Chain of Custody for Sensitive Equipment: A Guide

Equipment being handed from one person to another and signed for

A chain of custody for sensitive equipment is an unbroken, dated record of who held a device holding regulated data, from receipt through issue, transfer, return, sanitisation and disposal. HIPAA, GDPR, PCI DSS and NIST SP 800-88 all expect parts of it. Most chains break at transfers, returns and disposal hand-offs.

Most organisations can tell you who has a laptop today. Far fewer can tell you who had it in March, how it got from one person to the next, whether it was wiped before it was reissued, and what happened to its drive when it was finally retired.

For most equipment that gap is an inconvenience. For a laptop holding patient records, a drive with cardholder data or a phone full of customer details, it's the difference between a contained incident and a reportable breach you can't explain. A chain of custody closes the gap.

What is a chain of custody?

The term comes from evidence handling. NIST defines it as a process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle, by documenting each person who handled it, the date and time it was collected or transferred, and the purpose of each transfer.

Applied to equipment, the idea is the same: for any device that holds sensitive data or is high-value or regulated, you can show an unbroken sequence of who held it, from when to when, and why it moved. Our knowledge base explainer on chain of custody covers the general concept; this guide is about devices that carry regulated data.

Why it matters: what the rules actually say

HIPAA: device and media controls (US)

The HIPAA Security Rule's device and media controls standard, 45 CFR 164.310(d)(1), requires covered entities to implement policies and procedures governing the receipt and removal of hardware and electronic media containing electronic protected health information into and out of a facility, and their movement within it. Its implementation specifications include disposal and media re-use (both required), and accountability (addressable): to maintain a record of the movements of hardware and electronic media and any person responsible for them. That last line is, in effect, a chain of custody requirement.

It isn't theoretical. In 2020 the HHS Office for Civil Rights imposed a $1,040,000 penalty on Lifespan after an unencrypted laptop holding data on 20,431 patients was stolen in 2017. Among OCR's findings, as reported by HIPAA Journal, Lifespan had no policies requiring the tracking of portable devices with access to its network, and no comprehensive inventory of them.

GDPR: accountability and security (EU and UK)

GDPR Article 5(1)(f) requires personal data to be protected against accidental loss, destruction or damage, and Article 5(2) makes the controller responsible for, and able to demonstrate, compliance (the accountability principle). Article 32 requires security appropriate to the risk, including encryption where appropriate. If a device is lost and the breach is likely to risk people's rights, Article 33 requires notifying the supervisory authority within 72 hours where feasible. The UK's ICO lists lost or stolen computing devices containing personal data as an example of a breach.

The word that matters is 'demonstrate'. A custody record is how you demonstrate that a device was where you say it was, and that it was wiped before it left your control.

PCI DSS v4.0: requirement 9.4 media handling

PCI DSS requirement 9.4 says media with cardholder data is securely stored, accessed, distributed, and destroyed. Its sub-requirements, as numbered in v4.0, read almost like a custody specification: media sent outside the facility is logged and sent by a secured courier or other delivery method that can be accurately tracked (9.4.3); management approves media moved outside the facility, including to individuals (9.4.4); inventory logs of electronic media are maintained (9.4.5) and inventories are conducted at least once every 12 months (9.4.5.1); and electronic media is destroyed or the data rendered unrecoverable when no longer needed (9.4.7).

ISO/IEC 27001:2022 Annex A

ISO 27001 is paywalled, but its Annex A control titles are widely published. Several map directly onto equipment custody: 5.9 Inventory of information and other associated assets, 5.11 Return of assets, 7.9 Security of assets off-premises, 7.10 Storage media and 7.14 Secure disposal or re-use of equipment. An auditor assessing those controls will ask for exactly the records described below.

NIST SP 800-88: sanitisation evidence

NIST SP 800-88 Revision 2, published in September 2025 and superseding the 2014 Revision 1, is the reference most organisations use for media sanitisation. It defines three methods (clear, purge and destroy) and recommends completing a certificate of sanitisation for each item, recording the manufacturer, model, serial number, any organisationally assigned property number, method, technique, tool and version, verification method, and the name, date, location and signature of the person who verified it. It also notes that the record can be electronic, captured by scanning a barcode on the item.

