Secure Mobile Device Disposition: Enterprise Fleet Playbook

Key Takeaways for Secure Mobile Disposition

• Secure mobile disposition depends on per-device sanitization, documentation and certification aligned to NIST SP 800-88 Rev. 2 so data becomes irrecoverable and every custody transfer remains traceable.
• The six-step checklist covers intake, MDM unenrollment, sanitization method selection, verification, chain-of-custody logging and issuance of per-device Certificates of Sanitization that satisfy CMMC 2.0 and FISMA audits.
• Clear, Purge and Destroy methods must match media type and data classification. Purge uses cryptographic erasure for devices leaving the organization, and Destroy applies when verification cannot be confirmed.
• Serial-number-level chain-of-custody logs and Certificates of Sanitization are mandatory for compliance. Batch certificates fail audit requirements under NIST SP 800-88 Rev. 2 Section 5.
• Premier Logitech delivers this full chain-of-custody program at enterprise scale with CMMC, NIST, SOC 2, TAA and ISO credentials. Talk to a lifecycle expert to design a secure mobile device disposition program built for fleet size, compliance tier and value-recovery goals.

Six-Step Secure Mobile Device Disposition Checklist

This checklist applies to every individual device in the fleet, not to batches.

1. Intake and manifest. Record the manufacturer, model, IMEI and serial number of every device on arrival. No device enters the workflow without a confirmed serial number in the manifest. Cross-reference the manifest against the client asset list before processing begins.
2. MDM unenrollment. Remove devices from Apple Business Manager, Microsoft Intune, Jamf Pro or VMware Workspace ONE before sanitization. Approximately 30 percent of devices arrive at ITAD facilities still enrolled in MDM platforms, which creates holding queues that block erasure and remarketing until client IT teams complete unenrollment. For Android Enterprise devices, issue the factory reset through the MDM platform rather than manually to avoid leaving the device in a re-enrollment state.
3. Sanitization method selection. Classify each device by media type and FIPS 199 data sensitivity tier. Select Clear for low-risk internal reuse. Select Purge, which uses cryptographic erasure at the AES-256 controller level, for devices leaving the organization. Select Destroy for classified or high-sensitivity data where no residual risk is acceptable. A factory reset can qualify as Clear sanitization under NIST SP 800-88 for some flash storage devices such as phones where rewriting is unsupported, provided the interface does not allow data retrieval.
4. Verification. Confirm the sanitization outcome per device using software-generated pass or fail reports from tools such as Blancco Mobile, BitRaser or equivalent. NIST-compliant Purge methods for SSDs and NVMe drives include cryptographic erasure under Section 3.2 conditions with verification and block erase on flash-based media meeting those conditions. Devices that cannot meet verification requirements require physical destruction.
5. Chain-of-custody logging. Record every custody handoff with date, time, origin, destination, named custodians, serial number, asset tag, media type, condition notes, transport controls and acknowledgments from both parties. Batch certificates fail NIST SP 800-88 Rev. 2 Section 5 audit requirements. Serial-number-level records are mandatory.
6. Certification. Issue a per-device Certificate of Sanitization listing device details, sanitization methodology and tool version, verification results and chain-of-custody cross-references. An MDM remote wipe command alone does not constitute a NIST SP 800-88 Rev. 2 Certificate of Sanitization.

Disposition Decision Framework for Clear, Purge and Destroy

The six-step checklist requires a sanitization choice for every device, and that choice controls compliance and value recovery. This framework connects each NIST SP 800-88 Rev. 2 method to its audit scope and resale potential so teams can route devices correctly from the start.

Clear uses overwrite for low-risk internal reuse and does not satisfy requirements for devices leaving the organization. Devices remain eligible for internal redeployment when condition allows.

Purge uses cryptographic erasure at the AES-256 controller level for SSDs, NVMe, M.2 and embedded flash. This method satisfies CMMC 2.0 Level 2 and above and meets NIST SP 800-171 MP.L2-3.8.3 for CUI-handling contractors. Viable hardware can recover resale value on the secondary market.

Destroy uses shredding, disintegration or pulverization. This method meets all CMMC tiers and FISMA requirements and serves as the mandatory fallback when Purge verification cannot be confirmed.

Chain-of-Custody Log Fields for Retired Mobile Devices

A complete chain-of-custody log proves which device moved where, when and under whose control. The following template captures the minimum fields required for a defensible ITAD chain-of-custody log, and each field supports a specific audit question.

