SR-12 Component disposal: requirements and evidence

What SR-12 component disposal asks for and why it is hard to prove

An assessor or a contract has required SR-12, and your team now has to show that disposal actually happened. SR-12 asks the organization to dispose of defined components, documentation and tools using defined techniques and methods, so that supply chain information and data cannot be recovered afterward. It applies in the low, moderate and high baselines in SP 800-53B. The organization makes the key choices: which data, items and documentation fall in scope, and which disposal techniques and methods are acceptable. The control does not prescribe those choices for you, so the first decision is to write them down and get them approved.

The hard part is proving the disposal was complete, not just planned. SP 800-53A assesses SR-12 through a single determination statement, and the examine objects are the disposal procedures that address supply chain protection, the records of disposal for system components, the list of components identified for disposal, and the documentation of the techniques and methods used. An assessor will compare those records against what is physically or logically gone. That means a disposal record must tie a named asset to a method, a date, a responsible person and a verification step. Documentation and tools are easy to forget, so check whether design files, configuration exports, admin scripts and vendor support portals are on the list. Ask your assessor early which disposal evidence they expect for each class of item.

Asset inventory is usually the source of truth for this evidence. Open-source inventory tools such as GLPI can track computers, network equipment and other assets through their lifecycle, and an agent-based inventory such as the Wazuh system inventory can show what was last seen on each endpoint. Use these to build a before-and-after picture: the asset was in inventory, it was retired on a set date, and it no longer reports. Confirm with your assessor and the relevant FedRAMP or contract language whether a related control, MP-6 media sanitization, will be assessed alongside SR-12, since the two records overlap for storage devices.

Which disposals fall under SR-12 in your environment

SR-12 reaches further than the hard drive in a decommissioned server. The scope depends on which system components, documentation and tools you dispose of, which third parties touch them, and which baseline or FedRAMP class applies. Settle these decisions first, because each one changes what must be disposed of, how it is evidenced and who must be assessed.

System components in scope

Decide which physical items count as system components for SR-12: servers, endpoints, network gear, storage arrays, removable media and backup appliances. Storage is usually the highest-risk category because it holds data that may outlive the device's service life. Check the component inventory against disposal records so that every retired item has a traceable entry. Include spares and units returned under warranty, since they leave your control in the same way.

Documentation that carries supply chain information

Architecture diagrams, asset registers, supplier contracts, configuration baselines and network maps can reveal how a system is built and where its weaknesses lie. Decide which of these count as supply chain information and set disposal rules for paper and electronic copies alike. Audit the document repositories and shared drives, because copies often persist after the original system is retired.

Tools and test assets

Diagnostic laptops, programming dongles, imaging workstations, license keys and staging environments can hold credentials or configuration that expose the systems they once managed. Include these tools in the disposal scope and record how each was wiped, reset or destroyed. Ask whether maintenance tools are shared across sites, since a single retired tool may carry data from several environments.

Third parties that hold or dispose of items

Recyclers, leasing companies, cloud providers and managed service providers may take custody of components before final destruction. Each handoff needs a contract term that defines the disposal technique, a certificate of destruction and the right to audit. Confirm whether the third party is itself a supplier you assessed under the supply chain program, because an unassessed disposal vendor is a gap an assessor will ask about.

Low, moderate and high baselines

SR-12 applies in the low, moderate and high baselines, so no impact level removes it. What changes is the depth of evidence expected and how many components and records fall within your authorization boundary. Confirm with your authorizing official which baseline governs each system, and map its boundary before setting disposal procedures. Systems that share infrastructure with a higher-impact system should follow the stricter rule.

FedRAMP Classes B, C and D

FedRAMP's Rev5 baselines require SR-12 at Classes B, C and D, so cloud service offerings in those classes must show disposal evidence for their own hardware and media. Confirm the class with your sponsoring agency or FedRAMP documentation before scoping, and ask your cloud provider which disposal evidence it can share under its inheritance model. Plan for the assessor to sample disposal records, not accept a policy statement alone.

