What evidence should be attached?

Attach migration logs, sanitization reports or vendor destruction certificates, and verification hashes. These items prove steps were completed and are essential for audits and breach investigations.

Can the form be signed electronically?

Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and retention are captured to meet legal validity tests.

Is notarization required?

Not typically required for internal decommissions. Use notarization or RON if contracts or certificates require notarized acknowledgements; state rules vary for witness or notary needs.

How long must evidence be retained?

Retention depends on context: IRS records 3 years (IRC §6501(a)), HIPAA 6 years (45 CFR §164.530(j)). Follow industry-specific schedules and state variations.

What sanitization methods are acceptable?

Acceptable methods include certified crypto-erase, DoD-style overwrites, degaussing, or physical destruction. Choose method aligned to data classification and vendor proof requirements.

Who should approve final disposition?

At minimum, the asset owner (IT Manager) and an Information Security Officer should sign off; records or legal should confirm retention obligations before disposal.

Electronic Signature
Templates
Miscellaneous
IT Server Decommissioning Form

IT Server Decommissioning Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

IT SERVER DECOMMISSIONING AGREEMENT

RECITALS

WHEREAS, Client Name: (the "Client") owns or controls the server(s) listed below; and

WHEREAS, Service Provider: (the "Provider") performs IT asset lifecycle services, including secure decommissioning and disposition; and

WHEREAS, the parties wish to document the scope, responsibilities, data sanitization, chain of custody, payment, and legal terms applicable to the decommissioning of the identified server equipment effective as of Effective Date: .

SCOPE OF WORK

The Provider will perform secure decommissioning services for the server(s) identified below. Services include verification of backups, secure data sanitization, hardware removal, inventory reconciliation, generation of a sanitization certificate, and final disposition in accordance with Client instructions and applicable law.

Detailed scope and special instructions

DECOMMISSIONING DETAILS (SERVER RECORD)

Server Hostname: Asset Tag: Serial Number:

Model: Operating System: IP Address:

Virtualization Host (if applicable):

Backup verification

Backups verified and accessible Backup Location:

Decommission date Reason for decommission

DATA SANITIZATION & MEDIA DISPOSITION

The Provider warrants that data-bearing media will be sanitized or destroyed using methods selected below. Provider shall produce a written Certificate of Sanitization listing methods used, items sanitized, and personnel performing the work.

Sanitization method(s) applied (select all that apply)

Crypto-erase / cryptographic wipe Overwrite (number of passes: )

DoD-standard overwrite Physical destruction (shredding/crushing) Other:

Certificate of Sanitization Media disposition instructions

CHAIN OF CUSTODY

Provider shall maintain a chain of custody for all media from removal to final disposition. The following entries shall be recorded at transfer points and attached to the Certificate of Sanitization.

Chain of custody log (summary)

PAYMENT TERMS

The Client shall pay the Provider the fees described below in consideration for the services rendered under this Agreement. Fees cover labor, tooling, reporting, certificate issuance, and authorized disposal unless otherwise stated in writing.

Total fee for decommissioning services Payment schedule Late payment

Amounts not paid when due shall accrue interest at a rate of or the maximum rate permitted by law, and Client shall be responsible for reasonable collection costs and attorneys' fees.

TERM AND TERMINATION

This Agreement commences on Start Date: and shall continue until completion of the services or End Date: , unless earlier terminated in accordance with this section.

Either party may terminate for convenience upon Notice Period: days' written notice. Either party may terminate for material breach if the breach is not cured within 15 days after written notice specifying the breach. Termination does not relieve the Client of liability for services performed and costs incurred prior to termination.

CONFIDENTIALITY

Each party shall maintain the confidentiality of the other party's Confidential Information and shall not disclose it except as required by law or as necessary to perform the services. Confidential Information includes system configurations, access credentials, data inventories, and any non-public information related to the Client's systems. Provider shall implement reasonable administrative, physical, and technical safeguards to protect Confidential Information.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to principles of conflicts of law.

ENTIRE AGREEMENT

This Agreement, including any attachments and the Certificate of Sanitization referenced herein, constitutes the entire agreement between the parties and supersedes all prior negotiations, understandings, and agreements relating to the subject matter. Any amendment must be in writing and signed by duly authorized representatives of both parties.

