# The Deal Closes. Now You Own Their Disposal History Too. Source: https://promo.ccrcyber.com/articles/merger-acquisition-itad Author: Brian Boynton Published: July 2, 2026 Publisher: CyberCrunch (https://ccrcyber.com) > M&A hands you someone else's IT estate — unknown inventory, unknown disposal history. How ITAD fits diligence, Day 1, consolidation, and divestiture data separation. ## Diligence: their disposal shortcuts become your regulatory history Acquirers audit contracts, litigation, and security posture — and almost never ask how the target has been disposing of IT assets. Yet successor liability doesn't care: a target that spent years handing retired drives to an unvetted hauler has been accumulating exactly the kind of exposure that surfaces later as someone else's breach notification. The [case files](https://promo.ccrcyber.com/articles/itad-breach-case-files) show how long disposal failures take to surface — Morgan Stanley's 2016 project produced penalties into 2023. The diligence ask is small: the target's disposal policy, its ITAD vendor(s) and their certifications, and serialized certificates from the last one or two disposal events, reconciled against retirement records. A clean answer takes the target a day to produce. An inability to produce it is itself the finding — price the remediation, or at minimum plan the estate's first compliant disposal wave, into integration. ## Day 1 and the interim: devices in motion, entities in flux - **Freeze informal disposal.** Integration uncertainty makes people clean house; the target's teams should stop ad-hoc equipment disposal at announcement, because assets discarded during the interim are the ones nobody can account for later. - **Departures spike; recovery must keep up.** Deals shed people. Every departure is a device (or three) that needs recovery, lock release, and disposition — the [offboarding problem](https://promo.ccrcyber.com/crunch/offboarded-not-forgotten) at deal volume, often across sites and remote staff simultaneously. - **Name the entity on the paperwork.** During transition, certificates of destruction, custody documents, and settlement reports must name the correct legal entity — the one that owns the assets on that date. Certificates issued to a dissolved or renamed entity fracture the audit trail exactly where a regulator would look. It's a one-line instruction to the ITAD vendor; give it. - **Interim inventory.** Merge or at least cross-reference asset inventories early. You cannot dispose of, or defend, an estate you haven't enumerated — and the combined [CMDB](https://promo.ccrcyber.com/answers/#cmdb) is what every later certificate reconciles against. ## The consolidation wave: duplicate everything, retired at once Six to eighteen months after close, integration produces the wave: duplicate data centers and server rooms, overlapping offices, redundant branch infrastructure, and one of two endpoint fleets — all retiring on a compressed schedule. Treat it as what it is: a multi-site [decommissioning program](https://promo.ccrcyber.com/articles/data-center-decommissioning-checklist) plus a set of [office closures](https://promo.ccrcyber.com/articles/office-closure-it-checklist), with the same controls — serialized inventory first, per-media [NIST 800-88](https://promo.ccrcyber.com/articles/nist-800-88-explained) methods, sealed custody, reconciled certificates. Two deal-specific notes. **Value recovery is real money at wave scale** — a consolidated refresh generates enough recent-generation equipment that remarketing returns can visibly offset integration cost, provided devices are released from the (possibly two different) management stacks before they ship. And **license harvesting belongs in the same pass**: retiring hardware carries transferable licenses and support contracts that integration budgets routinely forget to reclaim or cancel. ## Divestitures: data separation runs in both directions Carve-outs invert the problem: instead of absorbing an estate, you're splitting one. The hardware and the data on it rarely divide along the same line, which creates two destruction obligations that mirror each other: - **Assets that go with the divested business** may carry the parent's data — retained-company information that must be verifiably destroyed or migrated off before transfer. A transferred server with the parent's data aboard is a disclosure, not a convenience. - **Assets that stay with the parent** may carry the divested unit's data — which the buyer's transition agreement will often require destroyed by a date, with evidence. - **TSA end dates are destruction deadlines.** Transition-services periods end with data-return-or-destroy obligations; serialized certificates are how both sides prove the clause was met, and the entity-naming rule above applies doubly. The pattern across all four stages is the same one that runs through this whole hub: the organization that can produce a reconciled, serialized record wins every later argument — with a regulator, a counterparty, or its own auditors. In M&A there are simply more counterparties waiting to ask. Inherited litigation brings inherited legal holds, and they rarely transfer into the acquirer’s asset systems before consolidation starts. [The legal-hold brief](https://promo.ccrcyber.com/articles/legal-hold-itad-data-destruction) lays out the hold gate that keeps held devices out of a consolidation wave. ## M&A ITAD FAQ ### Do we inherit their past disposal problems? Structure and jurisdiction determine the legal answer — that's deal counsel's question — but practically the acquirer inherits the *consequences*: if the target's previously disposed devices surface with recoverable data post-close, the notification and regulatory costs land on the combined company. That's why disposal history belongs in diligence. (Informational only, not legal advice.) ### What does ITAD diligence actually ask for? Four artifacts: the disposal policy; the ITAD vendors and their certifications (R2v3, NAID AAA); serialized certificates from the most recent disposal events; and evidence they reconcile to retirement records. A mature program produces this in a day. Gaps aren't deal-breakers — they're integration line items with a cost attached. ### Whose name goes on the certificates mid-deal? The legal entity that owns the assets on the destruction date — which can change across a transition. Make entity naming explicit in the ITAD engagement: pre-close disposals certify to the target; post-close, to the surviving entity; in carve-outs, per the asset allocation. Wrong-entity certificates are reconcilable only with effort, exactly when someone's scrutinizing the file. ### When do we plan the consolidation wave? During integration planning, before close — not when the duplicate data center's lease renewal forces it. The wave is predictable from the deal thesis, so the ITAD workstream can be scoped early: inventory merge, vendor selection, per-site schedules, and value-recovery estimates integration finance will welcome. Early planning is also what secures provider capacity on your timeline instead of theirs.