Data center decommissioning and equipment removal field guide

Decommissioning, and why the live retirement is the dangerous part

Data center decommissioning is the controlled retirement of the IT and the infrastructure that supported it: the servers, the storage, the racks, and behind them the power chain, the cooling, and the cabling. It is commissioning run backward. Where commissioning proved the plant before any load landed, decommissioning takes the load away and proves nothing got hurt on the way out.

The reason it is risky is that almost nothing about a data center is fully dead when the decom starts. The room next door is still serving customers. The PDU you are pulling shares a bus with one that is feeding a live cabinet. The drives in the rack on the dolly still hold somebody's data. And the paper trail that proves where every asset went is one missed signature away from a hole an auditor will find. A sloppy decom does one of two things, and both end careers: it drops a live circuit and takes down a neighbor that was supposed to stay up, or it lets a drive walk out the door with data still on it.

The discipline that makes it safe is the same discipline that made commissioning work. A plan, a method of procedure for every move near live gear, verified de-energization before anyone touches a conductor, and a record built as the work happens, not reconstructed at the end. The commissioning and operations overview guide is the forward version of this same program. Read decommissioning as that process in reverse, with data security and chain of custody bolted on top.

What goes in a decommissioning plan and MOP?

The plan starts with two lists: what comes out, and what stays. That sounds obvious until you are standing in a shared row where one rack is leaving and the one beside it is staying live. The scope has to name the assets coming out by location, the circuits feeding them, the shared infrastructure that must keep running, and the boundary where your work stops and the live plant begins.

Then it phases the work. You do not pull a row at once. You retire it in a sequence that keeps the live systems supported the whole way: migrate or confirm the load is gone, sanitize the data, de-energize the feed, disconnect, then rig out. Each phase has a gate, and the gate before disconnect is always a verified data-clear and a verified de-energization. Skipping a gate to make the schedule is how a live circuit gets cut.

Every move that happens near energized gear gets a method of procedure, the MOP, the same as any work in a live room. The MOP names the exact steps, the isolation points, who does what, the back-out plan if something reads wrong, and the abort criteria. For a decom in a running hall, the MOP is not paperwork. It is the thing that keeps a worker from opening the wrong panel because two PDUs look identical and only one is dead.

The asset inventory and the audit

Before anything moves, every asset gets counted, and the count has to be complete, because the assets you do not list are the ones that disappear without a record. A real decommissioning inventory captures each asset by serial number, its location down to the rack and rack unit, its make and model, and its planned disposition: wipe and resell, recycle, return to a lease, or destroy. Tie it back to the DCIM or the CMDB the site already keeps, and reconcile the two, because the floor and the database drift apart over years of moves nobody logged.

The drives are the part of the inventory that an auditor cares about most. Every storage device gets its own line, its own serial, and its own disposition, because that line is what a certificate of destruction will later have to match one to one. A server with eight drives is nine assets on the inventory, not one. Miss a drive in the count and you have a gap in the custody chain that no signature closes.

The inventory is also the asset record the as-built and records work feeds off. The DCIM that gets updated at the end starts from this count, and the as-built and record drawings guide covers how that record stays trustworthy. Build the inventory once, build it right, and the reconciliation at the end is a check instead of an investigation. Build it loose and the final report is a list of things you cannot account for.

How is data sanitized when decommissioning?

Data sanitization is the headline of any decommissioning, because the drives leaving the building hold the data, and a drive that walks out unwiped is a breach waiting to be reported. The recognized framework in the United States is NIST SP 800-88, Guidelines for Media Sanitization, which sorts the work into three levels: Clear, Purge, and Destroy. Clear overwrites with standard read-write commands. Purge applies a stronger method like a cryptographic erase or a degauss that defeats lab recovery. Destroy is physical: shred, disintegrate, or for magnetic media, degauss to the point the media is unusable.

Which level you use is a function of how sensitive the data is and what happens to the media next, and that call belongs to the data owner, not the crew on the floor. A drive being resold gets Purge and a verification. A drive holding regulated data the owner will not let leave gets Destroyed on site. The choice is driven by the data classification and the project security requirements, so confirm the level with the owner before the first drive is touched.

Two points the field gets wrong. First, the standard calls for verification, not just the wipe: NIST 800-88 expects you to confirm the sanitization worked and to sample-verify a subset, ideally by someone outside the team that ran it. Second, the standard moves. The current revision shifts the approved techniques toward the IEEE 2883 media sanitization standard and leans on a program rather than a fixed recipe, so cite the revision the owner's policy actually adopts. Degaussing only works on magnetic media. Degauss an SSD and you have done nothing. Solid-state media takes a cryptographic erase or destruction, and treating it like a spinning disk is a common and dangerous mistake.

