How a regional bank cleared four sites and reconciled 2,341 assets
After an acquisition, the bank had two owned data centers and two rented colocation cages to retire while part of the environment remained live.
Its source records did not share a common key. ITAMG reconciled asset tags and serial numbers, destroyed 9,412 drives with a bank officer present, and cleared 164 racks across the four sites.
The engagement produced $1,187,590 in client recovery against $217,939 in project cost, with a final record Internal Audit could trace to each accepted asset.
164 racks cleared
Two owned data centers and two rented colocation cages across the bank's Northeast footprint.
9,412 drives shredded on site
All drives were shredded on site while a bank officer witnessed the work. One certificate listed every serial number; 1,147 drives held customer account records.
Zero unresolved inventory exceptions
The final record matched all 2,341 assets, including 23 found during the site walk that appeared on neither source list.
$1.19M client recovery
Amount credited to the bank for accepted assets. Total project cost was $217,939.
Four sites remained after the acquisition
| Detail | Project record |
|---|---|
| Type of company | Regional bank integrating an acquired institution |
| Size | Large Northeast branch network |
| Scope | Two bank-owned data centers and two rented colocation cages |
| Business driver | Consolidate the acquired environment into one colocation site and the cloud |
| Client approval | SVP of Infrastructure, with approval from the CISO and Internal Audit |
| About this study | One completed ITAMG engagement. The client's identity and exact project dates are withheld under contract. Client-recovery figures are historical engagement values, not current offers. |
| Governing requirements | GLBA section 501(b), the Interagency Guidelines Establishing Information Security Standards, the Interagency Guidance on Third-Party Relationships: Risk Management, and SOX IT general controls |
Clear four sites without losing the audit trail
The bank would accept closeout only after all 164 racks were cleared, all 9,412 drives were destroyed and all 2,341 assets were accounted for in the final record.
The source systems made that difficult. The acquiring bank used ServiceNow asset tags; the acquired bank used serial numbers in a spreadsheet. The records had no shared key.
ITAMG had to join both sources to the physical inventory while two sites remained live and the colocation handback dates stayed fixed.
The constraints that set the work plan
The inventories used different identifiers
The acquiring bank tracked assets by tag in ServiceNow. The acquired bank used a spreadsheet keyed to serial numbers.
There was no shared key. Crews had to capture both identifiers from each machine during the site walk or removal pass before the records could be joined.
Two sites remained live
The disaster recovery environment stayed online until the cloud move finished in week six.
Crews worked beside live production racks. Before anyone touched a rail, each power change had to clear the bank's change management process.
Destruction required a bank officer witness
The bank classified 1,147 drives as containing customer account records, its most sensitive media category.
Under the bank's GLBA-aligned policy, an officer had to witness all on-site destruction and sign the witness record.
The colocation handback dates were fixed
Both cages had firm move-out dates and contract-specific handback conditions. Meeting those dates avoided $36,800 in holdover rent and set the removal sequence.
The evidence had to resolve to the inventory
Serial scans, custody records, destruction evidence and settlement reporting had to reconcile to the same asset record before Internal Audit could accept closeout.
From source records to a reconciled closeout
Build the master inventory
ITAMG walked all four sites and captured each identifier visible at the rack. Gaps were closed as equipment came out; some serial plates and asset tags could not be reached while units were racked.
The working inventory combined both source registers, the general ledger and the physical count.
Each data-bearing device was flagged on the master list before disposition.
Destroy and record the media
The bank's approved process mapped the media to the Destroy method in NIST SP 800-88.
ITAMG shredded the drives on site under its NAID AAA certification while a bank officer witnessed the work.
Crews scanned each serial number, destroyed the drive and logged the event in sequence. No data-bearing media left a site intact.
Clear each site to its handback scope
At the bank-owned sites, ITAMG removed the equipment and device cabling inside each cabinet, followed by the client-owned racks and power units.
In the colocation cages, ITAMG emptied the provider-owned cabinets but left them in place. Structured cabling in the ladder and floor runs remained.
Crews worked around the live disaster recovery floor. Every crew member was an ITAMG employee with a background check; no subcontracted labor entered a bank floor.
Transport was insured and GPS tracked, with custody recorded at each handoff.
Reconcile disposition and settlement
ITAMG matched each serial number to the master inventory, reported the client recovery credited for each accepted asset, and placed the complete closeout package in the client portal.
The bank supplied site access and source records, approved the work plan and power changes, provided the destruction witness, and accepted final reconciliation.
What the final reconciliation showed
Recovery, project cost and net cash to the bank
Client recovery is the amount ITAMG paid or credited to the bank for accepted assets based on secondary-market values at the time of the engagement. It is not ITAMG's downstream sale price.
Project cost is the sum of the service charges below. Net cash equals client recovery less project cost; avoided holdover rent is reported separately.
