How to Recover Value from Retired IT Assets (2026 Guide)

Written and reviewed by the ITAD team at Coretek 360, whose facility is audited to R2v3 and RIOS. About the company.

The world generated 62 million tonnes of e-waste in 2022, and "less than one quarter (22.3%) of the year's e-waste mass was documented as having been properly collected and recycled" (UNITAR, 2024). Some of that mass was working enterprise hardware that could have been resold. Retired laptops, servers, and network gear lose value every month they sit in a storage room. Every drive that leaves the building with data still on it is breach exposure, and IBM puts the global average cost of a data breach at $4.99 million, a record high (IBM, 2026).

This guide covers six steps that return the most money from retired IT assets and leave a paper trail an auditor can follow. The steps come from the daily work of a certified ITAD facility. If you're new to the process, start with what IT asset disposition covers and come back here when the refresh date is on the calendar.

Key Takeaways

• Timing sets the ceiling on recovery. The standard economic estimate is that a PC sheds about half its remaining value every year (NBER, 2004), so plan the exit when the refresh date is set, not after units come off the floor.
• The sanitization method decides whether a drive can be resold. NIST SP 800-88 Rev. 2 prefers purge over clear and says shredding should be reserved for the lowest security categories of data.
• Choose the ITAD partner on certification scope and settlement transparency, not per-unit price. R2v3 requires reuse before other strategies, a written Data Sanitization Plan, and a one-year processing limit.
• Close the project with one record per serial number: what the unit returned, how its media was sanitized, and where anything unsold went.

In this article:

• Before You Begin
• Step 1: Inventory and Classify Every Asset Before It Leaves the Floor
• Step 2: Pick the Sanitization Method That Preserves Resale Value
• Step 3: Value the Fleet While It Still Has Value
• Step 4: Choose a Certified Partner, Not the Lowest Per-Unit Bid
• Step 5: Move It Fast, Documented, and in One Trip
• Step 6: Reconcile the Settlement and Close the Books
• Common Mistakes to Avoid
• What Success Looks Like
• Frequently Asked Questions
• Conclusion
• Sources

Before You Begin

What you'll need:

• An asset inventory export with make, model, age, condition, and serial number for every retiring unit
• A data classification for each device type (what kind of data lived on it, and whether any of it is regulated)
• Named policy owners from IT, security, and finance who can sign off on the sanitization method and the settlement (the provider's itemized report and payment for what each unit returned)
• A target date tied to the hardware refresh or decommission
• Time: inventory and classification happen before pickup. The settlement arrives after testing and resale, so expect the recovered value to land in a later accounting period than the pickup itself.

Timing matters because there is no longer one standard refresh cycle to plan around. In the Uptime Institute's 2026 Global Data Center Survey, 33% of respondents refresh servers every three years or less, 15% at four years, 34% at five years, and 18% at six years or more (Uptime Institute, 2026). ITPro described the market as "increasingly segmented by technology and use case," adding that "the concept of a three-to-four-year refresh cycle feels like something from a bygone era" (ITPro, 2026). Whatever your cycle is, the recovery plan should start the day the refresh date is set.

Step 1: Inventory and Classify Every Asset Before It Leaves the Floor

By the end of this step you'll have one list of every retiring asset by serial number, with its data sensitivity, lease status, and working condition recorded.

The data classification decides the sanitization method in Step 2, the condition drives the valuation in Step 3, and the serial numbers are what the settlement reconciles against in Step 6.

1. Export the inventory from your asset management system, directory, or MDM tool. Include laptops, desktops, servers, storage arrays, network switches, mobile devices, and more.
2. Record make, model, year, and condition for each unit. "Condition" can be as simple as working, cosmetic damage, or failed.
3. Tag data sensitivity per device. Flag regulated data such as electronic protected health information (ePHI), consumer report data, and customer financial data. Use your existing security categories if you have them.
4. Flag leased units and their return terms. Check the lease for return-condition language; a unit that must go back working rules out physical destruction of its drive.
5. Separate working units from failed ones. Working units go on the resale path. Failed units go to component recovery or recycling.