What is a certificate of destruction?

A certificate of destruction is the signed document that proves a specific drive or batch of drives was sanitized or physically destroyed, and it is the piece of paper that closes the loop on a breach question years later. Without it, you wiped the data and cannot prove it, which in front of an auditor or a regulator is the same as not having wiped it at all.

A certificate that actually holds up names the device by serial number, states the sanitization method used and the level it meets, records the tool and its version, gives the result of the verification, and carries the date and the signature of the technician who did the work. A certificate that just says some quantity of drives were destroyed on some date, with no serials, proves nothing about your drive. Match every serial on the certificate against the serial on your inventory. The ones that do not match are the ones to chase before the vendor leaves.

The certificate is the back half of the chain of custody. The custody log proves the drive never left a tracked hand from the rack to the sanitization point. The certificate proves what happened to it there. Together they are the audit trail that answers, for every drive, where did it go and what happened to the data. Regulated environments under frameworks like HIPAA, PCI, and the financial rules expect that trail to be complete and retained.

Chain of custody from the rack to the recycler

Chain of custody is the unbroken record of who held each asset, when, and where, from the moment it leaves the rack to the moment it is sanitized, destroyed, or sold. The principle is the one a crime lab uses on evidence: every handoff is logged, and no asset is ever in an untracked hand. Break the chain at any link and every asset that passed through that link is now unaccounted for.

In practice the chain is a scan at every transition. Barcode or RFID the asset out of the rack, into the staging area, onto the truck, into the vendor's facility, and into the destruction process, with each scan stamping a time, a location, a custodian, and the serial. The serial is the thread that runs through the whole record and ties the inventory line to the custody log to the certificate of destruction at the end.

The chain breaks in the boring places. A drive pulled and set on a cart that is not yet logged. A pallet that sits overnight in an unsecured staging room. A truck handoff where nobody scanned and the paperwork was a head count. Stage sanitization-pending media in a locked, access-controlled space, and treat any asset that is off the log, even for an hour, as a potential breach until it is back on it. The strongest chain is one where a drive cannot move without leaving a record that it moved.

How do you de-energize and lock out gear in a live room?

You do not disconnect or remove any powered equipment until it is de-energized, locked out, and verified dead. This is the hard line of the whole job, and it is the one that kills people when it is crossed. The framework is OSHA's control of hazardous energy, 29 CFR 1910.147, lockout/tagout, and it covers more than electrical: stored energy in capacitors, in UPS batteries, in pressurized cooling lines, and in anything that can move or release when you open it.

The sequence does not change because the room is busy. Identify every energy source feeding the asset, including the second feed in a dual-corded, dual-path design that people forget is there. Shut it down, isolate at the disconnect, apply the lock and the tag, release or block any stored energy, then verify dead with a meter you proved on a known live source first. Lockout, the physical lock, is the surer method and the preferred one. A tag alone is a request, not a barrier.

The live-room twist is that the neighbors stay up. You are isolating one circuit on a bus that is still energized, in a room where the cabinet beside your work is serving load. That is why two PDUs that look identical are the classic trap: one is your locked-out target and one is live, and the only thing between a worker and an arc flash is the verification that the right one is dead. The electrical commissioning that proved the power chain forward, covered in the commissioning and operations overview, is the same chain you are now isolating one branch of. Verify dead at the point of work, every time, no exceptions.

Protecting the systems that stay live

Most decommissioning happens around equipment that has to keep running, and protecting that load is half the job. Pulling a rack changes the room, and the changes that bite are the ones nobody modeled: the airflow, the cooling balance, and the shared electrical paths.

Airflow is the quiet one. A row of racks was a sealed containment system, hot aisle on one side, cold on the other. Pull racks out of the middle and you have opened a gap that lets hot air recirculate to the live cabinets next to it, and their inlet temperatures climb. Blank the gaps, keep the containment intact as you work, and watch the inlet temperatures on the surviving gear, because a cooling problem you created shows up as a thermal alarm on equipment you were not supposed to touch.

On the electrical side, confirm before you cut that the circuit you are isolating does not share protection, neutral, or a path with a live load. Dropping a shared neutral or tripping an upstream device because two loads were on one branch is how a decom takes down a customer. The rule is simple to say and easy to skip under schedule pressure: prove the load is gone and the path is yours alone before you open anything.

