# The ITAD Certification Field Guide: What NAID AAA, R2v3, RIOS — and the State Permit — Actually Require

Source: https://promo.ccrcyber.com/guides/itad-certification-field-guide
Author: Brian Boynton
Published: July 29, 2026
Updated: September 1, 2026
Publisher: CyberCrunch (https://ccrcyber.com)

> What NAID AAA, R2v3, RIOS, and the PA DEP permit actually require inside: specification structure, employee screening, unannounced audits, appendices, and scope.

Section 01

## Four credentials, four different jobs

A destruction provider's credential wall usually compresses into a single line of logos — and the compression loses the most useful information: what anyone actually had to *do* to put each logo there.

Sorted by the job they perform, the four break cleanly. **NAID AAA** is a *security specification* for information destruction operations, written and enforced by i-SIGMA, the trade association for the secure destruction and records management industry. **R2v3** is a *responsible-recycling standard*, governed by SERI (Sustainable Electronics Recycling International), focused on where materials and data-bearing devices go and what happens to them. **RIOS** is a *management-system standard* for recyclers — the discipline layer that keeps quality, environmental, and safety performance consistent. And the **PA DEP permit** is not a certification at all: it is *government authorization* to operate an electronics-processing facility in Pennsylvania.

That last distinction organizes everything else. Certifications are voluntary: a company chooses to be measured against a private standard, and an independent auditor confirms conformance. A permit is mandatory: without it, the processing activity is unlawful regardless of how many certifications the company holds. When the four appear together, you're looking at a stack — legal authorization at the bottom, management discipline above it, and the two specialized standards (recycling responsibility and destruction security) on top.

Bottom line

Read the logos as a stack, not a list: the permit makes the operation legal, RIOS makes it consistent, R2v3 makes the downstream responsible, and NAID AAA makes the destruction itself secure. The rest of this guide opens each one up.

Section 02

## NAID AAA in brief: the destruction-security specification

NAID AAA is administered by i-SIGMA against a published Certification Specifications Reference Manual — a numbered specification with an audit methodology attached to every requirement. It reads like an audit checklist because it is one.

The specification has three tiers: requirements for **every certified operation** (screened **Access Individuals**, annual training, a designated i-SIGMA Certification Compliance Officer, receipts and serial-number logs, written disclosure of any subcontractor in the custody chain, and a written unannounced-audit policy); requirements for **facility-based operations** (access control, CCTV over every point where media is received, staged, processed, or destroyed, retained for 90 days); and per-media, per-method **endorsements** — paper, micro media, hard drives (physical destruction, overwriting, degaussing), solid-state devices (physical destruction, overwriting), optical and tape media, product destruction — each designated facility-based, mobile, or both. A NAID AAA certificate is the sum of its endorsements, which is why two providers with the same logo can be certified for different work.

Its defining feature is enforcement: scheduled audits against the full specification, plus **random unannounced audits** the operation must be structurally ready for. Since **October 1, 2026**, the specification has included cybersecurity requirements — documented policy with per-employee attestations, access control extended to servers and network equipment, a named set of controls the annual third-party security risk analysis must evidence, and workstation and identity controls for erasure and degaussing endorsement holders; the [companion brief](https://promo.ccrcyber.com/articles/naid-aaa-cybersecurity-requirements-2026) has the section-by-section view.

Read the full field guide

The [NAID AAA Certification Field Guide](https://promo.ccrcyber.com/guides/naid-aaa-certification-field-guide) is the buyer’s deep-dive: how the manual is organized, the complete endorsement list, the Access Individual screening rules, the receipts and failed-device documentation you should receive, how the audits run, why i-SIGMA membership is not certification, and how to verify a certificate in the directory.

Bottom line

NAID AAA answers one question — is the destruction operation itself secure, by people, facility, method, and documentation? — and verifies the answer without warning. Read the endorsement line, not the logo.

Section 03

## R2v3 in brief: the responsible-recycling standard

R2v3 — the current version of SERI’s Responsible Recycling standard — is built as a universal core plus modular appendices, and its certificate is issued to a facility address, not a company.

Ten **Core Requirements** apply to every R2 facility: scope (all R2-related processes the facility manages must be inside the audit — nothing carved out), the hierarchy of responsible management strategies, a separately certified EH&S management system (ISO 14001 plus 45001, or RIOS), legal and other requirements including import/export law, tracking throughput, sorting and categorization, data security, focus materials, facility requirements, and transport. Lettered **Process Requirement appendices** then attach to what the facility actually does: **A** downstream recycling chain, **B** data sanitization, **C** test and repair, **D** specialty electronics reuse, **E** materials recovery, **F** brokering, and **G** photovoltaic modules (added 2024).