Three US rules that turn on the data class

Each of these rules makes the type of data on a device, not the device itself, decide how it must be handled.

Verification: the number of serials on the list equals the number of physical units staged for pickup, and no row has a blank data class or condition. Healthcare fleets should check the list against their HIPAA disposal requirements.

Step 2: Pick the Sanitization Method That Preserves Resale Value

By the end of this step you'll have a sanitization method assigned to every data-bearing device, chosen so the media stays reusable wherever the data category allows it.

The three NIST methods

NIST SP 800-88 Rev. 2, published in September 2025, supersedes the 2014 Rev. 1 and defines three sanitization methods (NIST, 2025). It uses the term ISM for information storage media.

Purge is the method that protects both the data and the resale value. Section 4.3 says purge "may be more appropriate than destroy sanitization techniques" when the organization has "the desire to reuse the ISM (either within the organization or by selling or donating the ISM)," faces lease returns, or weighs environmental concerns and the cost of the media. Rev. 2 also cautions that "pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data," and that degaussing "should not be used for non-magnetic ISM (e.g., flash storage, such as SSDs)."

Decision flow per device class

Follow the decision flow in NIST Figure 1 for each device class:

1. Decide whether the media will be reused, whether inside your organization, through resale or donation, or as a lease return.
2. Assign the security category (Low, Moderate, or High) from the Step 1 classification.
3. Decide whether the media will leave your control. Media handed to a provider or buyer leaves organizational control.
4. Select clear, purge, or destroy. Purge is the default for reusable media leaving your control. Reserve destroy for media that cannot be purged or that failed testing.
5. Validate the result on the sanitized media.
6. Document the method, the tool, the date, and the operator against the serial number.

Verification: a certificate of sanitization for every serial that names the method used. That certificate matters most for devices that were never encrypted: IBM reports that "only 37% of breached organizations stated that they encrypt sensitive data both at rest and in transit" (IBM Newsroom, 2026). For how purge and destroy are performed and certified in practice, see certified data destruction methods.

Step 3: Value the Fleet While It Still Has Value

By the end of this step you'll have a residual value estimate per asset class, requested before pickup, with a floor you'll accept.

Why the only reliable number is a quote

No current authoritative table of resale value by age exists, so be careful with any number you see quoted. The best-documented rule of thumb is old. A 2004 NBER working paper on PC depreciation found that "PCs lose roughly half their remaining value, on average, with each additional year of use" (NBER, 2004). A 2008 Toshiba white paper stated that "the residual value of a machine drops below 20 percent of its new value by the third year" (Toshiba, 2008). Both describe the market of their time. Current prices depend on the model, configuration, and demand that month, and the only reliable figure is a quote from your provider's remarketing data.

Book value versus market value

Book value and market value are different numbers. Under MACRS, computers and peripheral equipment are 5-year property (IRS Publication 946, tax year 2025). A fully depreciated laptop carries zero book value while a buyer may still pay for it. The settlement in Step 6 records that gap as recovered value.

How to request the valuation

The resale market is where the growth is. MarketsandMarkets reported that "the remarketing & value recovery segment" is expected "to grow at the fastest CAGR" of the ITAD market and that the "computers/laptops segment holds the highest market share in 2023" (MarketsandMarkets, 2024).

1. Group the inventory by class: laptops, desktops, servers, storage, networking, mobile devices, and more.
2. Request a valuation from the inventory, before anything is picked up. A provider with remarketing data can quote by model and condition.
3. Separate the resale path from the recycle path. Failed units and obsolete models go to component recovery or certified recycling; price those as a separate line.
4. Set a floor for each class so the settlement can be judged against something you agreed to in advance.

Verification: a written estimate per class, dated, that states the assumptions (condition, completeness, market at time of quote). The asset value recovery process explains how resale, parts harvesting, and recycling revenue are reported back.

