What happens to old computers and hard drives when we replace them?

Almost every business we take over has a pile of retired equipment somewhere, and almost nobody knows what is on it. Those drives usually hold customer records, financial data, saved passwords, and in a medical or dental practice, patient information. A storage room is not a control, and disposal is an obligation under most of the frameworks our clients fall under.

What we do: drives are wiped to a recognized sanitization standard when they are reusable, and physically destroyed when they are not, with documentation of what was destroyed and when. That certificate is what an auditor or an examiner wants to see, and it is also what turns a lost laptop into a non-event if the drive was encrypted.

The stack you already have gets dealt with during onboarding. It is one of the quickest risks to eliminate and one of the most commonly ignored, because nothing about it feels urgent until a drive walks out of the building.