Walk into any enterprise approaching a hardware refresh and the same conversation plays out: security wants destruction, finance wants recovery, operations wants both done by Friday. The compromise that emerges — usually a combination of “wipe it ourselves” and “sell what we can to a broker” — is the worst of both worlds. It loses value AND creates exposure.

When retired hardware moves through bulk-disposal vendors or unvetted brokers, the headline number looks attractive. What gets missed is the loss profile underneath. Equipment sold without proper grading, testing, and remarketing typically clears at 15–30% of fair market value. The same hardware run through a certified channel — tested, documented, and placed with qualified buyers — often recovers multiples of that. The “savings” from skipping certified sanitization get repaid many times over in suppressed recovery.

Under HIPAA, GDPR, CCPA, NYDFS Part 500, and most financial services frameworks, hardware that leaves your custody without documented sanitization remains your liability. Morgan Stanley is the textbook case: a moving company hired to save roughly $100,000 on decommissioning sold thousands of drives onto auction sites with customer data intact. The result was a $60M OCC fine, a $35M SEC penalty, and a $60M consolidated class-action settlement. The hardware was worth a fraction of any one of those figures.

NIST SP 800-88 Rev. 1 is the standard regulators expect. Drives are Cleared, Purged, or Destroyed depending on classification — with cryptographic erasure on self-encrypting drives, ATA Secure Erase on SSDs, and physical destruction reserved for media that can’t be sanitized in place. Each unit is logged by serial number and tied to a Certificate of Sanitization. That’s what “documented” means in a regulatory context. A spreadsheet is not documentation.

A defensible chain captures every transfer point — pickup, transport, receipt, sanitization, remarketing, final disposition — each tied to a serialized record. If a unit ends up somewhere it shouldn’t, you can prove where the chain held and where it broke. That’s the difference between a contained incident and a regulatory event.

Buyers in the secondary market pay premiums for hardware with documented provenance, certified sanitization, and known operational history. The same enterprise GPU that recovers cents on the dollar through a bulk channel routinely clears at multiples of that when properly graded, tested, and remarketed with documentation. Storage, networking, and standard server hardware show similar spreads. The audit trail isn’t overhead — it’s a value driver.

Advanced GPUs, certain networking gear, and a growing list of components fall under EAR or ITAR restrictions. Selling to the wrong end-user — even unknowingly, even through a broker — is a federal compliance issue. A serious disposition program screens buyers, geographies, and end uses before any unit moves.

The enterprises getting this right aren’t choosing between security and value. They’re recognizing that the controls protecting them are the same controls maximizing recovery. Same decision, same outcome.