Abandoned cable removal

When equipment comes out, the cable that fed it usually gets left behind, and that abandoned cable is both a code problem and a fire-load problem. Years of decommissioning without cable removal is how a data center ends up with raised floors and cable trays packed solid with dead copper and fiber that blocks airflow and feeds a fire.

The NEC addresses this directly. It defines abandoned cable as installed cable that is not terminated at equipment and not identified for future use, and it requires the accessible portions to be removed. The requirement runs through the limited-energy articles, the communications and optical-fiber rules and the article covering information technology equipment rooms, so the specific section depends on the cable type and the adopted code edition. The intent is consistent across all of them: if it is dead and accessible and not tagged for future use, it comes out.

The practical version is to remove the cable that fed the gear you removed, and to tag any cable you are deliberately keeping for a future install so the next crew knows it is not abandoned. Pull it back to the source, not just to the nearest tray. Half-removed cable that dangles in a tray is worse than leaving it, because now nobody can tell what is live, what is spare, and what is dead. Confirm the section numbers against the edition the jurisdiction has adopted before you cite them on a closeout.

Equipment removal and rigging

Once an asset is de-energized, disconnected, and clear, it comes out, and the heavy gear is a rigging job long before it is a recycling job. Racks loaded with gear, PDUs, UPS modules and their battery cabinets, CRAC and CRAH units, and standby generators are heavy, and they have to come out along a path the building can actually carry.

Plan the path and the weight together. A loaded rack can run well over a ton, a UPS battery cabinet more, and a flooded battery string or a generator is a different class of load again. The raised floor in a data hall has a point load rating, and rolling a loaded rack across it or staging a battery cabinet on it can punch through or deflect the floor if the weight is not spread. Know the floor loading, use load-spreading where the path crosses raised floor, and confirm the elevator or the dock can take the heaviest piece before you commit a unit to that route.

The path is the other half. Door widths, ramp angles, turning radius, and the freight elevator capacity decide what can come out whole and what has to be broken down first. Walk the egress path before the lift shows up, not when a UPS module is stuck in a doorway. Rigging the big iron is where a decom hurts someone if the weight, the path, and the floor were not worked out in advance.

Hazardous materials

A data center is full of regulated material, and decommissioning is when all of it has to be handled and documented as hazardous waste rather than quietly thrown in a dumpster. The big four are batteries, refrigerant, the clean-agent fire suppression, and the lead and other materials in the older gear.

Batteries are the largest ongoing obligation, because UPS systems hold a lot of them. Older strings are lead-acid, a regulated material; newer systems are lithium-ion, which carry a fire and thermal-runaway risk on top of the disposal rules and need careful handling and transport. Refrigerant in the cooling equipment, commonly R-410A or R-134a, is regulated under Section 608 of the Clean Air Act, which requires certified recovery before a unit is opened or scrapped. You do not vent it, and the recovery is done by a technician with the EPA certification and certified equipment. The clean-agent fire suppression, the gaseous systems in the room, has to be recovered and the cylinders handled by people who do that work, not cut loose.

Each waste stream rides on its own paper. A licensed transporter, a permitted disposal facility, a manifest for every shipment, and a signed certificate for the destruction or recovery, retained with the rest of the closeout record. The mishandled-hazmat failure is expensive twice: the fine when it is caught, and the cleanup when the material was dumped instead of manifested.

What is ITAD?

ITAD is IT asset disposition, the business of retiring IT assets in a way that is secure, documented, and environmentally responsible. An ITAD vendor handles the back end of a decommissioning: the data destruction with certificates, the chain-of-custody tracking, the resale of what has value, and the recycling of what does not, all wrapped in the documentation the owner needs for an audit.

The reason ITAD matters more than plain e-waste hauling is the two things a hauler does not give you: certified data destruction and a downstream you can prove. The certifications to look for are R2v3, the Responsible Recycling standard maintained by SERI, and e-Stewards, the standard from the Basel Action Network. Both certify responsible recycling and downstream tracking; e-Stewards is the stricter on export, refusing to send electronics to developing countries, while R2v3 is the broader and more common. For the data side, NAID AAA certification covers the data-destruction process specifically. A vendor with the right certifications is one whose downstream you can stand behind when someone asks where the material went.