• Device Identifier: Serial number and IMEI, both required for mobile devices
• Asset Tag: Client-assigned asset tag number
• Equipment Type: Smartphone, tablet or mobile endpoint
• Media Type: Embedded flash, NVMe or M.2
• Starting Condition: Functional status, cosmetic grade and MDM enrollment status
• Collection Event: Date, time, location and custodian name at origin
• Transport Controls: Carrier, tracking number and tamper-evident seal ID
• Receiving Custodian: Name, title, facility and date and time of receipt
• Processing Handoff: Technician ID, sanitization method applied, tool and version
• Verification Result: Pass or fail with verification log reference
• Final Disposition: Remarketed, refurbished, recycled or destroyed
• Cross-Reference: Work order number and Certificate of Sanitization number
• Acknowledgment Signatures: Releasing and receiving custodians from both parties

Certificate of Data Destruction Requirements

A Certificate of Sanitization is defensible only when it lists each device by serial number or asset tag, identifies the media type and sanitization method, records the date, location and technician identifier and references the chain-of-custody log. The checklist below reflects NIST SP 800-88 Rev. 2 per-device certificate requirements and 2026 CMMC audit expectations.

• Device manufacturer, model, serial number and IMEI
• Asset tag and client work order number
• Media type such as embedded flash, NVMe or M.2
• Data classification tier at time of retirement
• Sanitization method applied: Clear, Purge or Destroy
• Tool name, version and configuration used
• Verification result with pass or fail status and verification log reference
• Technician identifier and facility location
• Date and time of sanitization event
• Chain-of-custody log cross-reference number
• Final disposition path such as remarketed, refurbished, recycled or destroyed
• Authorized signatory name and title

NIST SP 800-88 Rev. 2 highlights the need for detailed sanitization documentation to support audit reviews, and batch certificates often fail to meet that standard. HIPAA-covered entities must retain these records for at least six years after creation or last effective date.

When to Destroy vs. Refurbish Mobile Fleet Devices

Data classification drives the disposition decision before any device leaves the premises. Classification occurs first and directly determines treatment.

Devices that held regulated or classified data and cannot pass independent Purge verification require physical destruction regardless of remaining hardware value. Physical Destroy-level sanitization through shredding, disintegration or pulverization is the only category unconditionally compliant for all media types.

Devices that pass that verification threshold are candidates for certified refurbishment and secondary-market remarketing. Routing these viable assets to remarketing before directing non-viable units to certified recycling maximizes residual value while maintaining compliance. A mature ITAD program becomes partly self-funding through value recovery rather than operating only as a cost center.

Premier Logitech holds TAA, SOC 2, ISO 9001/14001, NIST and CMMC credentials that support both paths. Certified refurbishment and grading capabilities route recoverable devices to secondary-market channels, while secure data destruction services handle Destroy-path devices with full chain-of-custody documentation. Blancco’s 2025 State of Data Sanitization Report found that for 17 percent of respondents who experienced data breaches or leaks, redeployed assets with left-behind sensitive data were involved, which underscores the risk of skipping certified sanitization on refurbishment-path devices.

CMMC-Compliant Mobile Disposition for Defense Contractors

CMMC 2.0 Level 2 and above requires defense contractors to implement NIST SP 800-171 Practice MP.L2-3.8.3 for sanitization or destruction of media containing CUI before disposal. Noncompliance risks contract termination or debarment during C3PAO assessments.

DFARS 252.204-7012 requires contractors handling covered defense information, including CTI, to implement NIST SP 800-171 and to report cyber incidents within 72 hours via DIBNet while preserving affected media for 90 days after discovery of an incident.

NIST SP 800-88 Rev. 2 deprecates DoD 5220.22-M, so any disposition program that still references that overwrite standard fails CMMC audit requirements for CUI-handling contractors.

Premier Logitech holds CAGE Code 4WAJ9 as a pre-vetted U.S. federal government partner and operates under NIST, CMMC, SOC 2, TAA and ISO frameworks. These credentials position Premier Logitech to execute CMMC-compliant mobile disposition programs that produce per-device sanitization records and chain-of-custody documentation required during C3PAO assessments. NAID AAA certification from i-SIGMA provides unannounced third-party audits that confirm an ITAD vendor’s processes, personnel background checks, equipment and chain-of-custody protocols meet NIST Purge and Destroy standards. Enterprises benefit from requiring this benchmark of any disposition partner.

