ITAM, ITAD and data wipe are often used interchangeably in procurement conversations. They are three different controls, and skipping one leaves a gap.
Short version: ITAM knows what you have, ITAD retires it responsibly, and data wipe makes retirement safe. You need all three in that order.
For the erasure product, see CoreInspect Wipe. For verification at scale, see AI-assisted data erasure.
The three in one table
| Practice | Question it answers | Owns | Typical output |
|---|---|---|---|
| ITAM | What do we own, where is it, who has it? | Asset register | Inventory, ownership, warranty |
| ITAD | How do we retire it responsibly? | Disposal process | Resale, recycling, certificates |
| Data wipe | Is the data gone before it leaves? | Sanitisation | Erasure certificate |
ITAM is ongoing. ITAD is a project or a contract. Data wipe is a step inside ITAD.
ITAM: the asset register
IT Asset Management covers the life of every device: purchase, assignment, changes, repairs and retirement.
A workable ITAM record has:
- Asset tag and serial number.
- Model and configuration.
- Purchase date, warranty and vendor.
- Assigned user and location.
- Repair and change history.
- Retirement status.
The hard part is not the software. It is keeping the record true when laptops move between people. Barcode or RFID scanning at handover helps more than a spreadsheet ever will.
ITAD: the retirement process
IT Asset Disposition covers what happens when a device leaves service: collection, data sanitisation, testing, refurbishment, resale or recycling.
A credible ITAD process includes:
- Chain of custody from pickup to final destination.
- Data sanitisation before any resale or recycling.
- Functional testing and grading.
- Environmental compliance for e-waste.
- Certificates for erasure and disposal.
- A report on recovered value.
ITAD is where most data leaks happen, because disposal is treated as logistics rather than a security event.
Data wipe: the control inside ITAD
Data wipe is the step that removes data from storage before the device is reused, resold or recycled.
It is not the same as a factory reset. A reset removes the file index; it does not guarantee that the underlying data is unrecoverable. For devices leaving your control, use a recognised sanitisation method and verify the result.
For devices that will be reused internally, a verified wipe is usually enough. For devices leaving the organisation, treat the certificate as part of the audit trail.
Where the three connect
Procure -> Deploy -> Track (ITAM)
|
v
Retire -> Wipe -> Verify -> Remarket or Recycle (ITAD)If ITAM is weak, you do not know what left. If ITAD is weak, devices leave without control. If wipe is weak, the data leaves with them.
Common mistakes
- Wiping only the primary drive. Embedded and secondary storage is missed.
- Accepting a factory reset as erasure. It is not.
- No chain of custody. You cannot prove who handled the device.
- ITAM and ITAD in different spreadsheets. The asset disappears between them.
- Certificates without verification. A PDF is not evidence.
- No sampling. Without an audit sample, the process drifts unnoticed.
The small-business version
You do not need an enterprise platform to do this well.
- Keep one asset register, even if it is a shared sheet with serial numbers.
- Define a retirement checklist: collect, wipe, verify, record, dispose.
- Use a verified erasure tool and keep the certificate with the asset record.
- Sample a few certificates each quarter.
- Store the records for the period your contracts require.
That is enough to answer a client audit or a DPDP question without rebuilding your process.
FAQ
Is ITAD the same as data wipe?
No. ITAD is the disposal process. Data wipe is one step inside it.
Can ITAM track retired devices?
It should. Retirement status is part of the asset record, including the erasure certificate and final destination.
Is a factory reset enough before resale?
No. Use a recognised sanitisation method and verify the result before the device leaves your control.
Do small businesses need ITAD?
If they resell, donate or recycle devices that held customer or employee data, yes, even if it is a simple documented process.
Next step
If you need certified erasure or a retirement workflow, contact 24Bit System. CoreInspect Wipe handles computer and mobile erasure, and our managed IT team can run the asset register.