ITAD is also where value comes back. A drive resold after a verified wipe, a server or a switch with remaining life sold into the secondary market, returns money that offsets the cost of the decom. The trade is data risk against recovered value, and the certified-wipe-then-resell path is how you get the value without taking the risk. The owner sets the line on what is allowed to leave versus what must be destroyed.

Environmental and regulatory closeout

The environmental side of a decommissioning is governed by a stack of rules that run from the EPA down to the state and the local level, and the documentation is the proof you followed them. E-waste handling, the refrigerant recovery, and the battery disposal each sit under their own regulation, and the manifests and certificates are what demonstrate compliance.

Refrigerant is the cleanest example of a hard requirement. EPA Section 608 makes recovery mandatory for anyone who services, maintains, or disposes of refrigerant-containing equipment, and that includes scrapping a CRAC unit. The recovery is logged, the technician is certified, and the record goes in the file. E-waste is regulated at the federal level and more tightly in many states, several of which ban electronics from landfill outright, so the disposal path depends on the jurisdiction as much as the federal rule.

The practical posture is to assume every material stream needs a manifest and a certificate, and to retain the whole package. The owner inherits the regulatory exposure along with the empty room, so the closeout record is what protects them if anyone ever asks where a ton of batteries or a charge of refrigerant ended up. Confirm the specific obligations against the EPA rules and the state and local requirements that apply to the site.

Reuse, resale, and the recycle rate

Decommissioning is the point where a data center's hardware either becomes scrap or becomes value, and the circular-economy framing has moved from a nice-to-have to a number owners track. The hierarchy is reuse first, then resale, then materials recycling, and only then disposal, because each step up keeps more value and keeps material out of the waste stream.

Reuse and resale depend entirely on the data being provably gone, which is why the verified wipe is the gate. A server that is sanitized, certified, and still has market life is worth real money in the secondary market. The same server with no certificate is scrap, because no buyer and no compliance team will touch it. The recycle rate, the share of material diverted from landfill, is the metric a certified ITAD vendor reports and that increasingly shows up in the owner's sustainability reporting.

The practical lever is to decide disposition early, asset by asset, on the inventory. What gets wiped and resold, what gets harvested for parts, what goes to materials recovery. Decide it at the inventory stage and the value recovery is planned. Decide it at the dumpster and everything becomes scrap by default.

Why the AI refresh is driving more decommissioning

The volume of decommissioning work has climbed because the hardware refresh cycle has shortened, and the GPU-heavy AI buildout is the reason. Where a generation of servers used to run five years or more, the compute density and the power-and-cooling economics of AI hardware are pushing fleets to refresh faster, and every refresh is a decommissioning of the gear it replaces.

That changes the decom from a rare event into a recurring program. A site that refreshes a hall every couple of years is running the data-sanitization, custody, and ITAD machinery constantly, not once a decade. The owners who handle it well treat decommissioning as a standing process with fixed procedures, the same way they treat commissioning, rather than scrambling a one-off team each time. The faster the refresh, the more the discipline of the record pays for itself, because the volume of drives and assets moving through is what an auditor will eventually sample.

Records and the DCIM update

A decommissioning is not finished when the room is empty. It is finished when the record reflects what left, and the as-built and the DCIM are updated to match. The asset that came off the floor has to come off the database, or the next person plans against equipment that is not there.

Update the DCIM or the CMDB to retire every asset that was removed, with its disposition and the reference to its certificate of destruction. Update the as-built drawings and the one-line to show the circuits that were de-energized, the cable that was pulled, and the space as it now stands, so the record drawings stay true. The as-built and record drawings guide covers the discipline that keeps that set trustworthy, and a decommissioning is exactly the kind of change that has to be captured the day it happens, not reconstructed later.

The final reconciliation is the proof that the record is complete: every asset on the opening inventory accounted for, matched to a disposition, a custody log, and a certificate where one applies. The reconciliation report, with no open lines, is the document that says the decom was done right. An open line is an asset nobody can find, and that is the exact thing the whole process exists to prevent.

Space turnover

The last phase is handing the space back, and what that means depends on what the owner intends to do with it. The room gets cleaned, and then it is either re-purposed for new equipment, returned to the landlord, or demolished, and each of those is a different finish line.

A space being re-purposed for a refresh gets cleaned, the surviving infrastructure verified, and the room readied to be commissioned again for the new gear. A space being returned to a landlord usually has a contractual condition to meet, broom-clean or a specified restoration, and the lease defines it. A space being demolished moves into a different scope entirely, with the structure and the remaining infrastructure handled as construction demolition.

