we give old computers to e-waste companies, is the disk data wiped, can we verify it

we used to just hand them over directly at first... then we started wiping them with DBAN good

DBAN download → write to USB → boot from computer → wipe disk completely. research can take 6-8 hours.

here's how it went for us. i mean the answer varies greatly by industry; there is no one-size-fits-all rule.

if the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection and of course, it varies if your situation is different.

You're right, I've been down that road too. Taking measures without an inventory leaves doors you haven't seen open.

Just leaving this note, it might be useful.

i think it's hard to be that definitive about disposal of old computers. if you scold false aarms nobody will report again.

if I were you Id go this route.

I'm curious too.

heres how it went for us. mistakes made on the disposal of old computers side are usually reversible but expensive.

if you have questions, write them; I'll answer as best I can.

Let me summarize the topic, since several different answers were given. If it's your first time, start small; scaling comes later.

Absolutely. If I were to add anything: The harder it is to reverse a decision, the slower you should make it.

If I were you, I'd go this route.

I've been down this road let me tell you... tbh hasty decisions become decisions you have to fix six months later.

I'm also curious if anyone does it differently.

If I understood correctly you're saying: If it's your first time start small; scaling comes later.

Let me summarize what's been said so far. The answer varies greatly by industry; there is no one-size-fits-all rule.

An automated scan report is not the same as a penetration test. Just leaving this note, it might be useful.

this thread is archived. processes without records never improve, because you don't know what to fix.

start with a small trial; don't commit to everything at once then that's all sorry if I went on too long.

The opposite happened to me, that's why I'm writing. The real issue isn't the number, but what it's based on.

Don't hesitate to ask; those who don't ask always pay more. Hope this helps.

Thanks for writing this, that's the right way. An untested backup is not a backup.

That's all, sorry if I went on too long.

The discussion got scattered, let me summarize. Having backups accessible on the same network and with the same identity makes them part of the target.

An automated scan report is not the same as a penetration test. This is my opinion, I'm not claiming it's absolute truth.

I went through the same thing. Most time waste accumulates in tasks waiting for approval.

If you post the result here, it will help others too.

Looking at it as a process, the picture changes. An untested backup is not a backup.

Just leaving this note, it might be useful.