How an assessor tests SR-12 disposal

This table maps each examine object in the single SR-12 determination statement to the test approach, the evidence an assessor requests and the findings that show up most often. Read it as a checklist for what to have ready before an assessment, since the assessor will look for the same records across all four objects.

Examine object	What the assessor tests	Evidence requested	Common findings
Disposal procedures addressing supply chain protection	Whether written procedures cover disposal of components, documentation and tools in a way that protects supply chain information from recovery	Current disposal procedure, approval history, and the defined data, documentation and tools the procedure covers	Procedure names no disposal techniques or methods, or omits documentation and tools from scope
Disposal records for system components	Whether disposal actions were carried out and recorded for components that reached end of use	Disposal log with dates, asset identifiers, responsible staff and disposal outcome for each item	Records are incomplete, undated or cannot be tied back to a specific asset
Documentation of components identified for disposal	Whether the components selected for disposal are identified and traceable to the organization's inventory	Disposal candidate list reconciled against the asset inventory, with serial numbers or other unique identifiers	Records do not match the inventory, so components cannot be confirmed as disposed
Documentation of disposal techniques and methods	Whether the techniques used (for example, sanitization or destruction methods) are defined and were applied to each item	Method definitions, vendor or internal certificates of destruction, and a per-item record of the method used	Methods are named generically or no evidence shows which method was applied to which item
Related control MP-6 (media sanitization)	Whether the disposal evidence for storage media agrees with the sanitization records assessors review under MP-6	Cross-referenced MP-6 sanitization records and SR-12 disposal entries for the same media	SR-12 and MP-6 records conflict, or one control is documented without the other

Implementing SR-12 disposal from procedure to closed record

This sequence turns SR-12 from a policy statement into disposal records an assessor can trace, from the first inventory of what is in scope to the retained evidence that each item was removed and cannot be recovered. Each step names the artifact it produces so the record stays intact from start to finish.

Define the items in scope
Start by listing the data, documentation, tools and system components that the disposal procedure covers, including supply chain information such as supplier documentation, configuration files and asset records. The owner is typically the system owner with input from procurement and IT asset management. The step closes when the list is approved and each item has an identifier that matches the asset inventory. Output: a scoped disposal inventory the assessor can compare against the system boundary.
Define disposal techniques and methods by item type
For each item type in the inventory, document the disposal technique and method the organization will use, such as overwriting, degaussing, physical destruction, cryptographic erasure or secure deletion of documentation. Because the SR-12 parameters are organization-defined, record the chosen values in the system security and privacy plan and tie them to the media protection procedures where those overlap. Confirm each method with the hardware and software vendors, since some devices and storage types need specific techniques. Output: an approved disposal standard that names the method for every item type.
Assign disposal owners and approvers
Name who initiates, performs, approves and verifies each disposal, and separate the approver from the person who performs the disposal where the organization can do so. Record the roles in the disposal procedure and in the asset management workflow so that responsibility is clear for each item type. Where a third party performs destruction, assign the contract owner and confirm the vendor's responsibilities in writing. Output: a responsibility matrix that shows who signs each disposal record.
Run and record each disposal
When an item reaches end of use, open a disposal ticket that references the inventory identifier, the approved technique, the performer and the date. Perform the disposal, and where a vendor performs it, collect the vendor's certificate of destruction or equivalent statement that names the items. Record any exception, such as a device that failed the chosen method, and route it to the approver before the item leaves custody. Output: one disposal record per item or batch, linked to its inventory entry.
Verify completion
Have someone other than the performer check that each disposed item is no longer present in the inventory, backups, repositories or management consoles, and that the chosen technique was applied. For logical assets, confirm the removal against the platform's asset data, for example by checking that the asset no longer appears in the inventory or that its records are marked retired. Record the verifier, the check performed and the result. Output: a verification entry that closes each disposal ticket.
Retain disposal records
Store the disposal inventory, technique standard, responsibility matrix, tickets, vendor certificates and verification entries in the evidence repository with the retention period set by the organization's policy and any contractual or regulatory obligation. Check that the records are protected against alteration and that they can be retrieved by inventory identifier. Ask the assessor which format they expect, since CA and PM evidence requirements may also apply. Output: a closed, retrievable record set that supports the SR-12 assessment.