Whatever the end state, confirm the live systems that stay are intact and documented before the team leaves. The failure here is walking away from a room that looks empty but left a surviving feed mislabeled or a containment gap open, so the next crew inherits a hazard nobody flagged.

What to document

The record is the deliverable, and for a decommissioning it has to answer one question for every asset: where did it go, and what happened to the data on it. Build the record asset by asset, keyed on the serial, so the inventory line, the custody log, the sanitization result, and the disposition all tie to the same thread.

Capture the asset and its serial, the sanitization method and the level it met, the verification result, the disposition, the chain-of-custody log, and the certificate of destruction reference. Where hazardous material moved, capture the manifest and the recovery or destruction certificate. The reconciliation report sits on top, accounting for every line, and the as-built and DCIM updates close it out. The record is what an auditor samples, so it is built to be sampled, not filed and forgotten.

Common mistakes

• Working without a MOP and disrupting a live load that was supposed to stay up.
• Pulling racks without blanking the gaps, so airflow recirculates and the surviving gear overheats.
• Sanitizing data with no verification and no certificate of destruction tied to the serial.
• Degaussing solid-state drives, which does nothing, instead of cryptographic erase or destruction.
• Disconnecting or removing equipment before it is locked out and verified dead with a meter.
• Leaving abandoned cable in the trays and under the floor instead of removing it to the source.
• Venting refrigerant or dumping batteries instead of certified recovery and manifested disposal.
• Closing out without updating the DCIM and as-built, so the record shows assets that are gone.

Field checklist

Standards and references

The decommissioning standards stack by topic. For data, NIST SP 800-88, Guidelines for Media Sanitization, is the reference for Clear, Purge, and Destroy, and the current revision points toward the IEEE 2883 sanitization standard for the approved techniques, so cite the revision the owner's policy adopts. The data owner and the data classification set the level; the standard sets how.

For the recycler, R2v3 from SERI and e-Stewards from the Basel Action Network are the two leading certifications for responsible recycling and downstream tracking, and NAID AAA covers the data-destruction process. For the live work, OSHA's control of hazardous energy, 29 CFR 1910.147, governs lockout/tagout, and NFPA 70E covers the electrical safety practices around the still-energized plant. For hazardous material, EPA Section 608 of the Clean Air Act governs refrigerant recovery, and the federal and state e-waste and battery rules govern disposal.

For the abandoned cable, the NEC defines abandoned cable and requires accessible portions to be removed, in the limited-energy articles and the article covering information technology equipment rooms; confirm the section against the adopted edition. NFPA 75 covers the protection of information technology equipment and the room itself. The exact citations shift by code cycle and jurisdiction, so verify them against the adopted editions and the project specification, and let the project security requirements and the data owner control the data side.

Units, terms, and conversions

Decommissioning borrows terms from data security, from electrical safety, and from waste handling, so the same job reads in three vocabularies depending on who is talking.

Sanitization is the umbrella term for Clear, Purge, and Destroy; wiping usually means the overwrite-level Clear, while degaussing is a magnetic-media-only Purge or Destroy method that does nothing to solid-state media. ITAD is IT asset disposition, the disposal-and-recovery program. Chain of custody is the unbroken handoff record. LOTO is lockout/tagout, the control of hazardous energy. DCIM is data center infrastructure management, the asset and capacity database, and CMDB is the configuration management database it often reconciles with. A certificate of destruction, sometimes a certificate of sanitization, is the signed proof for a specific serial.

Sanitization (Clear / Purge / Destroy)

The NIST 800-88 levels of removing data so it cannot be recovered, from overwrite to physical destruction

Degauss

A magnetic-media method that erases by demagnetizing; it does nothing to solid-state drives

ITAD

IT asset disposition, the secure and documented retirement, recycling, and resale of IT assets

Chain of custody

The unbroken logged record of who held each asset, when, and where, from rack to recycler

LOTO

Lockout/tagout, OSHA's control of hazardous energy before servicing or removal

DCIM / CMDB

Data center infrastructure management and the configuration database it reconciles the asset count against

Certificate of destruction

The signed proof that a specific drive, by serial, was sanitized or destroyed and verified

Related tools

Calculators and readiness checks for this work

Compare your options

FAQ

People also ask

• What is commissioning in construction?
• What is an as-built drawing?
• Cast-in vs post-installed anchors: which should I use?
• Why do data centers need seismic anchoring?
• What is rack-and-stack in a data center?