01 / DEFINITIONSWhat each one actually is
On-site destruction brings the capability to you: a mobile shredding unit and crew at your dock, media destroyed before the truck leaves, your staff free to witness and sign. The output leaves as commodity shred, not as readable drives. Off-site (facility-based) destruction moves intact equipment to a processing facility under chain of custody — serialized intake, locked totes, numbered tamper-evident seals, signed handoffs, seal verification at receipt — where media is sanitized or destroyed and working equipment can be graded for resale. The paths differ in geography and custody model; they must not differ in evidence.
02 / THE CASE FOR ON-SITEWhen the shredder should come to you
On-site wins when the transport of intact media is itself the unacceptable risk. Signals that point here: a data-classification policy or client contract that says media may not leave the premises readable; regulator or examiner expectations of witnessed destruction; defense work where CUI handling rules make transport a compliance question, not just a logistics one; high-density troves of loose drives — a decommissioned data center's pulled media — where the value is zero and the sensitivity is maximal; and organizational moments where the optics of watching it happen carry real weight with a board or an auditor. What you're buying is the elimination of a custody segment and an eyewitness line in the record.
03 / THE CASE FOR OFF-SITEWhen the facility is the right answer
Off-site wins on economics and on everything that isn't pure destruction. Facility processing consolidates equipment across clients, which is why it's the cost default; it handles the full media zoo — drives, tapes, mobiles, copier drives, network gear — with the right method per type; and critically, it's the only path that preserves choice: working equipment can be sanitized to a NIST 800-88 purge and remarketed, returning value instead of consuming shred cost. A fleet of two-year-old laptops routed through an on-site shredder is a value-destruction event dressed as a security decision. Off-site's obligation is the custody record: seals recorded on the manifest, verified at receipt, exceptions treated as incidents.
04 / THE CUSTODY QUESTIONWhat the sealed chain actually does
The instinct that transport equals risk is right — unmanaged transport is the classic disposal-breach pattern, and the public case files prove it. What certified off-site programs change is that transport stops being trust and becomes arithmetic: the seal number that left your dock either matches at the receiving bay or it doesn't; the serials on the intake manifest either reconcile or they don't; a mismatch is a stop-everything event, not a shrug. On-site removes the segment; off-site instruments it. Both are legitimate answers — what's illegitimate is transport without the instrumentation. (What the failure mode looks like in the wild: the breach case files.)
05 / THE DECISIONFactor by factor
Run the choice as a checklist. Policy and contracts: does any policy, flowdown, or regulator expectation require witnessed destruction or forbid intact media leaving? If yes, on-site for that media class — the decision is made. Media value: working, remarketable equipment argues off-site (destruction on your dock forfeits the resale offset). Media sensitivity and form: loose drives and pulled media with no resale value and maximal sensitivity are the classic on-site load. Volume and geography: a single dense site suits a shred-truck visit; a distributed fleet across forty locations is a facility-program shape. Witness requirements: if someone must attest “I watched it,” that's on-site — or a facility visit, which certified vendors accommodate. Budget reality: mobilization costs money; pay it where policy demands, not everywhere by reflex.
06 / THE HYBRIDHow mature programs actually run it
In practice the answer is usually “both, by rule.” The disposition policy assigns each media class a path in advance: witnessed on-site shred for the drives pulled in a data-center decommission and for anything under a witnessed-destruction clause; sealed facility processing with value recovery for the working fleet; and the same evidence standard — per-serial certificates naming the NIST 800-88 method, reconciled to intake — on every path. Writing the rule once, in the policy, is what keeps the loading dock from becoming a debate club. The Method Picker maps media to valid methods; the Field Manual is the media-by-media reference behind it.
07 / FAQOn-site vs. off-site FAQ
Is on-site destruction more secure than off-site?
It closes a different risk. On-site destruction eliminates transport entirely — data-bearing media never leaves your control intact, and your staff can witness the shred. Off-site destruction under a certified program replaces that with sealed, serialized chain of custody: numbered tamper-evident seals, signed handoffs, and reconciliation at receipt. Both end in verified destruction; the choice is about which risk your policy or regulator wants eliminated versus documented.
When is on-site destruction required?
Rarely by statute, often by policy. Some organizations — defense contractors handling CUI, healthcare systems under strict internal PHI rules, financial institutions responding to examiner expectations — write witnessed destruction into their own policies or contracts. If your data-classification policy, a client contract flowdown, or your regulator's guidance says media may not leave the premises intact, that clause decides the question for you.
Is off-site destruction cheaper?
Generally, yes. On-site work brings a shred truck and crew to your location — real capability with real mobilization cost. Facility-based destruction consolidates that overhead across many clients, which is why it's the economical default. The right comparison isn't just price, though: it's price against which risks your policy requires you to eliminate rather than document.
Can we mix both in one program?
Yes, and mature programs usually do: on-site destruction for the highest-sensitivity media classes — loose drives from a data center, media under a witnessed-destruction clause — and facility-based processing for the general fleet, where sealed custody plus resale-value recovery makes more sense. The disposition policy assigns each media class a path in advance, so the decision is a rule, not a debate at the loading dock.