R2v3 Data Sanitization Audit Evidence

Published 13 November 2026 · Paradygm Consulting

Most data sanitization findings are not about the wipe software or the shredder. They come from a facility that cannot show, quickly and device by device, what happened to the data. This guide covers what R2v3 auditors typically expect to see as evidence, and how to have it ready before the certification audit.

It is a practical preparation guide, not a restatement of the standard. Take the exact requirements from the current R2v3 text and SERI's published guidance, and confirm interpretations with your certification body.

Start with your sanitization pathway

First be clear which route your facility uses, because it decides what the auditor will test. SERI's guidance describes three pathways (SERI: Data Destruction/Sanitization Methods and Processing; SERI: Core 7 vs Appendix B):

Physical destruction under the core data security requirement. If every data device is physically destroyed using a NIST SP 800-88 destruction method suited to the device, and you do no wiping, Appendix B may not be required. You still need to show the method and that it was effective.
Appendix B certification. Any facility that performs logical sanitization (software wiping) must be certified to Appendix B. Once you are, Appendix B applies to all data devices under your control, including the ones you destroy.
A qualified downstream vendor. If another facility sanitizes for you, that vendor must be qualified under the downstream recycling chain requirements, and you must still identify, secure, package, transport and track every data device you send.

Write your pathway into your scope and your data sanitization plan. Many evidence gaps start with a facility that wipes "a few devices" while claiming it only shreds.

1. Written procedures that match the floor

Auditors compare your documents with what operators actually do. Expect them to ask for:

A data sanitization plan or policy that states your pathway, the device types you accept, who is responsible, and how you treat data-bearing devices from receipt to final disposition.
A media matrix that assigns each media type (HDD, SSD and NVMe, phones and tablets, removable flash, tape, embedded storage in printers, network gear and industrial equipment) to Clear, Purge or Destroy, with the specific method and tool.
Work instructions for each method, written in the order operators really work, with the failure path: what happens when a wipe fails or a device can't be wiped. The answer is usually a defined escalation to physical destruction, recorded against the device.
Current references. NIST published SP 800-88 Revision 2 in September 2025, replacing Revision 1. Revision 2 shifts the focus from device-by-device wipe tables to running a sanitization program, and points to standards such as IEEE 2883 for specific techniques. If your plan, work instructions or certificates still cite Revision 1, update them and check that each method traces to a current specification. Our post on NIST SP 800-88 Rev. 2: what changed from Rev. 1 and the short Rev. 2 checklist for R2v3 facilities walk through the changes.

2. Verification that shows the method worked

Running a process is not the same as proving it worked. Auditors look for:

Per-device results from your sanitization software: device identifier, method, date and time, result, and operator or station. SERI expects software that both sanitizes the device and records the result, and states that a factory reset on its own is not considered logical sanitization. Only where no sanitization software exists for a device type can a manufacturer reset be used, directed, controlled and recorded by software for each device (SERI: Verifying the Effectiveness of the Data Sanitization Process; SERI: R2v3 Formal Interpretation #1.0).
An independent check of a defined sample, done by someone other than the operator, with the sampling rule taken from the current standard text rather than a figure you made up.
Verification and validation. NIST Revision 2 separates verification (the technique completed successfully) from validation (your organization accepts the result as effective for that data). Keep a record of both.
Failure handling. A failed check should trigger re-sanitization or destruction, an investigation and a corrective action, all logged. A program with no recorded failures can look like a program that isn't checking.

3. Records that trace every device

R2v3 is built on traceability, so the auditor will pick devices and ask you to follow them. Be ready to produce, for any data device:

Stage	Evidence to have ready
Receipt	Device identifier, source, date, data-bearing determination
Secure storage	Access-controlled area and a log of who entered
Sanitization	Method, tool and version, operator, result
Verification	Who checked, how, result, any corrective action
Destruction	Date, method, equipment, device or batch list
Disposition	Where the device or its remains went, and to whom

If customers receive certificates of sanitization, keep copies linked to the same device records, and make sure the wording matches what you actually did (for example, don't call degaussing "destruction" if your referenced standard treats it as purge). For facilities certified to Appendix B, SERI's guidance also describes video recording of the physical destruction process (SERI: Core 7 vs Appendix B), so check that your recordings exist, are retained and can be found by date.