ACKNOWLEDGEMENTS AND REPRESENTATIONS

The Client represents that it has the authority to direct decommissioning of the identified equipment and to authorize data sanitization and disposal. The Provider represents that it will perform sanitization in accordance with the selected methods and will provide an accurate Certificate of Sanitization upon completion.

Additional notes or required attachments

Client:

By:

Date:

Service Provider:

By:

Date:

What the IT Server Decommissioning Form Is and when it’s used

The IT Server Decommissioning Form documents the planned removal, data sanitization, and disposal or repurposing of a physical or virtual server. It records asset identifiers, owners, data classification, migration status, sanitization method, verification steps, and final disposition so IT, security, and records teams share a single authoritative record. Organizations use it to meet internal change-control policies, vendor handoff requirements, audit trails for compliance (HIPAA, PCI, SOX), and to prove that sensitive data was erased or retained according to regulatory or contractual obligations.

Why completing a formal decommissioning form matters

A completed IT Server Decommissioning Form creates documented evidence of decisions, data destruction, and custody transfer; it reduces legal and operational risk and supports audits. Use the form to satisfy ESIGN (15 U.S.C. ch. 96) and UETA-consistent electronic recordkeeping where applicable, and to show chain-of-custody for regulated data.

Which teams typically complete and review the form

Start with the team that initiates the decommission (asset owner or IT ops) and route for required approvals.

IT Operations: prepares server, documents migration status, and schedules sanitization for compliance.
Information Security: approves data sanitization method, verifies secure erasure or destruction evidence.
Records / Legal: confirms retention obligations and approves final disposition or evidence retention.

Final distributions commonly include security, records retention, facilities, and the external disposal vendor for accountability.

Who can sign and approve

IT Manager

The IT Manager or asset owner signs to confirm migration completion and release of the device from active service; they attest to inventory accuracy and operational readiness for decommissioning.

Security Officer

An Information Security Officer or delegated data custodian signs to confirm approved sanitization/destruction methods and verification steps were completed per policy and regulatory requirements.

Step-by-step: completing the form from start to finish

Follow these sequential steps to prepare, document, and finalize a compliant decommissioning record.

01

Identify Asset: Record asset tag, serial, hostname, and owner before any changes.
02

Confirm Migration: Verify data and services moved; log migration date and destination.
03

Sanitize or Destroy: Apply approved sanitization method and document tool and parameters.
04

Verify and Sign: Capture verification evidence, approvals, and final disposition details.

Where the completed form travels in your process

Document routing ensures appropriate approvals and that evidence is stored where auditors can retrieve it.

Origin: Generated by IT Ops or Asset Owner with initial asset data.
Security Review: Sent to InfoSec to approve sanitization and verify data classification.
Records Retention: Forward final form and evidence to records or legal for retention.
Disposal Vendor: Provide approved vendor with disposition instructions and certificate requirements.

Typical online workflow settings for digital completion

Configure the digital workflow to enforce required fields, route approvals, and capture verification evidence automatically.

Field	Configuration
Required Fields	Asset ID, owner, data classification, sanitization method
Approval Order	IT Owner -> InfoSec -> Records
Authentication	Email + SMS code or SSO for approvers
Evidence Attachments	Allow PDF/log upload and timestamped hashes

Technical channels for signing, storage, and integrations

Use eSignature platforms that support secure attachments, audit trails, and enterprise integrations for records retention.

eSignature: Capture intent, timestamp, and audit trail
Integrations: Connect to Google Workspace, Microsoft 365, or NetSuite
File formats: Save signed PDFs and CSV audit exports

Essential sections every professional decommissioning form should include

A comprehensive form groups asset data, migration evidence, sanitization details, verification, approvals, and final disposition to meet audit and legal standards.

Asset Details

Unique identifiers, hardware/VM specifics, physical location, and owning department to ensure precise targeting.

Data Inventory

Summary of stored data types, PII or PHI indicators, and any regulatory constraints that affect sanitization.

Migration Evidence

Records confirming data/services moved, including dates, destination systems, and responsible engineers.

Sanitization Plan

Selected method, tool/version, overwrite passes, or destruction approach tied to data classification.

Verification Record

Verification logs, cryptographic hash outputs, or vendor certificates proving erasure or destruction.

Final Approval

Signatures, dates, and disposition code (repurpose, recycle, destroy) to close the asset lifecycle.

