What is in scope?
Identify all devices and media that may hold data. Include servers, laptops, mobile devices, storage arrays and loose drives.
Which method applies?
Ask which sanitisation or physical destruction process is appropriate for each media type, what verification is performed and how unsuccessful processing is handled.
What evidence comes back?
Agree the asset identifiers, processing details, exception records and certificate types you require. Review an example before committing to the service.
Who is responsible?
Confirm custody arrangements, processing locations, any partners involved and responsibilities in your service agreement. Website wording alone does not establish supplier approval.