A good self-test: pick five devices from last month's intake and trace each one from receipt to final disposition. Every missing link is a corrective action to close before the audit.

4. Equipment evidence

For each sanitization tool and machine, keep a file with:

The software name and version, the media types it is approved for, and the Clear or Purge level it achieves for each.
Your own test results, for example a recovery attempt on a test drive after sanitization, repeated after software updates.
For shredders, disintegrators and degaussers: the manufacturer's specification, maintenance records, and periodic performance checks. Where you rely on an evaluated product list or a destruction specification, record which one and what it requires, and check output against it.

5. Training records tied to the work

General awareness training is a start, but auditors look for competence on the specific tools and methods each person uses. Keep:

A list of who is authorized to sanitize, verify and destroy, kept current.
Training records for each person, linked to the methods and tools they use, with refresher dates.
Certificates from any courses completed.

Our free NIST SP 800-88 online training gives staff a media sanitization overview and a training certificate. Note that its course materials are the Revision 1 module, so use it as foundational awareness alongside your Revision 2 procedures. Our free IEEE 2883 logical data sanitization training covers logical methods and ends with a scored quiz and a PDF certificate. For the people who audit your own system, Paradygm also offers R2v3 internal auditor training, delivered online and self-paced.

6. Downstream control

If any unsanitized data devices leave your facility, the auditor will follow them. Have ready:

The downstream vendor's qualification for data sanitization under the downstream recycling chain requirements, including any audit evidence your qualification relies on (SERI: Data Sanitization by Downstream Vendors).
Records showing devices were identified, secured, packaged and tracked in transit.
The vendor's sanitization or destruction records, matched back to your shipment lists.

Your downstream flowchart and vendor files should show the same path your device records do. See R2v3 standard requirements for how the downstream chain fits the rest of the standard.

Fit sanitization into your management system

Sanitization procedures should sit inside the same document control, training, internal audit and corrective action system as the rest of your facility. For the R2v3 environmental, health and safety management system, Paradygm recommends ISO 14001 + ISO 45001, adding ISO 9001 only when required, for example for test and repair or brokering. Run an internal audit of your sanitization evidence before you book the certification audit.

How Paradygm helps

Paradygm Consulting is a SERI Approved Consultant with a 100% R2 track record. We help recyclers, refurbishers and ITAD facilities build and update data sanitization plans, procedures, records and training for Appendix B and NIST SP 800-88 Revision 2. Every R2 engagement includes attending the certification audit and closing its findings, and we offer Guaranteed Certification within the first attempt. Proposals come with no hidden costs.

Book a free consultation through our contact page, see our R2v3 certification consulting services, or call 1-855-702-9001, Monday to Friday, 8:00 AM to 6:00 PM ET.

Frequently asked questions

Does every R2v3 facility need Appendix B?

No. SERI's guidance says Appendix B is required if you perform logical sanitization. A facility that only physically destroys data devices using NIST SP 800-88 methods, or that sends them to a qualified downstream vendor, may not need it. Confirm your scope with your certification body.

Is a factory reset enough for R2v3?

On its own, no. SERI's knowledge base states that a factory reset is not considered logical sanitization. Use software that sanitizes the device and records the result. Only where no such software exists for a device type can a manufacturer reset be used, and then software must direct, control and record it for each device.

Should our procedures cite NIST SP 800-88 Rev. 1 or Rev. 2?

NIST replaced Revision 1 with Revision 2 in September 2025. Update your plan, work instructions, training and certificates to the current revision, and confirm with your certification body which revision it expects.

What records will the auditor ask for?

Expect to trace individual devices from receipt to final disposition: identifier, storage, method, tool, operator, result, verification, destruction and downstream destination, plus training and equipment records.

What training evidence do auditors expect?

Records showing each person is trained and authorized on the specific tools and methods they use, with refresher dates and any course certificates.

Sources

Last updated: 13 November 2026. Commentary by Paradygm Consulting. Not a substitute for the R2v3 Standard, SERI guidance, NIST SP 800-88 or IEEE 2883.

← All news