Supporting documents commonly attached to the form

Attach standard supporting artifacts to create an auditable package for compliance reviewers and disposal vendors.

Migration Logs

Exported tickets, database transfer logs, or replication reports that confirm data moved successfully to the destination environment.

Sanitization Reports

Tool-generated overwrite verification, cryptographic erasure confirmation, or vendor certificates demonstrating accepted sanitization standards were applied.

Disposal Certificate

Third-party vendor certificate for physical destruction or a signed chain-of-custody document when assets leave site.

Approval Audit

Signed approval pages, email consent records, or eSign audit trail exports included for recordkeeping.

Timelines and expected processing milestones

Track deadlines for migration, sanitization, verification, and evidence retention to avoid compliance gaps and operational disruption.

Migration Completion Date:

Target date when all services and data are confirmed moved.

Sanitization Window:

Planned date/time range when erasure or destruction occurs.

Verification Deadline:

Date by which evidence must be uploaded and verified.

Approval Turnaround:

Expected review and signoff timeframe, typically 2–5 business days.

Records Handoff:

Date when final package is forwarded to records retention team.

Common mistakes to avoid when preparing the form

Failing to record precise asset identifiers leads to orphaned devices and audit mismatches requiring time-consuming reconciliation.
Using vague sanitization terms (e.g., 'wiped') without specifying method or tool prevents validation against regulatory standards.
Not attaching verification logs or certificates makes it difficult to prove data destruction during audits or litigation.
Skipping approvals or routing the document incorrectly can defeat internal controls and expose data to unauthorized access.

Risks and potential penalties for deficient documentation

Data Breach Liability: Civil fines and remediation costs

HIPAA Violation: Civil monetary penalties, enforcement action

Contract Breach: Indemnity claims or vendor penalties

Regulatory Audit: Expanded review and corrective action

Operational Delay: Service outages and recovery expense

Reputational Harm: Customer loss and business impact

Comparing eSignature options for decommissioning documentation

Basic pricing and feature differences for common eSignature vendors. Use the row values to match plan needs for volume, HIPAA, and bulk workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Real-world examples of how teams use the form

Two practical scenarios show how the form supports compliance, asset control, and evidence collection.

Hospital IT Decommission

A hospital migrates an EMR test server to a secure cluster

sanitization uses certified crypto-erase
InfoSec attaches hashes, signs the form, and Records retains the package for six years to meet HIPAA (45 CFR §164.530(j)).

Cloud Migration Project

A SaaS company retires on-prem VMs after lift-and-shift

team documents migration tickets and snapshot deletion
Legal and Security review the verification logs and preserve disposition evidence for audits and IP protection.

Practical tips for fast, accurate completion

Adopt these practices to reduce errors and enforce controls across high-volume decommission workflows.

Standardize Templates

Use a single approved form version to ensure consistent fields and reduce missing information.

Enforce Required Fields

Make asset ID, data classification, and verification attachments mandatory to pass automated gate checks.

Preserve Audit Trails

Capture signer identity, timestamps, IP, and attachment hashes to support non-repudiation and audits.

Record Retention Policy

Define retention and disposal schedules aligned with HIPAA, IRS, or agency rules as applicable.

Frequently asked questions about the IT Server Decommissioning Form

Answers to common completion and compliance questions encountered during decommissioning.

Need help? Contact support

What evidence should be attached?
Attach migration logs, sanitization reports or vendor destruction certificates, and verification hashes. These items prove steps were completed and are essential for audits and breach investigations.
Can the form be signed electronically?
Yes. Electronic signatures are valid under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure intent, consent, attribution, and retention are captured to meet legal validity tests.
Is notarization required?
Not typically required for internal decommissions. Use notarization or RON if contracts or certificates require notarized acknowledgements; state rules vary for witness or notary needs.
How long must evidence be retained?
Retention depends on context: IRS records 3 years (IRC §6501(a)), HIPAA 6 years (45 CFR §164.530(j)). Follow industry-specific schedules and state variations.
What sanitization methods are acceptable?
Acceptable methods include certified crypto-erase, DoD-style overwrites, degaussing, or physical destruction. Choose method aligned to data classification and vendor proof requirements.
Who should approve final disposition?
At minimum, the asset owner (IT Manager) and an Information Security Officer should sign off; records or legal should confirm retention obligations before disposal.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now