Reading a certificate means reading its appendix list. A facility scoped to Appendices A, B, and C — CyberCrunch’s scope — is audited for downstream vendor management, data sanitization, and test-and-repair for reuse. A facility scoped only to E is a materials-recovery operation whose certificate says nothing about sanitizing anything. Certification runs through SERI-authorized, accredited certification bodies with a two-stage initial audit and annual surveillance, and SERI’s public directory shows each facility’s current status and appendices.

Read the full field guide

The [R2v3 Certification Field Guide](https://promo.ccrcyber.com/guides/r2v3-certification-field-guide) is the buyer’s deep-dive: why the certificate is per facility, the Core Requirements that matter most, what Appendix B actually requires for sanitization and independent verification, Appendix A’s downstream due diligence, how the audit cycle works, and how to verify status, address, and appendices in SERI’s directory.

Bottom line

R2v3 = ten universal core requirements + the appendices matching what the facility does, at one address. For ITAD the load-bearing letters are A, B, and C. Check the appendix list and the directory status, not the logo.

Section 04

## RIOS in brief: the operating system underneath

RIOS — the Recycling Industry Operating Standard — is the least flashy credential of the four and the one doing the quietest structural work: it certifies the *management system* that keeps everything else running the same way on a Tuesday in February as during an audit.

RIOS is an **integrated QEH&S standard**: quality, environmental, and health & safety management unified in a single framework built for recycling operations. It grew out of the scrap and recycling industry’s trade association (ISRI, now the Recycled Materials Association) and is administered by the Global Recycling Standards Organization. It follows the classic Plan-Do-Check-Act management-system discipline, is certified by third-party audit on a recurring cycle, and — the reason it matters most to ITAD buyers — is accepted by R2v3 as the certified EH&S management system Core Requirement 3 demands and as the quality management system Appendix C requires, in place of ISO 14001, 45001, and 9001.

In the credential stack, RIOS answers the question the other logos don’t: *will this operation perform the same way on every project?* NAID AAA audits the security of destruction; R2v3 audits the responsibility of the downstream. RIOS audits the machine that runs both. It does not, and does not claim to, certify data destruction.

Read the full reference

The [RIOS section of the ISO management-system standards guide](https://promo.ccrcyber.com/guides/iso-management-standards-itad-field-guide#rios) covers what RIOS certifies, how it maps to ISO 9001, 14001, and 45001, where R2v3 accepts it, and how to verify a certificate in GRSO’s directory.

Section 05

## The PA DEP permit and the law behind it

The fourth credential is the one that isn't voluntary. In Pennsylvania, processing electronics for recovery and recycling is a regulated activity — and the regulator is the Department of Environmental Protection.

The legal frame is Pennsylvania's **Covered Device Recycling Act** (Act 108 of 2010), the state's electronics-recycling law. The CDRA builds a manufacturer-funded recycling system for covered devices — and it sets conditions on the recyclers who process them. Under the state's program, a recycler handling covered devices must hold an accredited responsible-recycling certification — R2 or e-Stewards — or an equivalent internationally accredited environmental management standard, and a recycler *located in Pennsylvania* must additionally hold the DEP's general permit for electronics processing. The statute and the certification system interlock: the state leans on the private standards for process quality, and adds its own permit for the facility itself. The state has since applied the same template to solar facilities in [Act 44 of 2026](https://promo.ccrcyber.com/articles/pa-solar-decommissioning-act-44).

The permit — the WMGR081 general permit family, issued under the state's Solid Waste Management Act — authorizes the **processing and beneficial use of source-separated electronic devices**: disassembly, mechanical processing, and the associated storage, for material recovery and recycling. It is **facility-specific and non-transferable**: it names an operator and a location, which is why a permit held for one site says nothing about another. What it obligates the holder to is the operating conditions of the permit and the underlying waste law — lawful handling, storage limits, and the state's enforcement jurisdiction over the facility.

Outside Pennsylvania the pattern repeats with different names: most states with electronics-recycling laws pair a registration or permit for processors with reliance on the same certification standards. The principle for a buyer is portable — somewhere under the certifications, a government agency should be authorizing the physical facility. In Pennsylvania, that's the DEP.

A note on scope

This section describes the Pennsylvania program at the pattern level, based on PA DEP's published guidance. State electronics laws differ and change; for the 50-state landscape, see the [Multi-State ITAD Compliance Field Guide](https://promo.ccrcyber.com/guides/multi-state-itad-compliance-field-guide), and verify any specific obligation with the agency or counsel.

