ISO 9001, 14001 and 45001 in IT Asset Disposition
By Ali Hassan, Editor, MAH Recycling
An ISO certificate on a recycler’s wall tells you how the company runs. It says nothing about what happened to your drives. Procurement teams often treat the two as one document, and that is where audit gaps start.
This guide explains what ISO 9001, 14001 and 45001 certificates cover in IT asset disposition, how to verify them, and which records you still need for your own project.
What each certificate covers
| Standard | Topic | What certification shows | What it does not show |
|---|---|---|---|
| ISO 9001:2015 | Quality management | The company plans, monitors and improves its processes under audit | That your batch was processed correctly |
| ISO 14001:2015 | Environmental management | An environmental management system is in place | Where your specific materials ended up |
| ISO 45001:2018 | Occupational health and safety | Worker safety risks are identified and managed | Anything about your data |
None of the three addresses how a particular drive is sanitized. They describe the management system around the work.
Certificate vs project record
MAH Recycling states this split on its homepage: its ISO certificates cover how the business runs, and they are separate from the project records that document the work done for a client.
Project records are the ones your auditor will ask for:
- A data destruction certificate where sanitization or destruction took place.
- A serialized inventory report, when serial numbers are captured.
- A chain-of-custody record from collection through processing.
- A recycling certificate for equipment processed for material recovery.
The level of detail is agreed in the quotation, so settle it before work starts. A certification body audits a company’s system, usually by sampling projects. It does not audit your batch, so a clean audit says the system works, not that your lot was handled correctly.
How to verify a recycler’s ISO certificate
ISO does not perform certification or issue certificates. Independent certification bodies do, so the check starts with them.
- Ask for the certificate number, certification body, scope, site and validity dates.
- Confirm the body’s accreditation, and look the certificate up in IAF CertSearch, the global database ISO points to.
- Read the scope. It should cover ITAD or e-waste activities, at the site that will handle your assets.
- Match the legal entity name to the one on your contract.
- Check the dates every time you renew a vendor, not once.
Not every certificate appears in CertSearch. DAkkS notes that certification bodies are not obliged to publish there. If you cannot find it, ask the body named on the certificate to confirm it in writing.
“Aligned” is not “certified”
The same logic applies to NIST. SP 800-88 is a guideline, not a certification scheme, so MAH Recycling describes its sanitization as aligned with it. Its About page treats R2v3 the same way: framework aligned, not certified. If a vendor claims to be “NIST certified,” ask who issued the certificate and under what scheme.
What to ask for in a tender
- Certificate copies for all three standards, with scope and dates.
- A sample data destruction certificate and a sample serialized inventory report. MAH Recycling offers samples with client details removed.
- The chain-of-custody template used at pickup.
- The method per media type, written into the quotation.
Review our certificates on the About page, then request sample records and a written quote through our data destruction services page.
