ADISA Certified Data Erasure Explained

When an auditor asks how retired laptops were sanitised, “we wiped them” is not an acceptable answer. ADISA-certified data erasure may be relevant when a contract, tender, sector rule or internal policy requires independent certification. For organisations handling customer records, employee data, financial information or protected health data, that distinction can separate a clean disposition process from an avoidable compliance failure.

Independent certification is one form of assurance. It may be required by procurement rules or customer contracts. Always check the current certificate status and scope of any product or service before relying on certification claims for policy or contractual decisions.

What is ADISA certified data erasure and why does it matter?

ADISA certified data erasure means an erasure product, process or service has been independently tested by ADISA against a defined claim or standard, within a stated scope. It matters because it gives buyers, auditors and contract owners third-party evidence rather than relying on a vendor's own description, but only for what the current certificate actually covers.

How does ADISA certification work in practice?

A vendor or service provider submits a specific claim, such as erasing defined drive types to a stated level, and ADISA has it independently tested. A successful result is recorded on a certificate with a scope and validity period, which buyers should check before relying on it.

ADISA is a security-focused body best known in the IT asset disposition space for setting expectations around secure data sanitisation, operational controls and verification. In practical terms, ADISA certified data erasure refers to an erasure process or solution that has been independently assessed against defined standards for removing data from storage media, with the aim of making practical recovery infeasible within the scope assessed.

That matters because not every wipe is equal. A basic delete removes file references, not the underlying data. A quick format can leave recoverable information behind. Even some built-in reset functions vary by device type, storage architecture and implementation. An independently assessed erasure process is intended to address that uncertainty within its assessed scope, with a repeatable method, verification and records.

For IT teams, the real value is not the label by itself. The value is what the label should represent: consistent sanitisation, reduced human error and evidence that the organisation followed a recognised process.

Why independent assessment matters in operations

Most data exposure during asset retirement does not happen because a team ignored security. It happens because the process broke under volume, time pressure or inconsistent tooling. An organisation may have hundreds of endpoints to remove during a hardware refresh, a deadline tied to lease return and multiple technicians handling equipment across locations. That is where independent assessment requirements become operational, not just procedural.

An ADISA-certified product or process can support a controlled workflow within the scope of its current certificate. The device is identified, the erasure method is applied, the result is verified and a report is produced. Each step supports audit readiness and reduces the chance that a device leaves custody with recoverable data still on it.

This is especially relevant for MSPs, ITAD providers, healthcare organisations, financial firms, schools and any business that offboards employees at scale. If you redeploy assets internally, resell them, donate them or send them to recycling, you need more than a best-effort wipe. You need a process that stands up to scrutiny.

Does ADISA certification make you compliant?

No. Certification is evidence about a product or service within a defined scope; compliance still depends on your own policy, method choice, records and controls.

ADISA certification does not replace your compliance obligations. It supports them.

Regulations and frameworks such as GDPR, HIPAA, NIST guidance and internal security policies generally require secure disposal or sanitisation of data-bearing devices. They do not all prescribe the same workflow, and they do not treat every medium the same way. What they do require is reasonable, effective protection of sensitive data throughout the device lifecycle.

An independently assessed erasure process can strengthen your position by demonstrating a recognised method, creating documentation for audits or customer requests, and giving compliance teams a clearer evidence trail than manual checklists. Still, certification is not a shortcut. Confirm that the erasure method fits the media type, that reports are retained properly and that your internal process covers custody, technician access and exception handling.

What should you check before relying on a certified erasure product?

Check that the certificate is current, what exactly it covers (product version, media types, methods), and who issued it. Then confirm the product still suits your hardware and produces the records you need.

The word “certified” gets used loosely in the market. Some vendors mean their software supports recognised overwrite methods. Others mean a process has been independently tested. Buyers should separate marketing language from verifiable claims.