Disposal evidence that passes an examine

An assessor testing SR-12 Component disposal under SP 800-53A examines documents, not intentions. The cards below cover the artifacts that show what was disposed of, how, when, and by whom, and the routine that keeps those records accurate between assessments.

Written disposal procedure

The examine objects start with disposal procedures that address supply chain protection. The procedure should name the categories of items covered (media, hardware, documentation, tools), the disposal techniques allowed for each, and the approval step before anything leaves the controlled environment. Check that it refers to supply chain concerns, such as keeping vendor-specific configuration, firmware images and supplier documentation from being recovered after an asset leaves service. A procedure that never mentions supply chain information is the first gap an assessor will find.

Inventory of items selected for disposal

The assessor needs documentation of the system components identified for disposal. Build this list from the asset inventory, not from memory. Each entry should identify the component, its serial or asset tag, the data and software it held, and the reason for retirement. Open-source asset management such as GLPI can hold these records, and its Assets module covers computers, monitors, network equipment and other device types. Confirm that disposal status is recorded in the same system so retired items do not stay listed as active.

Disposal records with dates and staff

Each disposal event needs a record showing the date, the individuals who performed or verified the work, and the items involved. Assessors use these entries to confirm that disposal happened as the procedure describes. Use a ticket or change record for every batch so the approval, execution and closure steps are linked. Zammad can serve as the ticket system if the organization does not already run one, which keeps the trail in a single place with timestamps.

Technique recorded for each item

The examine objects include documentation of the disposal techniques and methods used for each system component. A general statement that media were destroyed does not satisfy this. Record the technique per item, such as overwriting, degaussing, physical destruction or shredding, and note where it differs by device type. Check that the chosen technique matches the sensitivity of the data the item held and the approach in the procedure. Where a technique cannot be verified from the record, the assessor will treat the disposal as unsupported.

Third-party disposal certificates

When a vendor collects or destroys equipment, keep the certificate of destruction or disposal that the vendor issues for each batch. The certificate should list serial numbers or asset identifiers, the method used and the date. Reconcile the vendor list against your own inventory so every item sent out has a matching certificate. Ask the vendor to confirm in the contract how it protects equipment in transit and whether it keeps any copies of data. Terms for this belong in the acquisition and notification agreements that govern the supplier relationship.

Review dates and named owners

Evidence goes stale unless someone is accountable for it. Assign a named owner to the disposal procedure, the inventory and each recurring record set, and set a review date for each one. Review the inventory against the asset register at each cycle and confirm that the records reflect the current procedure. Record the review in the same system as the artifacts so an assessor can see that the evidence was current on the date of testing, not only at the last audit.

