01 / THE HONEST ANSWERNothing stops you — and nothing excuses you
There is no rule that data destruction must be outsourced. What the governing standard — NIST SP 800-88, now in Revision 2 — actually requires is indifferent to who holds the tool: a technique valid for the media type, applied to every device, verified, and documented. Those last two words are where this article earns its length. In-house destruction fails audits not because the drives survived, but because nobody can prove what happened to serial number so-and-so. If you internalize one thing: the deliverable of a destruction program is not debris. It's a record.
02 / METHODSWhat works, what doesn't, by media type
Drilling and hammering — the folk methods — damage drives without meeting the standard. A drill hole ruins the track it passes through; the remaining platter surface is physically intact, and recovery labs work with damaged media for a living. NIST's Destroy category means techniques like shredding, disintegrating, pulverizing, and incinerating — nothing meaningfully intact afterward.
Degaussing works on magnetic media only — hard drives, tape — and destroys the device along with the data. Against an SSD it does precisely nothing: flash stores charge, not magnetism, and a degaussed SSD hands its data back untouched.
Shredding is the gold standard with a flash-shaped asterisk: memory chips small enough to pass intact through an HDD-width shredder can be read off-board afterward. Flash media needs flash-rated particle sizes — a specification question, not an anxiety question (the media-by-media detail lives in the Data Destruction Field Manual).
Software sanitization — verified overwrite for magnetic drives, cryptographic erase or native sanitize commands for SSDs — meets the Clear/Purge levels of the standard and preserves the device's resale value. It also demands the most process discipline: per-drive verification, logged, every time. Sanitization without a verification step is a hope, not a method.
03 / THE RECORDThe verification problem, which is the whole problem
Run the audit conversation forward. Someone — an auditor, an assessor, an incident-response team after a laptop turns up somewhere unexpected — asks: what happened to this asset? The answer “we destroy drives in-house” is a policy, not evidence. The defensible record is per-device: serial captured before destruction (afterward there's nothing left to read), method named, date, operator, ideally a witness or photo. That's the entire content of a professional certificate of destruction — which is why certificates exist. They aren't a ceremony; they're this record produced at scale with the reconciliation against your inventory already done. Build the same record yourself and DIY destruction is defensible. Skip it and, evidentially, the destruction never happened.
04 / THE MATHLabor, safety, and the debris you now own
Price the work honestly. Someone inventories every drive, pulls them from chassis, captures serials, performs the destruction, verifies, logs, and then — the forgotten line item — disposes of the debris. Shattered platters and shredded electronics are not office trash: electronics carry landfill restrictions in a large share of states, and the debris stream needs a documented recycling path just like whole devices do (that problem is the second half of the companion piece on DIY resale). At a handful of drives, this is an afternoon. At a refresh wave's worth, it's a project with safety equipment, and the internal hourly math usually stops flattering the DIY option well before the hundredth serial.
05 / WHEN DIY IS FINEThe legitimate case
Small volumes, low-sensitivity data, a person willing to keep the log: perfectly reasonable. A ten-drive pile from aging desktops, serials photographed, drives run through verified overwrite or physically destroyed completely, a one-page record filed — no auditor will blink. The method matched the media, the verification happened, the record exists. That is the standard.
06 / WHEN IT ISN'TWhere the in-house case collapses
Four signals, any one sufficient. Regulated data — health records, financial data, CUI — where the evidentiary bar and the cost of being wrong both jump. Volume — the labor math above. Mixed media — the moment tape, copier drives, and SSDs enter the pile, method selection becomes a specification exercise most teams shouldn't improvise. And value — destroying working, remarketable equipment converts an asset into debris plus labor; sanitize-and-resell returns money instead (what that equipment is actually worth is its own question). A certified program isn't buying a bigger hammer — it's buying the record, the reconciliation, the flash-rated specifications, and the option to recover value instead of forfeiting it.
07 / FAQDIY destruction FAQ
Does drilling a hole through a hard drive destroy the data?
It destroys the drive, not necessarily the data. A drill hole ruins the area it passes through, but the rest of the platter surface remains physically intact, and specialized recovery labs work with damaged media routinely. NIST SP 800-88 treats Destroy as techniques like shredding, disintegrating, pulverizing, and incinerating — methods that leave no meaningfully intact recording surface. If you're going to destroy media yourself, destroy all of it, capture the serial first, and record the method.
Does degaussing work on SSDs?
No. Degaussing erases by collapsing magnetic fields, and flash memory stores data electrically, not magnetically — a degaussed SSD comes out with its data fully intact. Degaussing remains valid for magnetic media like hard drives and tape (and renders them unusable in the process), but for SSDs the valid paths are cryptographic erase or native sanitize commands with verification, or physical destruction at a flash-appropriate particle size.
If we destroy drives ourselves, do we still need a certificate?
You need a record, whatever you call it. Auditors and regulators don't ask whether destruction happened — they ask you to prove it, per device. A defensible internal record captures each serial before destruction, the method used, the date, and who performed and witnessed it. A certificate of destruction is simply that record produced professionally, with the reconciliation already done. No record means that, from an evidence standpoint, the destruction may as well not have happened.
Is DIY destruction compliant with HIPAA or NIST 800-88?
It can be — neither requires a vendor. NIST SP 800-88 is method- and verification-based: if you apply a valid technique for the media type, verify the result, and document it per device, in-house destruction can satisfy the standard. Where DIY programs actually fail compliance is the paper: no serial capture, no method documentation, no verification step. HIPAA's disposal expectations follow the same logic — the cited failures are almost always about media that left control with data intact and nobody able to prove otherwise.