• Confirm what exactly is certified: the software, the erasure process, the service provider or the reporting workflow.
• Verify which device types are covered. A process suited to spinning hard drives may not translate directly to SSDs, NVMe drives or mobile devices.
• Look closely at reporting. A usable erasure certificate should identify the device, document the method, record the result and support traceability back to the asset.
• Consider operational fit. Controls only work when technicians can execute them consistently under pressure.

If a tool is difficult to deploy, tied to recurring licences or limited by per-device costs, teams tend to cut corners or delay sanitisation. Check the current certificate and its scope before treating certification as a procurement or policy requirement.

Erasure versus physical destruction

Software sanitisation can preserve suitable hardware for reuse, resale, lease return or redeployment when the method, media and reported result support that outcome. Physical destruction renders the media unusable. If your goal is to recover asset value, erasure is usually the better path, provided the drive is healthy and the method is appropriate for that media.

There are cases where destruction remains the right option. Failed drives, damaged media, high-security environments or devices that cannot complete a verified wipe may need shredding or another approved destruction method. Apply the right control to the right asset and keep evidence for either path.

Where independent assessment helps most

The strongest return usually shows up in high-volume, repeatable workflows such as employee offboarding, hardware refresh projects and ITAD or resale preparation. Without a simple erasure method and clear reporting, retired devices become a storage problem, a compliance problem or both.

A USB-based erasure workflow can reduce setup time, simplify technician training and support repeatable results across device fleets. For teams managing sanitisation regularly, unlimited use and no subscription can also change the economics. The cost model affects behaviour: if every wipe carries friction or added licensing expense, throughput suffers.

We designed RedKey USB, our reusable bootable wipe tool, for that operational pattern. To be clear about our own position: RedKey USB does not currently hold ADISA certification or any other product certification, and our certification notice sets out the current status. Independent certification status for any product can change over time. Do not assume a tool is ADISA certified unless you have verified the current certificate and scope. Use certification as one input alongside method suitability, reporting quality and your own process controls.

Common mistakes teams make

Common mistakes include treating a factory reset as formal sanitisation, ignoring SSD and NVMe differences, skipping retained wipe reports, and leaving failed drives without an exception path. The best erasure process is the one your team can execute correctly every time, with consistent output and defensible records.

How to evaluate your current process

Start with a simple question: can you show, for any given retired device, what method was used, who performed it, when it was completed and what the result was? If the answer is no, the process needs work.

Then look at scale. Can your team handle a surge of devices without skipping verification or losing documentation? Can the same process be applied across laptops, desktops and supported mobile hardware? Does the tool align with recognised standards and produce records your compliance team will trust?

Independent assessment is not a substitute for the organisation’s own controls. Check the current certificate and its scope, the selected method and the reported result before a device leaves service. If the workflow cannot produce a reliable record on demand, tighten it before release.

Frequently asked questions

Is RedKey USB ADISA certified?

No. RedKey USB does not currently hold ADISA certification or any other product certification. Our certification notice explains the current position, and we recommend checking any vendor's current certificate and scope before relying on it.

What does ADISA test?

ADISA runs several schemes. In its Product Claims Test, a laboratory checks whether a product achieves the erasure outcome its vendor claims for defined media types, and other schemes assess service providers such as IT asset disposal companies. Each certificate has its own scope and validity dates.

Do I need an ADISA certified product?

Only if a contract, tender, sector rule or internal policy requires it. Otherwise, a suitable method for each media type, checked results and complete records, aligned with NIST SP 800-88 Rev. 2 and IEEE 2883, are what make a process defensible.

Does NIST certify erasure software?

No. NIST SP 800-88 Rev. 2 is guidance and NIST does not certify products. A tool that describes a method as "NIST Clear" or "NIST Purge" is using a vendor label, not an independent finding.

Our certification notice sets out RedKey USB's current position in full and is updated when anything changes. Related reading: Certified Data Destruction Explained and Data Destruction Standards That Matter.