What meeting SR-12 disposal costs in money and effort

This table breaks down the cost components of running SR-12 disposal, who is paid for each, whether it is one-time or recurring, and what pushes it up or down. Read it as a checklist for scoping and for questions to put to a quote. No dollar figures or durations are given because none are supplied for this control.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
Disposal procedure drafting	Internal policy owner, with security and records staff; optionally an outside consultant	One-time, then reviewed on the organization's own cycle	Number of component types, data classes and media in scope; fewer exceptions lower drafting effort
Staff time per disposal event	Internal IT asset and media handling staff	Recurring, every time a component, document or tool is retired	Volume of retired items and how many handoffs occur before destruction or release
Inventory and ticketing tools	Software vendor or open-source project operator; internal administrators	Recurring if licensed, one-time setup for self-hosted deployment	Use of GLPI for asset records and Zammad for disposal tickets can remove license spend; confirm the hosting and support model
Third-party disposal services	External destruction or recycling vendor	Recurring per engagement, priced by the vendor	Number of third parties involved, chain-of-custody requirements and whether certificates of destruction are required
Verification of disposal	Internal reviewers who check records against the disposal procedure	Recurring, for each disposal batch	Data sensitivity: higher-sensitivity media usually needs more verification steps and sign-off
Assessor sampling and evidence review	Independent assessor, billed by its own terms	Recurring at each assessment cycle	Number of disposal records the assessor samples and how complete the records are when requested
Recovery-proofing of retired data	Internal security or forensic staff, or an external specialist	Recurring where sanitization is tested	Storage type, backup copies and whether tools or documentation are also retired and must be cleared

Self-hosted tools that keep the disposal trail

SR-12 asks the organization to dispose of defined components, documentation and tools using defined techniques and methods, and to keep records that show it happened. The three tools below can hold part of that trail: what was retired, when its status changed, whether it still reports to the environment, and who approved the request. None of them sanitizes media, so the technical wiping step must be evidenced by a separate process.

GLPI Assets for disposal state

GLPI's Assets module manages computers, monitors, software, network equipment, peripherals, printers, phones and racks. Records can be entered manually or pushed automatically by the GLPI Agent through native inventory, which is built into GLPI since version 10. Use the status of each asset to record that it moved from in service to pending disposal and then to disposed, with dates and the responsible person. GLPI records the status you set, not the physical destruction itself, so confirm with the vendor how status history and audit entries are retained before relying on them as SR-12 evidence.

Wazuh Syscollector for retirement checks

The Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, services, users and groups from each endpoint and stores them in the Wazuh indexer for dashboard views and reports. After a device is marked disposed, check that it no longer appears in the inventory. This gives a dated, system-generated observation that the endpoint has stopped reporting. It does not prove the data on the drive was removed, and a device that is powered off or unplugged will also stop reporting, so pair this check with the sanitization record.

Zammad for approved disposal requests

Zammad is a web-based helpdesk that brings email, chat, telephone and social media messages into one ticket system. Open one ticket per disposal batch, attach the asset list, the disposal technique and the method selected, and route it for approval before any equipment leaves custody. The ticket history then shows who requested, who approved and who closed the request. Zammad holds the workflow record only. Confirm how approval states, attachments and retention are configured in your deployment, since these settings depend on your own setup.

Licenses and what each tool cannot prove

GLPI is licensed under GPL-3.0-or-later, Wazuh under GPL-2.0-only and Zammad under AGPL-3.0-only. Licensing matters when you modify or redistribute the code, and your legal team should review the obligations that apply to your deployment. None of the three performs media sanitization, produces a certificate of destruction or reconciles documentation and tools with asset records. Those gaps must be covered by a documented sanitization process, a vendor or internal destruction certificate, and a reviewed procedure for paper and software tools.

Who owns SR-12 disposal, who can help, and where the auditor stops

Your organization owns SR-12. The control requires you to dispose of defined data, documentation, tools or system components using defined techniques and methods, and you must decide what those items are, which techniques are acceptable for each, and who signs off when a disposal is complete. Those decisions sit with the security, IT asset and records owners, not with a vendor. Your team also owns the operating record: the disposal procedure, the approval workflow and the disposal records that the assessor will later examine.

Procedure ownership: Name an accountable owner for the disposal procedure and define which items it covers, including documentation and tools as well as hardware.
Technique decisions: Choose disposal techniques for each media and component class, and document why each is adequate for the data it held.
Approval and sign-off: Require a named approver to confirm each disposal before the record is closed.
Supply chain protection: Confirm that disposal procedures address supply chain protection, such as chain of custody when a third party removes equipment.
Operating records: Keep disposal records for each system component, linked to the inventory entry.