Step 4: Choose a Certified Partner, Not the Lowest Per-Unit Bid

By the end of this step you'll have a provider whose certificate scope covers the work you need and whose paperwork you've already seen.

What R2v3 requires of the facility

R2v3 is the standard that matters for value recovery because it is built around reuse. SERI's highlights sheet sets out the parts a buyer should care about (SERI, 2021):

• Core 2, Hierarchy of Responsible Management Strategies: "Focus remains on reuse before other management strategies. This core principle of R2 is aligned with the global trend towards a more circular economy."
• Core 7, Data Security: "Requires all R2 Facilities to develop a detailed Data Sanitization Plan."
• Appendix C, Test and Repair: the facility "must be certified to Quality Management System standard ISO 9001 or RIOS," "data must be sanitized in accordance with the requirements of Appendix B," and there is a "1 year limit to process equipment and components."
• Core 5: "Prohibits the storage of R2 Controlled and negative value streams for longer than 1 year." A certified facility cannot let your fleet sit.

Four checks before you sign

1. Verify the certificate scope. Ask for the R2v3 certificate and confirm it lists test and repair (Appendix C) and data sanitization (Appendix B).
2. Ask for a sample settlement report and a sample certificate of destruction. You want to see serial-level resale results and the sanitization method named per unit before you sign.
3. Confirm downstream recycling for everything that cannot be resold, including the documentation you'll receive for it.
4. Check the FTC due diligence language. The Disposal Rule allows contracting "with another party engaged in the business of record destruction" after due diligence (16 CFR 682.3(b)(3)). Keep a record of the checks you ran.

Ask what a low per-unit bid assumes about destruction and downstream handling. The settlement, not the handling fee, is where the money is.

Verification: certificate numbers recorded, scope confirmed, sample documents on file. Read what the R2v3 certification requirements and the RIOS quality and safety standard each cover so the scope check is quick.

Step 5: Move It Fast, Documented, and in One Trip

By the end of this step the assets are off site with a chain of custody that runs from your floor to the provider's dock.

Every week the fleet stays on site is a week of depreciation, floor space, and exposure. One scheduled pickup against the refresh date moves everything at once and gives you a single reconciliation to check.

1. Schedule the pickup against the refresh date so retired units never accumulate in a storeroom.
2. Palletize by class (laptops with laptops, servers with servers) so receiving matches the inventory groupings from Step 3.
3. Log serials at pickup. The driver or technician scans each unit against the list before it leaves.
4. Use locked transport. Sealed and tracked vehicles keep the chain of custody unbroken in transit.
5. Receive a reconciliation from the provider that matches what arrived against the inventory you sent, with any variance explained.

Data center decommissions are the case where rack-level logistics decide the outcome. Servers, storage, and switches have to be powered down, de-racked, labeled by rack position, and packed without damage to the components that carry the resale value. A crew that handles white glove pickup and packing and has run a data center decommission before will plan the sequence with you.

Verification: a signed pickup manifest with serials, and a receiving reconciliation with zero unexplained variances.

Step 6: Reconcile the Settlement and Close the Books

By the end of this step you'll hold one record per asset showing what it returned, how its media was sanitized, and where anything unsold went.

1. Match the settlement to the inventory by serial. Every unit on your list should appear once, with a resale amount, a parts value, or a recycling disposition.
2. Book the recovery. Finance records the proceeds against the fully depreciated assets and retires them from the register.
3. File the certificates. Sanitization certificates and certificates of destruction sit with the asset record for the audit period your policy requires.
4. Record final disposition for recycled units, including the downstream documentation from Step 4.
5. Capture the sustainability line. Every unit resold avoided the manufacturing footprint of a replacement.

Dell's life cycle assessment of a Latitude 7300 laptop, in a European five-year use scenario, reported a lifetime footprint of 146.8 kg CO2e, with manufacturing accounting for roughly three quarters of it (Dell, 2019). The European Environment Agency concluded that "extending the lifetime and delaying obsolescence of electronics can significantly reduce impacts" (EEA, 2020); its case studies covered smartphones, washing machines, vacuum cleaners, and TVs rather than laptops, so treat the finding as directional for enterprise hardware.

