Third-Party Risk Management and IT Disposal

Your Risk Doesn’t End at the Loading Dock

When you hand IT equipment to a third-party disposal provider, your legal and regulatory obligations don’t transfer with it. Under the Privacy Act, ISO 27001, APRA CPS 234, and virtually every other compliance framework, the organisation that generated the data remains responsible for its security throughout the disposal process, regardless of who physically performs the destruction.

This means third-party risk management for IT disposal isn’t optional. It’s a core compliance requirement that demands the same rigour you apply to any other critical vendor relationship.

Why Third-Party Disposal Risk Matters

Several factors make disposal providers a particularly important category of third-party risk:

They handle your most vulnerable data. Data on decommissioned devices is data that’s left the protection of your active security controls. It’s no longer behind your firewall, no longer subject to your access controls, and no longer monitored by your security tools.

The consequences of failure are severe. A data breach from improperly handled disposal equipment triggers notification obligations, regulatory scrutiny, reputational damage, and potential litigation. And because disposal data is often historical, it may include records spanning years of operations.

Visibility is limited. Once equipment leaves your premises, your ability to directly observe what happens to it is reduced. You’re relying on the provider’s processes, integrity, and competence.

The market is variable. The ITAD and e-waste recycling industry includes excellent, certified operators alongside less scrupulous ones. The quality difference isn’t always visible from the outside.

Pre-Engagement Due Diligence

Before engaging any disposal provider, conduct thorough due diligence. This assessment should cover:

Certifications: Verify current certifications. Key ones include ADISA (forensic-tested data destruction), ISO 27001 (information security management), AS/NZS 5377 (e-waste handling), and ISO 14001 (environmental management). Request copies of current certificates and verify them independently.

Facility assessment: Visit the provider’s processing facility. Assess physical security (access controls, CCTV, perimeter security), the processing environment (equipment, cleanliness, organisation), and staff professionalism. A site visit tells you more than any brochure.

Process review: Understand exactly how the provider handles equipment from collection through to destruction. What security controls exist at each stage? How is chain of custody maintained? What destruction methods are used? How is destruction verified?

Insurance: Confirm the provider carries adequate insurance including public liability, professional indemnity, and cyber liability. Request certificates of currency and check coverage limits against your risk assessment.

References: Request and check references from organisations of similar size and industry. Ask references about reliability, documentation quality, responsiveness, and any issues encountered.

Financial stability: A provider that goes out of business while holding your equipment creates a significant problem. Basic financial due diligence (checking company status, reviewing available financial information) helps assess this risk.

Contractual Controls

The contract with your disposal provider is your primary mechanism for establishing expectations and accountability. Key contractual elements include:

Service specifications: Clearly define what services the provider will deliver, including collection, transport, data destruction, material recycling, and reporting. Avoid vague language. Specify the destruction methods to be used and the standards to be followed.

Data destruction requirements: Specify the destruction standard (NIST 800-88 Purge, physical destruction to specified particle sizes, etc.), verification requirements, and certificate of destruction format and content.

Chain of custody obligations: Require documented chain of custody from collection to destruction, including manifest signing, transport security, and receipt confirmation.

Security requirements: Specify the minimum security controls the provider must maintain, including physical security at their facility, staff screening, and information security practices.

Reporting and documentation: Define what documentation the provider must deliver and by when. This includes collection manifests, processing reports, certificates of destruction, and any incident reports.

Audit rights: Reserve the right to audit the provider’s facility, processes, and records at reasonable notice. This is essential for ongoing assurance and is a standard expectation under most compliance frameworks.

Incident notification: Require the provider to notify you immediately of any security incidents, breaches, or deviations from the agreed process. Define what constitutes an incident and the notification timeline.

Liability and indemnification: Address liability for breaches caused by the provider’s failure to follow the agreed process. Include appropriate indemnification clauses.

Subcontracting restrictions: Specify whether the provider can subcontract any part of the service, and if so, require the same standards to apply to subcontractors.

Ongoing Monitoring

Due diligence is not a one-time exercise. Ongoing monitoring ensures the provider continues to meet your requirements throughout the relationship.

Certificate renewal tracking: Monitor the expiry dates of the provider’s certifications and request copies of renewals. A lapsed certification may indicate problems.

Performance metrics: Track key performance indicators such as turnaround time from collection to certificate delivery, accuracy of manifests and certificates (discrepancy rate), responsiveness to queries and issues, and any incidents or near-misses.

Periodic reassessment: Conduct a formal reassessment of the provider at least annually. This should include a review of their certification status, insurance, performance, and any changes to their operations. A facility visit every 1-2 years is recommended.

Spot checks: Periodically verify the provider’s process through spot checks. This might include requesting evidence of destruction for specific assets, visiting unannounced (if your contract permits), or testing whether tamper-evident seals are intact on arrival at the provider’s facility.

Managing Multiple Providers

Some organisations use multiple disposal providers for geographic coverage, redundancy, or specialisation. Managing multiple providers requires a consistent framework applied across all of them.

Use the same due diligence assessment criteria, the same contractual standards, and the same monitoring approach for every provider. Maintain a provider register that tracks certification status, contract terms, and performance for each. Compare performance across providers to identify best practices and issues.

Having multiple providers also reduces concentration risk. If one provider experiences problems (loss of certification, business failure, security incident), you have alternatives already assessed and contracted.

When to Change Providers

Certain events should trigger a reassessment of whether to continue with a disposal provider:

Loss of a key certification (ADISA, ISO 27001) without a clear path to renewal. A security incident at the provider’s facility, particularly one involving customer data. Consistent discrepancies between manifests and certificates. Deterioration in the condition or security of their facility. Change of ownership that introduces uncertainty about continued capability. Failure to meet contractual SLAs repeatedly. Inability to adapt to new requirements (new device types, new standards, changed regulatory expectations).

Third-party risk management for IT disposal is about maintaining control over your data even when you no longer have physical possession of the devices. The investment in proper vendor management is modest compared to the potential consequences of entrusting your most sensitive data to an unvetted provider.

For more on selecting and evaluating providers, see our guide on how to choose an ITAD provider and our complete guide to data destruction.

EWV helps Victorian businesses manage e-waste and IT asset disposal compliantly and sustainably — including collection, certified data destruction, and recycling. Contact us for a free quote.