Check that the owner, approver and technique list are written down, dated and approved before any assessor asks for them.

Where SR-12 disposal programs usually fall short

SR-12 asks an organization to dispose of defined data, documentation, tools and system components using defined techniques and methods. Most shortfalls come from disposal that is not tied to the inventory, not scoped to everything that holds supply chain information, or not provable after the fact. The cards below name each gap and a concrete way to close it before an assessor asks.

Procedures that name no techniques

A disposal procedure that says media will be destroyed securely does not meet SR-12, which expects defined techniques and methods for each class of item. Define the technique per item type, for example secure erasure for drives, physical destruction for failed storage that cannot be wiped, and reset with verification for network devices. Confirm that the procedure lists the organization-defined parameters that SR-12 leaves to the organization, since an assessor will check that the values were set and followed.

Disposal detached from the inventory

Disposal often happens at the loading dock, not in the asset register, so the record of what left the environment is missing or wrong. Tie every disposal ticket to a specific asset record with its serial number, owner and location, and close the asset record only after the disposal evidence is attached. An inventory tool such as GLPI can hold the asset record and its lifecycle status, while a host inventory agent such as Wazuh Syscollector can show whether a machine is still reporting after it was supposed to be retired.

Documentation and tools left out of scope

Teams scope disposal to laptops and servers and forget printed system documentation, configuration backups, administrative tools, USB installers and build media. These items can reveal supplier details, architecture and component provenance, which is the supply chain information SR-12 aims to protect. Build a disposal checklist that covers documents and tooling as well as hardware, and review it whenever a new system or supplier is onboarded.

Third-party disposal without certificates

When a hauler, recycler or managed service provider removes equipment, the organization often receives no document that names the items and the method used. Require a certificate of destruction or sanitization that lists each serial number, the technique applied and the date, and make that certificate a contract term. Check that the provider's method matches the one in your procedure, and sample a few certificates against the physical items to confirm the paperwork is accurate.

Records that cannot be matched to an item

Some organizations keep a disposal log, but its entries describe batches such as "twelve drives from the lab" and cannot be traced to a specific component. An assessor sampling disposal records under the examine method will look for documentation of the components identified for disposal and the techniques used on each. Record one entry per item with a unique identifier, the disposal method, the person who approved it, the executing party and the verification step. Store the records in a system that the disposal team cannot edit after the fact.

No verification after disposal

A disposal step can be marked complete without anyone confirming that the data or component is unrecoverable. Add a verification step for each technique, such as a sample read attempt after an erase or a visual check after destruction, and record who performed it and when. Where equipment leaves the organization for reuse or resale, verify sanitization before release and keep the result with the disposal record, because a sanitized claim without a check is weak evidence.

SR-12 component disposal questions buyers ask

How much effort does SR-12 component disposal take to implement?

SR-12 is a single base control with no enhancements, so the effort lies in defining what gets disposed of and how, not in the control text itself. The organization must set the parameters (which data, documentation, tools and system components are covered, and which disposal techniques and methods apply), write the disposal procedures, and keep disposal records. Effort rises with the number of asset types, the number of disposal channels (internal reuse, resale, return to a vendor, destruction) and how many systems hold supply chain information. No supplied fact gives a duration or cost, so ask your assessor or implementation partner for a scoped estimate tied to your asset inventory.

Can a small team handle SR-12 disposal without outside help?

Often yes, provided the team owns the procedure and the records. A small team needs a defined list of what counts as disposable, a documented method for each asset class, a named owner who signs off each disposal, and a way to show that the disposal happened. Teams without a configuration or asset inventory usually struggle most, because they cannot prove what was removed. Outside help is most useful for setting up the inventory and records, writing procedures that an assessor will accept, and testing the evidence before the assessment. Whether your team can carry it alone depends on your authorization path, so confirm the expectation with your assessor or with FedRAMP if you are pursuing it.