Verification: every serial reconciled, proceeds booked, certificates filed, and recycling documentation attached for the units that did not sell. For what happens to the material that cannot be reused, see certified electronics recycling.

Common Mistakes to Avoid

Shredding everything by default. Teams shred because it feels final, but NIST SP 800-88 Rev. 2 reserves shredding and pulverizing for the lowest security categories of data (see Step 2). Purge the drive and keep the unit sellable unless the data category or a failed test requires destruction.

Letting retired units sit. Hardware waits in a storeroom because nobody owns the exit date. Under the NBER rule of thumb from Step 3, remaining value halves each year, and R2v3 itself sets a one-year processing limit on certified facilities. Tie the pickup to the refresh date.

No classification before pickup. Without a data class per device, the provider has to assume the highest category and the most destructive method. Finish Step 1 before anyone loads a pallet.

Choosing on per-unit price. A handling fee is a small number next to the settlement. Compare providers on certificate scope, sample settlement reports, and downstream documentation.

Treating destruction as the normal path. Blancco's 2020 survey of 1,850 senior decision makers at organizations with 5,000 or more employees, fielded in August 2019, found that "only a quarter (24 percent) of end-of-life equipment is being sanitized and reused" while "over a third (39 percent) of organizations physically destroy end-of-life IT equipment" (Blancco, 2020). The survey is vendor-run and dated, but it describes a default that costs organizations money. Make reuse the default and destruction the exception.

What Success Looks Like

If the six steps went correctly, you now hold a settlement reconciled by serial number, a sanitization certificate for every data-bearing device, recycling documentation for the units that did not sell, and recovered value booked against assets that had been carried at zero. Nothing is sitting in a storeroom, and nobody has to answer a question about where a drive went.

The stretch goal is a standing calendar. Put the next refresh date and its pickup on the same schedule now, so the recovery plan starts when the purchase order does rather than when the storeroom fills.

Frequently Asked Questions

How much is a 3-year-old enterprise laptop worth on resale?

No current authoritative table exists. The 2004 NBER halving rule cited in Step 3 implies roughly an eighth of original value at year three, and the 2008 Toshiba white paper put residual value under 20 percent by the third year. Both are dated, so ask your provider for a quote from current remarketing data for the specific model and condition.

Do old servers still have resale value, or only parts?

Both paths exist, and testing decides which one a unit takes. Working servers of recent generations can be resold whole; older or failed units are often worth more as components such as processors, memory, drives, and more. What fails testing goes to certified recycling, where the metals still carry value: UNITAR valued the metals embedded in 2022 e-waste at $91 billion worldwide (UNITAR, 2024).

Does NIST 800-88 require shredding, or is wiping enough?

NIST does not require shredding. SP 800-88 Rev. 2 defines clear, purge, and destroy, prefers purge over clear when possible, and reserves shredding and pulverizing for the lowest security categories of data (NIST, 2025). A validated and documented purge is a complete sanitization under the guideline.

Should retired IT equipment be resold, donated, or recycled?

Resold or donated first, recycled last. R2v3's Core 2 keeps the "focus on reuse before other management strategies" (SERI, 2021), and NIST lists "selling or donating the ISM" among the reasons purge may be more appropriate than destroy. Recycling is the right path for units that fail testing or have no market.

What is R2v3 certification and why does it matter when choosing an ITAD vendor?

R2v3 is the current version of the R2 standard for responsible electronics reuse and recycling, administered by SERI. It requires a reuse-first hierarchy, a detailed Data Sanitization Plan, and, for facilities that test and repair, certification to ISO 9001 or RIOS and sanitization per its Appendix B. For a buyer, it means the provider is audited on the exact things that determine recovered value and data risk.

