Published November 9, 2026
What the job is
Decommissioning a data center means emptying a site and handing it back. Every workload moves somewhere else or is switched off. Every circuit, contract and support agreement tied to the site ends. Every device that held data is sanitized before it leaves your control, and the hardware goes to reuse or recycling with a record of what happened to it.
The trigger can be a lease or colocation term ending, a hardware refresh nobody wants to fund, a merger, or a cloud program that has moved enough workloads that the site no longer pays for itself.
Move, retire or keep
The exit date is fixed. Scope is the only thing you control. Every system in the building needs one decision: move it, retire it, or keep it somewhere else for now.
Retire what you can. A system with no owner, no recent logins and no downstream consumers should be archived and switched off, not moved.
Some systems cannot be ready by the exit date. Hardware-bound appliances, systems awaiting a vendor upgrade and anything under a legal hold may need a temporary home, such as a small colocation footprint, with its own end date. Decide that early.
Where each workload goes
| Destination | Fits | Watch for |
|---|---|---|
| Retire and archive | Systems with no active users, or replaced by another system | Records retention and legal holds on the data |
| Public cloud | Workloads already virtualized, or due for a rebuild | Network design, licensing changes and the first months of bills |
| SaaS replacement | Commodity applications such as email, file shares or ticketing | Data migration and contract terms set by the provider |
| Another owned site | Organizations keeping some on-premises capacity | Capacity, power and cooling at the receiving site |
| Colocation | Hardware that must stay physical, or a temporary home | Cross-connects, remote hands and the contract term |
| Physical move | Recent hardware with time left on support | Downtime during transport, and insurance for the move |
The order of the work
- Fix the exit date and work back. Find the lease or colocation end date, the notice period and any penalties for staying late. Every other date comes from this one.
- Build the inventory from more than one source. Compare the asset register, the configuration management database, the virtualization manager, network scans and a physical walk of every rack. Reconcile the differences before planning waves.
- Map dependencies. Record which systems talk to which, using network flow data as well as interviews. Systems that depend on each other move in the same wave.
- Decide each system's destination, with a named owner who signs off the decision.
- Order circuits and the target environment early. Lead times for network circuits and cross-connects at a new site are set by the carrier or provider, not by you.
- Migrate in waves. Plan a rollback for each wave. Keep the source running until the owner accepts the move.
- Stop the services. End maintenance contracts, software support, circuits and monitoring for the site as each piece empties.
- Sanitize and dispose. Sanitize data-bearing media, record each device, and hand the hardware to a certified recycler or reseller.
- Hand back the space. Meet the restoration terms in the lease and get written acceptance from the landlord or provider.
Leave time for these
- Discovery. Undocumented servers, appliances bought by business units and systems whose owner left years ago can surface late. Each needs an owner and a decision before it can move.
- Dependencies nobody wrote down. Hard-coded IP addresses, file shares mapped by scripts, and batch jobs that run once a quarter can break after the move, not during it.
- Contract exits. Finding every contract tied to the site, and its notice period, takes procurement and legal time. Put it in the project plan.
The detail plans leave out
Servers are the obvious data-bearing devices. They are not the only ones.
- Everything with storage. NIST SP 800-88 notes that many items contain several types of storage media that can need different sanitization methods. Storage arrays, network switches, firewalls, backup appliances, tape libraries and out-of-band controllers all belong on the sanitization list.
- Statements of volatility. NIST suggests asking vendors which components of a device may hold sensitive data, which vendors typically document in a statement of volatility. It cautions that vendors state these details differently. Collect them during inventory, not at disposal.
- Batteries. Batteries are one of EPA's federal universal waste categories. Spent lead-acid batteries managed under 40 CFR part 266 subpart G follow that subpart instead. States may add their own universal wastes, so check your state's rules for UPS batteries.
- Cooling equipment. EPA requires refrigerant to be recovered, under its servicing requirements, from equipment dismantled on site, such as chillers, before disposal.
- Backups and replicas. Data copied to tapes, offsite vaults and disaster recovery sites has to follow the same retire, move or sanitize decision as the source.
Media sanitization and disposal records
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was published in September 2025 and supersedes Rev. 1 from 2014. It defines three methods. Clear uses logical techniques against simple, non-invasive recovery through the normal interface. Purge makes recovery infeasible with state-of-the-art laboratory techniques and can leave the media reusable. Destroy makes recovery infeasible and leaves the media unusable.
Rev. 2 no longer lists technique details for each media type. Apart from cryptographic erase, it points to IEEE 2883, NSA specifications or an organizationally approved standard. It states that multi-pass overwrite is not needed for clear, countering the obsolete DoD 5220.22-M language. It warns that overwriting is not effective on flash media with spare cells, and that degaussing should not be used on SSDs and is not a destroy technique.
Media leaving your control, through a lease return, resale, donation or a recycler, needs a sanitization decision first. NIST notes that some laws treat losing control of unsanitized media as a data breach.
NIST recommends a certificate of sanitization for each device. It should record the manufacturer, model, serial number, media type, method, technique, tool and version, verification method, and the name, title, date, location and signature of the person who verified it. Require that record from any contractor, matched to your inventory by serial number.
EPA recommends certified electronics recyclers and names two accredited standards, R2 and e-Stewards. Both require destruction of all data on used electronics. The e-Stewards standard also requires NAID AAA data security certification and prohibits exporting hazardous electronic waste from developed to developing countries.
Contracts and cost
- The lease or colocation agreement. Check the notice period, holdover charges for staying past the end date, and what restoration the space needs: removing cabling, raised floor or equipment you installed.
- Double running. The old site and the new destination both cost money for the length of the migration. Budget for the overlap at the planned length and at a slipped length.
- Support and maintenance contracts. Hardware support, software licenses tied to on-site hardware and carrier circuits may renew automatically. List each with its renewal and notice dates.
- Disposal. Sanitization, removal and recycling cost money. Resale can offset some of it. Agree who keeps the proceeds.
- Leased hardware. Equipment returned to a lessor leaves your control, so it needs sanitization before return. NIST names lease returns as one reason to choose purge over destroy, since purge can leave the media usable.
Skills and operations
Staff whose jobs end with the site may hold knowledge nobody else has. Agree retention terms with them early, or the knowledge can leave before the last wave.
A decommissioning needs a coordinator with authority over the exit date, not only an infrastructure lead. Application owners, procurement, legal, facilities and security all hold pieces of the work, and each can delay it.
Settle these first
- What is the exit date, the notice period, and the charge for staying late?
- Who owns each system, and who signs off its destination?
- Which systems will be retired rather than moved?
- Which devices hold data, including network and storage gear?
- Which sanitization standard will you require, and what record proves each device was done?
- Which certified recycler or reseller will take the hardware, and who keeps resale proceeds?
Questions
- Is a multi-pass overwrite required to sanitize drives?
- No. NIST SP 800-88 Rev. 2 states that multi-pass overwrite is not needed for clear, and that it gives little protection on SSDs with overprovisioning. Use purge or destroy where more assurance is needed.
- Can we degauss SSDs?
- No. NIST says degaussing should not be used on non-magnetic media such as SSDs. A degausser can complete its cycle on an SSD without sanitizing any data.
- What should a certificate of sanitization include?
- NIST lists the manufacturer, model, serial number, media type, sanitization method and technique, tool and version, verification method, and details and signature of the person who verified it.
- Do we need a certified electronics recycler?
- EPA recommends one. It names two accredited certification standards, R2 and e-Stewards, both of which require destruction of all data on used electronics.