• Pickup date and personnel
• Vehicle and route
• Receiving reconciliation
• Secure storage
• Sanitization or destruction event
• Exception and reprocessing
• Downstream disposition

Reconcile at rack removal, dock release, vendor receipt, processing, and project close. Loose drives and unmarked boxes should stop the workflow.

Phase 14: Remove Equipment and Infrastructure

• [ ] Protect retained assets and facility surfaces.
• [ ] Remove servers, storage, and network equipment.
• [ ] Remove rails, racks, cabling, containment, and support hardware within scope.
• [ ] Use approved lifting, rigging, and floor-loading procedures.
• [ ] Separate client, landlord, carrier, and vendor-owned assets.
• [ ] Identify equipment containing batteries, refrigerants, oils, lamps, or other regulated materials.
• [ ] Package equipment for safe transport.
• [ ] Photograph cleared areas.
• [ ] Update rack elevations and floor plans.
• [ ] Conduct a left-behind media and component sweep.

Do not mechanically process equipment containing batteries unless the equipment and facility are designed for that hazard.

Phase 15: Handle Power, Cooling, Fire, and Building Systems

This phase applies only when included in the project.

• [ ] Coordinate utility and service termination.
• [ ] De-energize electrical equipment under qualified procedures.
• [ ] Address UPS systems and battery banks.
• [ ] Address generators, fuel, and associated permits.
• [ ] Recover refrigerants through qualified personnel.
• [ ] Drain or process cooling fluids as required.
• [ ] Modify fire suppression only under approved design and authority.
• [ ] Remove monitoring and access systems after security release.
• [ ] Restore penetrations, floors, walls, grounding, and cabling according to lease or facility terms.
• [ ] Obtain landlord, site, and authority acceptance where applicable.

State, local, fire, environmental, transportation, and building requirements vary. Use qualified specialists.

Phase 16: Reuse, Resale, Return, Recycle, or Destroy Assets

Sanitization acceptance and financial disposition should remain separate decisions.

• [ ] Confirm ownership and lease status.
• [ ] Confirm data-bearing components are accepted.
• [ ] Grade reusable equipment.
• [ ] Record removed or replacement parts.
• [ ] Review export, trade, and client restrictions.
• [ ] Approve resale channels and buyers.
• [ ] Select qualified electronics and battery recyclers.
• [ ] Record downstream processors.
• [ ] Record weights and material routes where required.
• [ ] Prevent landfill disposal where contractually promised.

EPA advises removing batteries where appropriate and using suitable electronics and battery recycling channels. Federal, state, and local rules can differ.

Phase 17: Verify, Validate, and Close Evidence

• [ ] Reconcile planned assets against discovered and removed assets.
• [ ] Reconcile every storage component against its result.
• [ ] Review failed and missing items.
• [ ] Review sanitization verification and validation.
• [ ] Attach serialized reports and Certificates of Destruction.
• [ ] Attach migration and business acceptance.
• [ ] Attach environmental and downstream records.
• [ ] Close network, identity, contract, lease, utility, and facility records.
• [ ] Update CMDB, asset register, diagrams, continuity plans, and insurance schedules.
• [ ] Document exceptions and risk acceptance.
• [ ] Conduct a post-project review.
• [ ] Retain records for the assigned period.

NIST SP 800-88 Rev. 2 distinguishes verification of a completed technique from validation that the result protects the target data. Both matter.

Data Center Decommissioning RFP Questions

1. How will physical and logical inventories be reconciled?
2. How will drives, flash modules, tapes, and hidden storage be serialized?
3. Which work is performed directly and which is subcontracted?
4. Which Clear, Purge, and Destroy techniques are supported?
5. How are failed and inaccessible devices handled?
6. How are chain-of-custody handoffs recorded?
7. Can sanitization or destruction be witnessed?
8. How are electrical, rigging, battery, and environmental hazards controlled?
9. How are landlord and colocation requirements handled?
10. How are resale value and sanitization acceptance separated?
11. Which downstream processors receive equipment and remnants?
12. How are export and transportation requirements addressed?
13. Which certificate and serialized report fields are available?
14. How are discrepancies, loss, damage, and incidents reported?
15. How long are project records retained?
16. What insurance and personnel-screening controls apply?
17. How are temporary project files and inventory exports sanitized?

Require sample reports, custody records, output, and certificates before production work.

Data Center Decommissioning Checklist Summary

• [ ] Govern scope, risk, schedule, and approvals.
• [ ] Inventory physical and logical assets.
• [ ] Map dependencies.
• [ ] Resolve retention and legal holds.
• [ ] Migrate and validate workloads and data.
• [ ] Remove network, identity, and cloud trust.
• [ ] Shut down and isolate safely.
• [ ] Identify all data-bearing components.
• [ ] Assign Clear, Purge, or Destroy.
• [ ] Sanitize or destroy with media-specific techniques.
• [ ] Preserve serialized custody.
• [ ] Remove equipment and infrastructure safely.
• [ ] Close power, cooling, fire, lease, and environmental duties.
• [ ] Route assets to approved reuse, return, recycling, or destruction.
• [ ] Reconcile every asset, medium, exception, and document.
• [ ] Obtain final acceptance.

Frequently Asked Questions

Request a Data Center Decommissioning Assessment

Provide locations, rack and asset quantities, storage technologies, migration status, facility scope, service deadline, reuse plan, witness needs, and reporting requirements. Data Destruction Inc. will define the inventory, custody, sanitization, destruction, and evidence plan.

Request a Data Center Decommissioning Quote

Call: (866) 850-7977

Sources

1. NIST, NIST SP 800-88 Rev. 2, September 2025.
2. NIST, NIST SP 800-88 Rev. 2 PDF, Sections 3, 4.3, 4.5, and 4.6.
3. CISA and partners, Foundations for OT Cybersecurity: Asset Inventory Guidance, 2025.
4. EPA, Electronics Donation and Recycling.
5. EPA, Certified Electronics Recyclers.
6. EPA, Used Lithium-Ion Batteries.