The cost of not knowing

IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million. That's every kind of breach, not lost devices specifically. For devices, the most detailed study is old: Ponemon Institute's The Cost of a Lost Laptop, published in 2009, found an average cost of $49,246 per lost laptop across 138 cases, 80% of it from data breach costs. Laptops discovered missing the same day averaged $8,950; those noticed after more than a week averaged about $115,849. Treat the 2009 numbers as directional only, but the lesson stands: knowing quickly matters.

What a chain of custody record contains

Every entry in the chain should answer the same questions. If a field can't be filled, that's a break.

Unique identity. Asset tag plus manufacturer serial number. The tag ties the physical item to your record; the serial ties it to the manufacturer and to sanitisation certificates.
Data classification. Whether it holds regulated data, and what kind (health, cardholder, personal, confidential).
Event type. Receive, issue, transfer, return, quarantine, sanitise, dispose.
Who released it and who received it. Named people, not 'IT' or 'the team'.
When. Date and time of each hand-off.
Where. Site, room or address, including home addresses for remote staff.
Why. The purpose of the movement: new starter, repair, leaver return, end of life.
Condition and integrity. Physical condition, and for sensitive kit whether seals or encryption status were checked.
Evidence. Signature, acknowledgement, courier tracking number, photo or certificate as appropriate.

Custody events and the evidence each needs

Event	What happens	Evidence to keep	Typical break
Receive	Device arrives from supplier or another site	Delivery note, serial number checked against order, receiving person, date	Boxes signed for by reception and left unrecorded
Tag	Asset tag applied, record created	Tag number linked to serial, classification, location	Device used before it's tagged, so its first weeks are invisible
Issue	Handed to a named person	Recipient's signature or acknowledgement, date, condition, terms accepted	Issued verbally or by a manager on someone's behalf
Transfer	Moves directly between people or sites	Both parties named, date, reason; courier tracking if shipped; approval if leaving the facility	Colleagues swap devices informally; the record still shows the first holder
Return	Comes back from the holder	Returning person, receiving person, date, condition, accessories checked	Box left on a desk; nobody checks it in
Quarantine	Held pending wipe, repair, investigation or legal hold	Secure location, who has access, reason, date in	Returned devices pile up in an unlocked cupboard
Sanitise	Data removed by clear, purge or destroy	Certificate: serial, method, tool and version, verification, operator, date	Wiped 'at some point' with no record of method or person
Dispose	Leaves the organisation: recycling, resale, destruction	Sanitisation certificate, disposal partner's certificate, serial numbers matched, collection date	Bulk collection with a count, not a serial list

Where chains usually break

Informal transfers

Two colleagues swap laptops, or a manager hands a leaver's phone to a new starter. Nothing is wrong with the transfer, but the record now names the wrong person. Six months later, when the device is lost, the record points at someone who hasn't held it for half a year. The fix is simple, and mostly cultural. Any change of holder goes back through the record, even if the device never visits IT.

Returns that aren't checked in

A device comes back and is put down somewhere. The custody record still shows the old holder, and the device isn't in anyone's care. A returned laptop with data on it is never more exposed than in that state, physically present and administratively missing.

The quarantine cupboard

Devices awaiting wipe or repair tend to collect in one place with loose access. That place should be locked, its contents should be in the record with a status, and someone should own clearing it.

Sanitisation with no evidence

Most organisations do wipe devices. Far fewer can prove which device was wiped, how, and by whom. Without a per-serial certificate, a regulator or auditor has to take your word for it.

Disposal by count

A recycling partner collects 'forty laptops'. Which forty? If the collection note doesn't list serial numbers, you can't match it to your sanitisation records, and you can't prove a specific device was destroyed.

Remote staff

Devices shipped to and from home addresses add two courier legs to every chain. PCI DSS's expectation of tracked delivery for media leaving the facility is a sensible default for any regulated device. Our guide to getting equipment back from remote employees covers the return leg in detail.

Making the chain cheap to maintain

Chains almost never break through ignorance. Everyone knows a transfer should be recorded. It breaks because recording it costs more effort than doing it, so people skip it when they're busy. The design goal is to make the record a by-product of the hand-off rather than a separate task.