Talk to a lifecycle expert about CMMC-compliant mobile disposition for defense programs.

Conclusion: Turning Mobile Retirement into a Defensible Process

Fragmented mobile device retirement creates audit exposure, data leakage risk and compliance violations at scale. The six-step checklist, disposition decision framework and chain-of-custody templates in this playbook give Directors of Reverse Logistics, Supply Chain and Lifecycle a repeatable, certifiable protocol aligned to NIST SP 800-88 Rev. 2 and CMMC 2.0.

Premier Logitech executes this program end to end, including intake, MDM unenrollment, sanitization, verification, chain-of-custody logging and per-device certification, for enterprise fleets, OEMs and government agencies across the United States. Every device receives a serial-number-level audit trail that withstands C3PAO and FISCAM review.

Talk to a lifecycle expert to design a secure mobile device disposition program built for fleet size, compliance tier and value-recovery goals.

Frequently Asked Questions

What is the difference between Clear, Purge and Destroy for mobile devices?

Clear uses overwrite techniques suitable for low-risk internal reuse but does not satisfy requirements for devices leaving the organization. Purge requires cryptographic erasure at the AES-256 controller level for flash-based mobile storage, including embedded flash, NVMe and M.2 media, because wear leveling and overprovisioning make some regions inaccessible to simple overwrites. Destroy uses shredding, disintegration or pulverization and is unconditionally compliant for all media types when Purge verification cannot be independently confirmed or when devices held classified or high-sensitivity data. The selection depends on the device media type and the FIPS 199 data classification of the information it stored.

Why does MDM unenrollment need to happen before sanitization, and what happens if it is skipped?

MDM unenrollment serves as a prerequisite for compliant sanitization and downstream resale value. For iOS devices, unenrollment from Apple Business Manager followed by factory reset destroys the Secure Enclave key and renders encrypted data permanently inaccessible. For Android Enterprise devices, the factory reset must be issued through the MDM platform to avoid leaving the device locked in a state that requires re-enrollment. As noted in step 2 of the checklist, devices still enrolled in MDM platforms create processing holds that delay sanitization and block remarketing. Skipping unenrollment also leaves Activation Lock, Android Factory Reset Protection or Windows Autopilot registration active, which locks devices to the original organization and eliminates resale value.

What documentation does a Certificate of Data Destruction need for CMMC 2.0 or NIST review?

A compliant Certificate of Sanitization must be issued per device, not per batch, and should mirror the checklist in the Certificate of Data Destruction Requirements section. At a minimum, it records device identifiers, media type, data classification, sanitization method, tool details, verification result, technician and facility, event timestamp, chain-of-custody reference, final disposition and an authorized signatory. The standard emphasizes detailed documentation to support audit reviews. HIPAA-covered entities must retain these records for at least six years after creation or last effective date, and defense contractors maintain them as audit evidence during C3PAO assessments under CMMC 2.0.

How does Premier Logitech support CMMC-compliant mobile disposition?

Premier Logitech holds CAGE Code 4WAJ9 as a pre-vetted U.S. federal government partner and operates under NIST, CMMC, SOC 2, TAA and ISO 9001/14001 frameworks. For defense contractors subject to CMMC 2.0 Level 2 and above, Premier Logitech executes sanitization and destruction of media containing CUI in alignment with NIST SP 800-171 Practice MP.L2-3.8.3. The program produces per-device chain-of-custody records and Certificates of Sanitization formatted for C3PAO review. The disposition workflow does not reference the deprecated DoD 5220.22-M overwrite standard, which no longer satisfies NIST SP 800-88 Rev. 2 requirements for modern solid-state mobile media.

When should a retired mobile device be routed to refurbishment versus physical destruction?

The routing decision starts with data classification, not hardware condition. Devices that held regulated, CUI or classified data and cannot pass independent Purge verification require physical destruction regardless of remaining value. Devices that pass Purge-level cryptographic erasure with confirmed verification results are candidates for certified refurbishment and secondary-market remarketing, which recovers residual asset value and reduces e-waste. Devices with unresolvable MDM locks, failed verification or physical damage that prevents sanitization confirmation also require the Destroy path. A mature disposition program evaluates each device individually against these criteria rather than applying a single method across the entire fleet, which supports compliance and value recovery from assets that qualify for refurbishment.