How long does it take to get ready for SR-12?

The timeline depends on how mature your asset inventory and disposal practice already are. Readiness usually depends on four things: an inventory that covers the components in scope, documented disposal procedures, a record format that captures each disposal, and a sample of completed disposals an assessor can examine. If those exist, the work is mostly documentation and verification. If they do not, the inventory and process build dominates the schedule. No supplied fact states a duration, so request a written timeline in any proposal and check it against the assessment date set by your authorizing body.

What does the organization need to provide for SR-12?

The organization owns the control and must supply the inputs an assessor will examine. These are the disposal procedures that address supply chain protection, the list of system components identified for disposal, the documented disposal techniques and methods, and disposal records for each component. Assessors also examine the documentation that supports the list. Responsibilities usually include:

Defining the parameters for data, documentation, tools and components
Assigning an accountable owner for each disposal
Keeping records that link each asset to its disposal method and date
Retaining evidence the assessor can sample

Is an implementation partner worth bringing in for SR-12?

A partner is worth considering when your inventory is incomplete, your disposal records live in several tools, or your team lacks time to build evidence while running operations. DeployOpen prepares systems, controls and evidence for compliance assessments under a fixed scope agreed in writing before work starts. It does not issue assessment reports or certifications; only an independent assessor or certification body does that. Ask any partner to show how their scope covers asset inventory setup, procedure drafting, record design and a pre-assessment evidence review, and to state what they will not do.

How does SR-12 relate to MP-6 media sanitization?

SR-12 and MP-6 both concern disposal, but they address different objects. MP-6 covers sanitizing or destroying media so information cannot be retrieved, and the Release 5.2.0 catalog lists MP-6 as the one related control for SR-12. SR-12 extends disposal to supply chain information, documentation, tools and system components. In practice, a disposal procedure for drives and media may satisfy part of both controls, but the SR-12 record must also cover documentation and tools that MP-6 does not address. Confirm with your assessor how they want the two controls evidenced, and whether one procedure can cite both.

Does a FedRAMP baseline change what SR-12 requires?

FedRAMP's Rev5 baselines require SR-12 at Classes B, C and D under the Consolidated Rules for 2026 (rule FRC-CSF-BSL), so a FedRAMP authorization makes SR-12 mandatory at every class listed. The control text stays the same, but the authorizing body and the assessor set the evidence expectations and parameter values. Before you scope the work, confirm with your authorizing body and assessor which class applies to your system, which parameter values they expect, and whether they accept the disposal procedure you plan to write.

How DeployOpen prepares SR-12 disposal evidence

DeployOpen helps organizations set up the systems, procedures and records that show how components, documentation and tools are disposed of so supply chain information cannot be recovered. The organization owns its SR-12 control and its disposal decisions, while an independent auditor or assessor is the only party that tests and reports on them.

How we scope

Confirm which data, documentation, tools and system components the organization has defined for disposal under SR-12.
Record the disposal techniques and methods the organization has chosen, and which system owners approve them.
Agree the written scope, deliverables and timeline with the client before any work starts, as all engagements are fixed-scope.

How we build

Set up asset inventory in self-hosted tools such as GLPI so each component has a traceable record before disposal begins.
Connect endpoint inventory data from Wazuh so disposal records can be matched against what the system actually reports.
Configure ticket workflows in Zammad so each disposal request, approval and completion is logged in one place.

How we hand over

Deliver disposal procedures that name the defined components, techniques and methods, mapped to the SR-12 examine objects.
Provide disposal records for each system component, with dates, responsible staff and the method used.
Hand over documentation of the disposal techniques in a form the client's assessor can examine directly.

How we support

Offer ongoing support, upgrades and maintenance of the inventory and ticketing tools as a retainer, if the client wants it.
Review disposal records at agreed intervals so gaps are found before an assessment, not during it.
Confirm with the client's independent assessor which evidence they expect for SR-12 and the related MP-6 control.