Scan, don't type. A QR or barcode label on every sensitive device turns a custody event into a scan plus a name.
Capture acknowledgement at the hand-off. A signature on a phone or tablet at issue and return takes seconds and settles later disputes. Our employee equipment agreement guide covers what the holder should be acknowledging.
Use statuses, not spreadsheets on the side. Quarantined, in repair, lost, stolen and retired belong on the record itself, so a quarantined device can't be issued by mistake.
Keep history, never overwrite. A reissued device should keep its full history. Creating a new record on reissue throws away the chain.
Count regularly. Scoped cycle counts of sensitive devices catch breaks while people still remember what happened. PCI DSS expects media inventories at least every 12 months; I'd count regulated laptops more often than that.
Attach the certificates. Store sanitisation and disposal certificates against the device record so they're found by serial number, not by searching email.

Stackroom assignments list showing every checked-out asset with its named holder and checkout date

*Each device against a named holder, with the date custody began.*

This is the problem Stackroom is built for. Each device is checked out to a named person with a handover signature and returned with a return signature and condition; custody history is kept per asset and per person; statuses cover maintenance, lost, stolen and retired; scans record a geo position where available; and the activity log attributes each change to the person who made it. Certificates can be attached as files to the asset. It doesn't wipe devices or replace your MDM. It's the record that ties those actions to a serial number and a person. More on custody and accountability.

A short checklist

Identify which devices hold regulated or sensitive data, and mark that on each record.
Tag every one with a scannable label linked to its serial number.
Require a named recipient and acknowledgement at every issue, transfer and return.
Ship sensitive devices only with tracked delivery, and record the tracking number.
Keep returned and quarantined devices in a controlled location with a status on the record.
Sanitise to a defined method and keep a per-serial certificate.
Dispose only against a serial-numbered list, and file the partner's certificate.
Run scoped counts of sensitive devices and investigate every missing item.

Sources

Key takeaways

A chain of custody is an unbroken, dated record of who held a sensitive device, when, where and why it moved.
HIPAA's accountability specification, GDPR's accountability principle and PCI DSS requirement 9.4 all expect parts of it.
NIST SP 800-88 Rev. 2 recommends a per-item certificate of sanitisation recording serial, method, tool and verifier.
Chains usually break at informal transfers, unchecked returns, quarantine, unrecorded wipes and disposal by count.
Make the record a by-product of the hand-off: scan, capture acknowledgement, and never overwrite history.

Frequently asked questions

What is chain of custody for IT equipment?

It's a continuous, dated record of every person who held a device, when they received and released it, where it was and why it moved, from receipt through issue, transfer, return, sanitisation and disposal. For devices holding regulated data, it's how you show that the device and its data stayed under control throughout its life.

Does HIPAA require chain of custody for laptops?

HIPAA's device and media controls standard, 45 CFR 164.310(d)(1), requires policies for moving hardware and media containing ePHI into, out of and within a facility. Its accountability specification, which is addressable, is to maintain a record of those movements and the person responsible. Disposal and media re-use procedures are required specifications.

What does PCI DSS requirement 9.4 cover?

Requirement 9.4 says media with cardholder data is securely stored, accessed, distributed and destroyed. In v4.0 its sub-requirements include logging media sent outside the facility and using tracked delivery, management approval for moving media offsite, inventory logs with inventories at least every 12 months, and destroying electronic media or rendering data unrecoverable.

What should a certificate of sanitisation include?

NIST SP 800-88 Rev. 2 suggests recording the manufacturer, model, serial number, any property number, media type and source, the sanitisation method and technique, the tool and version, the verification method, and the name, title, date, location, contact details and signature of the person who verified it. It can be a paper or electronic record.

Is a lost company laptop a GDPR breach?

It can be. The UK ICO lists lost or stolen devices containing personal data as an example of a personal data breach. Under GDPR Article 33, if the breach is likely to risk people's rights, you must notify the supervisory authority within 72 hours where feasible. Encryption reduces the risk, and you should document your assessment either way.

Where do chains of custody usually break?

At informal transfers between colleagues, returns that are never checked in, unsecured quarantine areas for devices awaiting wipe, sanitisation done without a per-device record, and disposal collections recorded by count rather than serial number. Remote staff add courier legs that need tracking numbers on the record.

More from the blog

Equipment Checkout Systems for Universities and Colleges The IT Asset Lifecycle: Stages, Costs and Secure Disposal Preventive Maintenance Intervals by Equipment Type (2026 Guide)Warranty vs Service Contract vs Extended Warranty: What's Covered