ITAMG credited $1,187,590 in client recovery and charged $217,939 for the project, leaving $969,651 in net cash. The separate $36,800 rent avoidance is not included.
Client recovery by category
Values varied by model, configuration, condition and demand at the time of the engagement. The table shows accepted quantities and the client-recovery rate used for each category at settlement.
Drive value is excluded because all 9,412 drives were destroyed. The bank's pre-project comparison of destruction and verified Purge appears below.
| Accepted equipment | Quantity and client-recovery rate | Total client recovery |
|---|---|---|
| Complete server systems | Dell PowerEdge R740 and R640 class, HPE ProLiant Gen9 and Gen10, Cisco UCS M4 and M5. 1,010 accepted units at $700 per unit credited to the bank | $707,000 |
| Network equipment | Top-of-rack and aggregation switches, routers, firewalls, and WAN optimization appliances. 398 accepted units at $550 per unit credited to the bank | $218,900 |
| Storage equipment | Array controllers, expansion shelves and cache modules, sold empty after drive destruction. 328 accepted units at $400 per unit credited to the bank | $131,200 |
| Recovered parts | Processors, memory, power supplies, RAID controllers and network cards recovered from 278 chassis at $340 per chassis credited to the bank | $94,520 |
| Power, tape and appliances | Rack power units, tape library chassis, KVM units and purpose-built appliances. 327 accepted units at $110 per unit credited to the bank | $35,970 |
| Total client recovery | 2,341 accepted assets across the five recovery categories | $1,187,590 |
Project cost by service
The fixed project quote covered labor, processing, transport, destruction and recycling across all four sites.
| Cost category | What it covered | Project cost |
|---|---|---|
| On-site labor and removal | 130 crew days across four sites | $110,500 |
| Asset processing and testing | 2,341 assets received, reconciled, tested and reported at $15 per asset | $35,115 |
| Transport | 21 insured truckloads with documented custody across the four-site Northeast footprint | $31,500 |
| Recycling | Fixed charge for shredded media and residual chassis or components processed through ITAMG's R2v3-certified operations after parts recovery | $22,000 |
| On-site drive destruction | 9,412 drives shredded on site while a bank officer witnessed the work | $18,824 |
| Total project cost | Fixed quote covering all four sites | $217,939 |
The bank selected Destroy based on its data classification, the method's technical verifiability and its risk tolerance. The financial comparison did not determine the method.
Before removal, the bank also modeled verified Purge under NIST SP 800-88. The alternative preserved roughly $438,000 in client recovery.
Purge and verification would have cost about $42,400, or $23,600 more than destruction. The model left roughly $414,100 in potential net value.
ITAMG therefore used Destroy for all 9,412 drives, including 3,332 solid-state drives.
The records delivered to Internal Audit
| Document | Evidence in the record |
|---|---|
| Certificate of destruction (1) | Destruction dates, method and all 9,412 drive serial numbers |
| Witness statement (1) | The bank officer's signed record that all on-site destruction was observed |
| Chain-of-custody records (21) | Custody at each handoff for every truckload, from the site dock to the processing facility |
| Settlement and client-recovery report | Recovery credited to each accepted asset |
| Certificate of recycling | Residual material processed through ITAMG's R2v3-certified operations |
| Weight and diversion report | Downstream destinations and disposition for material outside client recovery |
| Final reconciliation | One record accounting for all 2,341 assets, including the 23 added from the physical count |
Services for controlled infrastructure retirement
ITAMG combines custody, approved sanitization or destruction, recovery, recycling and closeout reporting in one documented scope.
This engagement used data center decommissioning, hard drive destruction and server recycling.
Data Destruction
On-site and off-site media destruction aligned to NIST SP 800-88 Rev. 2, with applicable serial numbers recorded.
Learn moreIT Asset Disposition
Enterprise hardware retirement with documented custody through each handoff.
Learn moreSell Used IT Equipment
Client recovery for accepted servers, storage and networking equipment.
Learn moreComputer Recycling
Residual material processed through ITAMG's R2v3-certified operations, with downstream disposition documented.
Learn moreIndependent company ratings for ITAMG
Plan the closeout
Need to clear infrastructure and reconcile every asset?
ITAMG supports projects nationwide, from a single rack to coordinated multi-site decommissioning.
A written scope and fixed quote can cover removal, custody, the approved sanitization or destruction method, client recovery and closeout reporting.
About ITAMG
Since 1999, IT Asset Management Group has provided IT asset disposition and data center decommissioning services.
ITAMG holds R2v3, NAID AAA and RIOS certifications. Its media sanitization processes are aligned to NIST SP 800-88 Rev. 2, with nationwide service coverage across all 50 states.
This engagement combined multi-site removal, witnessed media destruction, client recovery and final reconciliation to the bank's project inventory.
www.itamg.com · +1 877.625.4872