Every retired router can carry configuration files, credentials, and customer data. Every switch takes up rack space until someone deals with it. And every decommissioning project sits at the intersection of security, compliance, and budget.
IT asset decommissioning is the formal process of retiring hardware securely, covering both the physical equipment and the data living inside it. It's not unplugging old gear. It's a documented process that protects your company from data breaches while potentially recovering real cash from equipment you'd otherwise scrap.
This guide covers the full decommissioning process, what it costs, the cybersecurity risks nobody talks about enough, and how to turn old Cisco, Juniper, or Arista gear into revenue instead of e-waste.
Key Takeaways
- Treat decommissioning as a structured process—inventory, sanitize, remove, dispose—to close security and compliance gaps
- Improperly wiped routers can expose customer data and authentication keys to the next buyer
- Your costs hinge on volume, sanitization method, and residual resale value
- Selling surplus equipment to a specialized buyer can offset or exceed your decommissioning costs
What Is IT Asset Decommissioning?
IT asset decommissioning is the formal, controlled process of retiring hardware and software assets once they're no longer needed in production. It covers everything from cataloging the equipment to wiping its data to deciding where it goes next. Think of commissioning and decommissioning as opposite bookends of the asset lifecycle. Commissioning deploys new equipment into your network. Decommissioning removes it, safely and with a paper trail. IBM frames this as the end-of-life phase of the IT asset lifecycle. It is the final stage in the broader IT Asset Disposition (ITAD) process:
- Inventory
- Sanitization
- Removal
- Disposition A concrete example: A data center refresh replaces a rack of Cisco Nexus switches with newer Arista gear. The old switches held configuration data, VLAN details, and possibly stored credentials. Before those units leave the building, teams wipe them, document the process, and decide whether to redeploy, sell, or recycle. That entire sequence is IT asset decommissioning.
Why IT Asset Decommissioning Matters
Skipping proper decommissioning creates lasting liability.
Data Security Risks Are Real
In 2023, ESET researchers bought 18 used enterprise routers on the secondary market. After adjusting for a dead unit and a mirrored pair, they found that over 56% still exposed configuration details or data, including customer information and router-to-router authentication keys.
That's not a hypothetical. That's more than half of secondhand routers tested leaking sensitive data to whoever bought them next.
Compliance Frameworks Demand Documentation
- HIPAA requires documented final-disposition procedures for any device that touched ePHI, with records retained for six years
- GDPR requires deleting personal data once it's no longer needed and demonstrating that deletion happened
- SOX-related audit rules carry their own record-retention requirements that can overlap with equipment holding financial data
None of these frameworks treat "we unplugged it" as a compliance answer.
Cost Recovery Offsets the Process
Surplus routers and switches often retain real resale value, especially from brands like Cisco, Juniper, and Arista. Terabit Systems' buy-back program, for example, purchases used equipment at fair market value or offers trade-in credit, turning a line-item cost into recovered capital.
Additional Business Benefits
- Certified recycling avoids landfill disposal and e-waste penalties
- Removing idle units frees rack space and cuts power and cooling costs
- Clearing ghost assets simplifies inventory and management systems
The IT Asset Decommissioning Process: Step-by-Step
A proper decommissioning project follows six stages. Skipping any of them creates risk.
Asset Inventory & Identification: Catalog every device: make, model, serial number, condition, and current location. You can't sanitize or dispose of what you haven't tracked.
Planning & Risk Assessment: Map network dependencies, set a timeline, and assign stakeholders across IT, compliance, and finance. Nobody wants to discover mid-project that a "retired" switch was still routing traffic.
Data Backup & Sanitization: Back up anything still needed, then sanitize using a documented method: logical wipe, cryptographic erasure, or physical destruction, depending on the device's data sensitivity.
Physical Removal & Secure Transport: Disconnect and label equipment, then transport it with chain-of-custody documentation. This step matters more than people assume; a truck full of unlabeled switches is a liability in transit.
Disposition Decision: Decide whether each asset gets redeployed internally, sold to a buyer like Terabit Systems for fair market value, or sent to certified recycling.