Conclusion

Six steps, in order: inventory and classify, choose a sanitization method that keeps media reusable, value the fleet before pickup, pick a partner on certificate scope, move everything in one documented trip, and reconcile the settlement by serial. Run that way, a hardware refresh returns money to the budget instead of consuming it, and the paperwork writes itself as the work happens. If you have a refresh or decommission coming, send Coretek 360 your inventory for a residual value estimate through the contact page.

Sources

• UNITAR, "Global E-waste Monitor 2024: Electronic Waste Rising Five Times Faster than Documented E-waste Recycling," press release, March 20, 2024. https://unitar.org/about/news-stories/press/global-e-waste-monitor-2024-electronic-waste-rising-five-times-faster-documented-e-waste-recycling
• IBM, "Cost of a Data Breach Report," 2026. https://www.ibm.com/reports/data-breach
• IBM Newsroom, "IBM Study: One in Four Malicious Breaches Are AI-Enabled, Costing Companies $6 Million on Average," July 29, 2026. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
• NBER, Working Paper 10521, Doms, Dunn, Oliner, and Sichel, "How Fast Do Personal Computers Depreciate?", May 2004. https://www.nber.org/papers/w10521
• Toshiba, "Old Laptops Can Put Business at Risk," white paper, 2008. https://us.dynabook.com/content/pc/b2c/downloads/tech-brief-pdfs/Old-Laptops-Can-Put-Business-at-Risk.pdf
• IRS, Publication 946, "How To Depreciate Property," tax year 2025. https://www.irs.gov/publications/p946
• MarketsandMarkets, "IT Asset Disposition Market," press release, January 2024. https://www.marketsandmarkets.com/PressReleases/it-asset-disposition.asp
• Uptime Institute, "Data Center Capacity Growth Trends: Findings from the 2026 Global Data Center Survey," August 2026. https://datacenter.uptimeinstitute.com/rs/711-RIA-145/images/2026%20Annual%20Survey%20Data%20Center%20Growth%20v6.pdf?version=0
• ITPro, "The havoc of modern refresh cycles: why the enterprise is all over the place on revitalizing hardware," October 7, 2026. https://www.itpro.com/infrastructure/the-havoc-of-modern-refresh-cycles-why-the-enterprise-is-all-over-the-place-on-revitalizing-hardware
• NIST, SP 800-88 Rev. 2, "Guidelines for Media Sanitization," September 2025. https://csrc.nist.gov/pubs/sp/800/88/r2/final
• SERI, "R2v3 Highlights Sheet," 2021. https://sustainableelectronics.org/wp-content/uploads/2021/03/Highlights-Sheet-2021.pdf
• Dell, "Life Cycle Assessment of Dell Latitude 7300 25th Anniversary Edition," August 2019. https://www.delltechnologies.com/resources/en-id/asset/data-sheets/products/laptops/lca-latitude_7300_25th_anniv_notebook.pdf.external
• European Environment Agency, "Europe's consumption in a circular economy: the benefits of longer-lasting electronics," briefing, June 18, 2020. https://www.eea.europa.eu/en/analysis/publications/europes-consumption-in-a-circular-economy-the-benefits-of-longer-lasting-electronics
• Blancco, "Enterprises Failing to Comply with Sustainability Policies," survey with Coleman Parkes, April 21, 2020 (fieldwork August 2019). https://blancco.com/enterprises-failing-to-comply-with-sustainability-policies/
• Legal Information Institute, 45 CFR 164.310, HIPAA Security Rule physical safeguards. https://www.law.cornell.edu/cfr/text/45/164.310
• Legal Information Institute, 16 CFR 682.3, FTC Disposal Rule. https://www.law.cornell.edu/cfr/text/16/682.3
• FTC, "Disposing of Consumer Report Information? Rule Tells How." https://www.ftc.gov/business-guidance/resources/disposing-consumer-report-information-rule-tells-how
• Legal Information Institute, 16 CFR 314.4, GLBA Safeguards Rule. https://www.law.cornell.edu/cfr/text/16/314.4