The R2v3 Appendix B Data Sanitization Audit Checklist for ITADs

The Sustainable Electronics Recycling International (SERI) R2v3 standard is the global benchmark for responsible electronics recycling, refurbishing, and reuse. Here's how it compares with e-Stewards, NAID AAA and ADISA. Among its specialized Process Requirements, Appendix B (Data Sanitization) establishes stringent mandates for physical security, sanitization methods, independent quality sampling, and downstream chain of custody.

Facilities undergoing an initial R2v3 certification or annual surveillance audit frequently encounter non-conformances due to gaps in software validation records, sampling frequency, or lack of documented separation of duties.

This guide provides an actionable technical checklist for electronics recyclers, refurbishers, and ITAD operations preparing for an R2v3 Appendix B audit.

---

Key Pillars of R2v3 Appendix B Compliance

Under R2v3 Core Requirement 7 and Appendix B, certified facilities must prove compliance across four critical operational domains:

---

1. The Data Sanitization Plan (DSP)

Auditors begin every review by examining your organization’s Data Sanitization Plan (DSP) under Appendix B.(1). Your DSP must explicitly detail:

• Categorization by Media Type: Dedicated procedures for magnetic spinning hard drives (HDDs), NVMe and SATA SSDs, embedded flash (eMMC, UFS), mobile devices, and networking equipment.
• Defined Sanitization Standards: Mapping each equipment category to recognized standards, such as NIST SP 800-88 Rev 2 (Clear or Purge) or IEEE Std 2883-2022.
• Quarantine & Physical Security: Secure, locked staging areas for inbound data-bearing media awaiting sanitization to maintain physical chain of custody.

---

2. Validation of Data Sanitization Software

R2v3 Appendix B requires facilities to validate that their data sanitization processes and software tools effectively sanitize media:

• Effective Coverage: The software must execute recognized sanitization commands (e.g., NVMe Sanitize, ATA Secure Erase, or certified logical overwrites) addressing user-addressable space and firmware-accessible areas.
• Automated Identification: Device serial numbers, drive models, and capacities must be captured directly from drive firmware rather than manual human entry to prevent transcription errors.
• Failure Handling: A device that fails sanitization should be held, recorded as failed, and routed to a different sanitization method or to physical destruction, with both events kept in its record.

---

3. Independent Quality Sampling (The 5% Rule)

Under R2v3 Appendix B(13), facilities must implement an ongoing quality control process to independently verify sanitization effectiveness:

• Mandatory 5% Sampling Baseline: At least 5% of logically sanitized media must be sampled, using commercial data-recovery software, to demonstrate data is not recoverable. SERI notes this is more than checking the sanitization software's own reports.
• Separation of Duties: The QA inspection must be performed by someone other than the technician who executed the wipe.
• Sample Rate Reduction (to 1%): The sampling frequency may be reduced to 1% of sanitized devices after continued sampling finds no issues with the process (SERI's guidance).
• Defect Escalation: If any sampled device shows residual data, SERI says previously processed devices must be further assessed, the facility must run its nonconformity process with a root cause analysis, and sampling must be increased until corrective actions are proven.

R2v3 Appendix B Quality Sampling Flow:
[Sanitization Station] -> 100% Wiped -> [Independent QA Tech] -> Samples >= 5% of Devices
                                                                  |
                                       +--------------------------+--------------------------+
                                       | Passed                                              | Failed (1 Defect)
                                       v                                                     v
                         [Approved for Inventory / Resale]                  [Prior devices reassessed + root cause]

---

4. Keeping the Records

What counts as a record matters as much as how long you keep it. SERI's formal interpretation says spreadsheets are not acceptable records of software sanitization; our guide to R2v3 sanitization records covers what auditors check and where spreadsheets break.

How long to keep them: we couldn't confirm one fixed period in SERI's published material. Set a retention period for each record type in your records procedure, long enough to cover your audit cycle, your client contracts and the law where you operate. A record an auditor can rely on includes:

1. Unique Asset & Drive Identification: Parent asset barcode/ID, drive serial number, make, model, and capacity.
2. Method & Standard Executed: Clear designation of the sanitization method (e.g., NIST SP 800-88 Rev 2 Purge or IEEE Std 2883-2022).
3. Execution & QA Verification Details: Technician ID, station ID, timestamp, and independent QA verification status.
4. Tamper-Evident Integrity: Storing records in formats with cryptographic checksums (e.g., SHA-256) to ensure records cannot be modified after issuance.

---

Preparing for Your Next Surveillance Audit

1. Audit Your Separation of Duties: Ensure your software workflow records separate user IDs for the wipe technician and the QA verifier.
2. Review Batch QA Sampling Logs: Confirm that every closed batch maintains at least a 5% independent verification record.
3. Verify Physical Quarantine Logs: Ensure physical scrap/destruction bins have matching disposal certificates tied to failed drive serial numbers.