Documentation & Certification: Generate certificates of data destruction and compliance reports. These become your audit trail if a regulator or customer ever asks what happened to the hardware.
What Does IT Decommissioning Cost?
There's no universal per-unit price for decommissioning enterprise networking gear. Cost depends on:
- Volume — a handful of switches vs. a full data center refresh
- Sanitization method — a logical wipe costs far less than physical destruction with certified verification
- Resale value — whether the equipment offsets its own disposal cost
In-house decommissioning carries hidden costs that rarely show up as a single line item:
- Staff hours spent on inventory and data wiping
- Compliance risk when sanitization is done incorrectly
- Missed resale value when gear is scrapped instead of sold
Selling used gear to a specialized reseller changes that math. Terabit Systems buys used switches, optics, and components at fair market value, with pricing that varies by item type and condition.
That revenue can offset, and sometimes exceed, the full decommissioning cost—turning an expense into income.
IT Decommissioning and Cybersecurity
Here's the uncomfortable truth: a factory reset is often not enough.
NIST SP 800-88 Rev. 2 outlines three sanitization tiers — Clear, Purge, and Destroy — and recommends Purge over Clear whenever possible.
A basic factory reset on a router or switch typically only achieves Clear-level sanitization. That's fine for low-sensitivity gear, but insufficient for devices that held customer data, credentials, or network architecture details.
Retired network hardware can expose:
- Configuration files and VLAN details
- Stored credentials and router-to-router authentication keys
- Logs revealing network topology and operational history
- Firmware images that hint at your security posture
Closing those gaps takes a deliberate sanitization process—not a default vendor reset.
Best practices for network hardware sanitization:
- Use NIST 800-88-aligned erasure methods, not just a vendor's default reset
- Treat removable storage (flash cards, NVRAM) as separate items requiring their own sanitization
- Verify sanitization with documented certificates tied to serial numbers
- Escalate to physical destruction when a device can't meet the required assurance level
Recovering Value from Decommissioned Networking Equipment
Enterprises, ISPs, and cloud/data center operators don't need to scrap Arista, Juniper, Cisco, or Extreme gear just because it's leaving production. Much of it still has a home in the secondary market.
How the trade-in process typically works:
- Submit your surplus inventory for a free audit
- Get a fair-market-value offer or trade-in credit toward your next purchase
- Ship equipment with documented chain of custody
- Receive payment or credit once the audit confirms condition
Terabit Systems runs its buy-back program this way, purchasing equipment ranging from legacy systems to current-generation devices. Every unit goes through a five-step quality control process:
- Physical inspection
- Functional testing
- Factory-default processing
- Cosmetic refurbishment
- Final QC
Factory-default processing strips passwords and configurations before anything is resold.
That level of handling is why a networking specialist outperforms a generic e-waste recycler on recovery value. A recycler may not know a used Juniper QFX5100 or Cisco Nexus line card still has resale demand. A networking-focused buyer does—and that knowledge turns decommissioned gear into real return instead of scrap.
Frequently Asked Questions
What are the steps in the IT decommissioning process?
Six core steps cover the full lifecycle: inventory, planning and risk assessment, data backup and sanitization, physical removal and secure transport, disposition, then documentation and certification. See the step-by-step section above for details on each.
What is commissioning and decommissioning in IT?
Commissioning is deploying new hardware or software into active use. Decommissioning is the reverse: formally retiring those assets, securing their data, and deciding on final disposition.
What does IT decommissioning mean?
IT decommissioning is the secure retirement of hardware and software assets—wiping or destroying stored data and documenting the process for compliance and audit.
What is IT decommissioning in cybersecurity?
In cybersecurity, IT decommissioning prevents breaches from retired devices by sanitizing storage before resale, recycling, or disposal. Without it, old routers and switches can leak credentials and configuration data.
How much does IT decommissioning cost?
Cost depends mainly on asset volume, sanitization method, and equipment condition. Selling surplus gear to a buyer like Terabit Systems can offset much of that spend through fair-market-value payouts.
What is an example of IT decommissioning?
A common example: retiring a rack of end-of-life Cisco or Juniper switches during a data center migration, then sanitizing, documenting, and either reselling or recycling each unit.
