ITAD Certifications Compared: R2v3, e-Stewards, NAID AAA and ADISA

ITAD certifications check the company that handles your old equipment, not the tools it uses. This guide compares four you will see on ITAD websites: R2v3, e-Stewards, NAID AAA and ADISA. R2v3 and e-Stewards are recycling and reuse standards with data rules inside them. NAID AAA is about destroying information. ADISA is a UK scheme for ITAD providers that also tests data sanitisation products on the side. Only those ADISA product tests look at software. The other three certify the operation.

That's the short answer. Below is who runs each one, what it actually certifies, and what it says about data, all taken from each body's own pages (or the EPA's) and linked so you can check.

---

The four at a glance

One thing the table makes plain: three of the four certify a facility or a service. If a vendor tells you its software is "R2 certified" or "NAID certified", ask what exactly was certified, and by whom.

R2v3: SERI's recycling and reuse standard

Who runs it. SERI (Sustainable Electronics Recycling International), the body behind the R2 standard. The EPA page links R2 straight to SERI's site.

What gets certified. The recycler. The EPA's page on certified electronics recyclers says "Currently two accredited certification standards exist", and the first one it names is "the Responsible Recycling ("R2") Standard for Electronics Recyclers". Recyclers become certified "by demonstrating to an accredited, independent third-party auditor" that they meet the standard. After that, they get "continual oversight by the independent accredited certifying body."

What it says about data. The EPA says both R2 and e-Stewards "require destruction of all data on used electronics." Wiping drives so they can be reused has its own part of R2v3, Appendix B. SERI has also ruled that wipe records must come from software, not from a spreadsheet someone typed. We cover that ruling, and the fields SERI wants in each record, in R2v3 sanitization records: why spreadsheets fail. The rest of Appendix B is on our R2v3 compliance page.

The key difference. R2v3 covers the whole recycling and reuse operation. Data sanitization is one appendix of it, not the whole standard.

e-Stewards: the Basel Action Network standard

Who runs it. The Basel Action Network. The e-Stewards site calls it "Our parent organization".

What gets certified. Recyclers and processors. The EPA lists it as the "Standard for Responsible Recycling and Reuse of Electronic Equipment." e-Stewards says on its why get certified page that "Version 4.1 was published on February 22, 2022."

What it says about data. "All e-Stewards processors must destroy all residual data on equipment they receive." For data security it leans on another certificate. It "requires Certification to i-Sigma's NAID AAA Data Security Standard." So an e-Stewards certified processor should also hold NAID AAA.

The key difference. e-Stewards leads with exports. In its own words, it "prohibits the export of hazardous electronic waste from developed to developing countries." It also "Requires compliance with ISO 14001 or RIOS Environmental Management Systems." ISO 14001 is the environmental management standard, so if you see it on an ITAD's site next to e-Stewards, this is likely why.

NAID AAA: now run by i-SIGMA

Who runs it. i-SIGMA. On May 9, 2018, NAID (the National Association for Information Destruction) announced it would merge with PRISM International "to form the new industry trade association International Secure Information Governance & Management Association (i-SIGMA)." The same release promised "NAID AAA Certification isn't going away." It didn't. The name stayed, and i-SIGMA runs it.

What gets certified. The destruction service. On i-SIGMA's NAID AAA page, endorsements define the service: mobile (on-site, with equipment at the client's site) or facility-based, and media types such as paper and hard drives. Certification also needs membership: "Certification is a benefit of i-SIGMA membership, and members must remain in good standing to maintain certification."

What it says about data. "Certification applies to both physical destruction and electronic media destruction." Notice the word: destruction. The page talks about destroying media. It doesn't describe wiping drives for reuse.

The key difference. The audits. i-SIGMA describes "both scheduled and unannounced reviews", and "Ongoing, unannounced audits ensure continuous compliance." Its page also names a state law: "New Jersey requires i-SIGMA NAID AAA Certification for on-site destruction of hard drives."

ADISA: UK ITAD certification, plus product testing

Who runs it. ADISA Certification, based in Harpenden in the UK. Its home page says it "is recognised by the United Kingdom Accreditation Service (UKAS)."

What gets certified. ITAD providers. The ICT Asset Recovery Standard 8.0 is "a certification for processors or sub-processors in the IT Asset Disposition (ITAD) sector." It is "formally approved by the ICO as an official UK GDPR certification scheme", and ADISA is "UKAS-accredited to audit this standard." Certified members "undergo regular audits to maintain their certified status."

What it says about data. ADISA says the standard "validates that IT Asset Disposition (ITAD) providers meet high data-protection standards." And "A DIAL rating (Data Impact Assurance Level) is a core element of the ADISA ICT Asset Recovery Standard 8.0."

The key difference. ADISA is the only body of the four that also tests products. Its Product Claims Test starts with "a specific claim being made about the effectiveness of the product to render user data unrecoverable." Then "The laboratory follows the test method to attest whether the claim made is True or Not True." Its Product Assurance test goes further: "Verification of compliance to NIST 800-88 and/or IEEE 2883 Clear and Purge for supported media and interfaces", looking at "the process as well as the outcome." We explain why that difference matters on our IEEE 2883 page.

Facility or software: which certificate covers what

This is where most confusion starts. A certificate for an ITAD and a test of a wiping product are different things, even when the same body issues both.

So a facility can't borrow its wiping tool's test result, and a tool can't borrow its customer's R2v3 certificate.

Which certifications should an ITAD have?

There's no single answer, because the four don't do the same job. Start from who you sell to:

• US recycling and reuse clients. The EPA "encourages all electronics recyclers to become certified" and names two standards: R2 and e-Stewards.
• Clients who care most about data. NAID AAA is built around destruction and unannounced audits. If you hold e-Stewards, you need it anyway.
• On-site hard drive destruction in New Jersey. i-SIGMA states the state requires NAID AAA for it.
• UK clients. ADISA's ICT Asset Recovery Standard 8.0 is an ICO-approved UK GDPR certification scheme.

If you're the buyer, three checks catch most problems:

1. Look the company up yourself. Use the body's own directory, not a logo on a website: i-SIGMA's NAID AAA directory, e-Stewards' recycler finder, ADISA's certified company search.
2. Check the site. A company with several sites may not have certified all of them. Ask which address the certificate covers.
3. Check the scope. For NAID AAA, check the endorsements: mobile or facility, and which media.

Where reCore fits

reCore is wiping and diagnostics software. It holds none of these certifications. The certificate belongs to the facility that does the work.

What software can do is give the facility the records an auditor asks for. Here's what reCore keeps:

• One wipe record per drive, with the drive's serial number, the wipe method, its NIST category and whether verification passed.
• A certificate per wipe record, issued only after an admin approves it.
• Two people, enforced. The approver can't be the technician who ran the wipe. reCore checks this against the technician identity the server recorded at PIN login, not a name typed on the station.
• A tamper check. When the certificate is approved, its data is frozen and a SHA-256 hash of it is stored, so a later edit shows.

More on how that works is on our compliance features page. If you're building your own certificate, our certificate of sanitization template goes through the fields one by one.