Section 06

## How the four fit together

Put back side by side, the four credentials stop being interchangeable logos and become a readable stack — each with its own issuer, its own audit model, and its own question.

| Credential | Issued by | The question it answers | Verified how |
| --- | --- | --- | --- |
| NAID AAA | i-SIGMA | Is the destruction operation itself secure — people, facility, methods, and (from Oct 2026) the data environment? | Scheduled + random unannounced audits against a published specification, per endorsement |
| R2v3 | SERI, via accredited certification bodies | Are devices, data, and materials handled responsibly through a vetted downstream? | Accredited third-party audit of ten core requirements + scoped appendices |
| RIOS | Global Recycling Standards Organization (ReMA-affiliated) | Does a managed QEH&S system keep the operation consistent? | Third-party audit of the integrated management system |
| PA DEP permit | Pennsylvania DEP | Is this facility legally authorized to process electronics at all? | State permitting under the Solid Waste Management Act; agency enforcement |

The stack is also why "which certification is best?" is usually the wrong question. They aren't substitutes. A provider holding only R2v3 has audited recycling but unaudited destruction security; only NAID AAA, the reverse; neither speaks to the management system or the legal authorization. The combinations are what carry meaning — which is exactly how to read a vendor's wall. To turn this understanding into an evaluation, the [Vendor Due Diligence Scorecard](https://promo.ccrcyber.com/tools/vendor-due-diligence-scorecard) scores a specific vendor against the evidence, and the [due-diligence guide](https://promo.ccrcyber.com/guides/itad-vendor-due-diligence-guide) walks the verification steps credential by credential.

Section 07

## Frequently asked questions

### What's the difference between a certification and a permit?

A certification is voluntary conformance to a private standard, verified by an independent auditor — NAID AAA, R2v3, and RIOS all work this way. A permit is legal authorization from a government regulator to conduct an activity at a specific facility — in Pennsylvania, the DEP general permit that authorizes electronics processing. A processor needs the permit to operate lawfully at all; it pursues certifications to prove how well it operates. One is a license, the others are audited claims of quality and security.

### Does R2v3 cover data destruction?

Partly. Data security is one of R2v3's ten core requirements, and facilities that sanitize media add Appendix B, which governs logical and physical data sanitization. But R2v3 is a responsible-recycling standard first — data sanitization is one process area among several. A destruction-first security certification like NAID AAA audits the security of the destruction operation itself, including employee screening and unannounced audits, which is why serious processors hold both.

### What does NAID AAA require of a provider's employees?

Every Access Individual — personnel with access to client media — must be screened before getting that access: verification of previous employment, a criminal records search drawn from federal, state, and county repositories, and initial drug screening through a third-party screening service. Since October 1, 2026, each Access Individual must also sign a documented attestation confirming they understand and agree to the organization's cybersecurity protocols, and auditors verify those attestations by sampling employee files.

### Are certified providers really audited without warning?

Under NAID AAA, yes. Random unannounced audits are a stated part of the certification program, and providers must maintain a written unannounced-audit policy naming at least one contact with physical access to the records an auditor may demand — so a surprise visit can't be stalled. R2v3 and RIOS use scheduled audits by accredited certification bodies on a recertification cycle. The unannounced element is specific to the destruction-security side, and it's a large part of what the NAID AAA credential is worth.

### What changed for NAID AAA holders on October 1, 2026?

i-SIGMA added cybersecurity requirements to the NAID AAA and PRISM Privacy+ certification standards: a documented cybersecurity policy with signed per-employee attestations, access control extended explicitly to servers, storage devices, and network equipment, an annual third-party security risk analysis with named controls, and new workstation access control and identity access management requirements for erasure and degaussing endorsement holders. Our [brief on the update](https://promo.ccrcyber.com/articles/naid-aaa-cybersecurity-requirements-2026) covers all five changes section by section.

THE WORKED EXAMPLE

## See the whole stack in one audit-ready file

CyberCrunch holds all four: NAID AAA continuously since 2012, R2v3 scoped to Appendices A, B, and C, RIOS, and the PA DEP general permit for its Greensburg facility. The Compliance & Credentials Packet reproduces the certificates, the permit, the insurance breakdown, and the chain-of-custody process in a single PDF — and the due-diligence questionnaire turns this guide into questions you can send any vendor.

NAID AAA · SINCE 2012
R2v3 · APPENDICES A/B/C
RIOS
PA DEP · WMGR081

[Get the credentials packet →](https://promo.ccrcyber.com/cybercrunch-compliance-credentials-packet)
[Talk to a compliance specialist](https://ccrcyber.com/contact?utm_source=guides&utm_medium=cta&utm_campaign=itad-certification-field-guide)

*This guide is informational only and reflects publicly available sources and the referenced standards as of July 2026 — including the i-SIGMA Certification Specifications Reference Manual, SERI's published R2v3 materials, RIOS program information, and PA DEP's published CDRA guidance. It is not legal or compliance advice, and no attorney-client relationship is created by reading it. Standards, statutes, and program requirements change; verify current requirements with the issuing body or agency, and consult qualified counsel before acting. CyberCrunch credential details reflect certificates and permits at the time of publication.*