Decommissioning is the part of a data center lifecycle that gets the least planning and carries the most risk. A wrong power off takes down something that was still in use. A drive that leaves without a record becomes a data breach waiting to be found.
This checklist follows the order the work happens in. It is written for the person who owns the project, whether that is infrastructure, IT operations or facilities. Deploris's role in this kind of project is the on-site work and the documentation. The customer decides what to keep, how long to keep records and what the law or the contract requires.
What is data center decommissioning and when does it happen?
Data center decommissioning is the planned, documented removal of IT equipment from service, from the last day it runs to the day it leaves the building with a record of where it went. The glossary entry on data center decommissioning has the short definition. This page covers the practice.
It differs from a simple equipment pickup. A pickup moves boxes. A decommission proves that each asset was identified, that data was handled by an agreed method and that nothing was removed that should have stayed.
- Site closure: an office server room or a whole facility is shut down.
- Consolidation: several rooms or sites merge into fewer.
- Migration: workloads move to the cloud, to a colocation facility or to a new platform, and the old hardware retires.
- End of lease: a colocation contract or a building lease ends on a fixed date.
- Refresh: old hardware is replaced and the old units must be removed and wiped.
What should you plan before anything is powered off?
Before any power off, the customer must confirm that applications and data have been migrated, verified and signed off by their owners. Field engineers do not judge whether a system is safe to switch off. The system owner does, in writing.
Plan the project around a point of no return: the moment after which a rollback is no longer possible, usually when data is destroyed or hardware leaves the site. Name who can approve it and what must be true first.
- Inventory: a decommission list by serial number and asset tag, reconciled against the CMDB or DCIM export and a physical walk of the racks.
- Dependencies: DNS records, IP addresses, monitoring, backups, licenses, firewall rules, certificates and any service that still points at the hardware.
- Data decisions: which devices hold data, what method applies to each, and what retention rules the customer must meet before media is wiped.
- Stakeholders: system owners, security, facilities, procurement, finance and the colocation provider, each with a named contact.
- Access and rules: site access lists, change windows, freight and loading dock rules, and any exit checklist from the landlord or provider.
- Sign-off: a written approval per rack or per system before each power off.
What are the physical steps to decommission a data center?
The physical process runs in a fixed order: confirm, power down, disconnect, record, remove and reconcile. Keeping the order stops mistakes, and the records are made while the evidence is still in front of you.
A typical sequence is below. Your written procedure sets the real order for your environment, and it should be reviewed by the system owners.
- Confirm the owner's sign-off for the rack and check the labels against the decommission list.
- Photograph the front and rear of the rack as found, before anything is touched.
- Shut down systems in the agreed order, normally servers and storage first and network devices last, so management access stays up as long as possible.
- Switch off and isolate power at the PDU, following the site's lockout rules. Record the time.
- Record both ends of each cable and its label, then disconnect. Do this before removal so the as-found record is complete.
- Remove patch cords, power cords and, where the scope covers it, structured cabling that is no longer needed. Cable removal rules differ by site and by fire code, so agree them first.
- Scan or note serial numbers and asset tags, and reconcile them against the decommission list. Mark any difference immediately.
- Pull the devices from the rack and remove rails. Bag and label loose parts.
- De-rack the cabinet itself if it is leaving, and photograph the empty position.
- Update the asset register, DCIM and CMDB to show each item as retired and each U position and power circuit as free.
How do you handle data-bearing devices and data destruction?
Treat every storage device as holding data until a documented method proves otherwise. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, published in September 2025, defines three sanitization methods: clear, purge and destroy. It supersedes Rev. 1, which NIST withdrew, so older guides that cite Rev. 1 are out of date.
The customer chooses the method, based on how sensitive the data is and on its own policy. Deploris performs and records the method the customer chooses. It does not hold itself out as a certified sanitization vendor, and the paperwork it produces is only as good as the scope behind it.
| Method | What it means | Media afterward |
|---|---|---|
| Clear | Logical techniques, such as overwriting, applied through the standard device interface | Usually reusable |
| Purge | Physical or logical techniques that make recovery infeasible using state-of-the-art laboratory techniques, such as cryptographic erase where supported | Potentially reusable |
| Destroy | Techniques that make recovery infeasible and the media unusable for storing data | Not reusable |
What records and chain of custody should you keep for media?
Keep one record per device that ties its serial number to the method used, who did it and where it went next. Without that, a certificate is just a piece of paper.
NIST says a certificate of sanitization should be completed for each device sanitized, and it lists the details to record: manufacturer, model, serial number, the method and technique, the tool used, the verification method, and the name, title, date, location and signature of the person responsible. The rule for field work is simple: no media changes hands without paperwork.
- Record the serial number of every drive as it leaves the server, and the serial number of the server it came from.
- Decide in writing whether drives are erased in place, removed for destruction or shipped intact to a processor.
- Seal and label containers, and log each handover with date, time, names and signatures.
- Photograph destruction or wiping results where the method allows it.
- Match certificates to the asset list, so every serial number is accounted for and none is left over.
How is decommissioned equipment disposed of or recycled?
Decommissioned equipment goes to one of three places: reuse inside the company, resale, or recycling. The customer chooses, and the paperwork follows the choice.
Rules for electronic waste vary by country and by contract. In the European Union, the WEEE Directive, 2012/19/EU, requires separate collection and proper treatment of waste electrical and electronic equipment, and each member state applies it through national law. Other regions have their own rules. The customer or their counsel confirms what applies and what records the law or the contract requires.
Deploris does not own or run recycling facilities. Where a scope includes disposal, equipment is handed to a processor the customer approves, with a signed receipt and a certificate from that processor. Keep that certificate with the asset record.
How do you restore the space and finish a colocation exit?
Restoring the space means returning the cage, cabinets and circuits to the condition the contract requires, then getting the provider to accept it. Ask for the provider's exit checklist at the start, not on the last day.
Exit terms differ between providers and contracts, so use the document you were given. Common items are listed below.
- Remove all equipment, cabling, labels and packaging, unless the contract says cabling stays.
- Return access badges, keys and cage hardware, and update the authorized visitor list.
- Cancel or disconnect cross-connects and circuits only once the provider confirms the order.
- Release power circuits and update the provider's records.
- Clean the space to the standard the provider specifies and photograph it as left.
- Hold a final walk-through with the provider and get the acceptance in writing before the lease or contract date.
What goes in a decommissioning closeout pack?
A closeout pack is the set of records that proves the decommission was done as agreed. Build it as you go and hand it over when the work is accepted.
The closeout report page shows the pattern. Keep the pack long enough to meet your own retention rules, which the customer sets.
- Final asset list reconciled against the CMDB, with serial numbers, tags and disposition.
- Certificates of sanitization or destruction, one per device or per batch as agreed.
- Chain of custody forms and signed handover receipts.
- Photos of racks as found, devices as removed and the space as left.
- Signed work orders, including the owner's sign-off for each power off.
- Disposal or recycling certificates from the processor.
- A list of open items or exceptions, with an owner for each.
Key takeaways
- Do not power anything off until the system owner has confirmed in writing that the migration is finished and verified.
- Follow a fixed physical order and record the rack as found before touching a cable.
- Choose the data method per device, record it by serial number, and let no media change hands without paperwork.
- Disposal rules vary by country and contract, so the customer confirms them and keeps the certificates.
- Finish with a closeout pack: asset list, certificates, photos and signed work orders.