NAID AAA and data destruction standards, explained
What the NAID AAA certification standard covers, who administers it, and the honest difference between "certified" and "aligned to specifications."
Quick answer
NAID AAA is the leading third-party certification standard for secure data destruction, administered by i-SIGMA. It defines specifications for how data-bearing media are sanitized or physically destroyed and how the work is documented and verified. Trace's wiping and destruction methods are aligned to NAID AAA / i-SIGMA specifications — Trace is not itself NAID AAA certified.
What NAID AAA / i-SIGMA covers
NAID AAA is the certification program of the International Secure Information Governance & Management Association (i-SIGMA), the trade association for the secure data destruction industry. Vendors that hold the certification are audited — including unannounced audits — against a published set of specifications. Broadly, the standard addresses four areas:
- Personnel — background screening, training, and confidentiality agreements for the people who handle data-bearing media.
- Process — defined, repeatable procedures for sanitizing or physically destroying each media type, plus access controls and facility security while media are in custody.
- Verification — confirming that destruction or sanitization actually completed on each device, not just that a process was started.
- Documentation — records of what was destroyed, when, how, and by whom, retained so clients can answer auditors later.
Because the specifications are concrete and auditable, many organizations use NAID AAA / i-SIGMA as the benchmark when writing their own media-disposal policies — whether or not the vendor they choose holds the certification itself.
What "aligned to specifications" means at Trace
Trace is not NAID AAA certified, and we say so plainly. What we do is run our data destruction to the same specifications the standard defines, and document it the same way an auditor would expect:
| Specification area | How Trace applies it |
|---|---|
| Sanitization | Free verified wipes on every resale-track drive, with per-drive verification that the overwrite completed — not just that it ran. |
| Physical destruction | Flat $10/drive shredding for media you designate for destruction, with serials logged before the drive is destroyed. |
| Documentation | A serialized Certificate of Destruction for every batch, retained with supporting records for 7 years. |
| Custody | A timestamped chain of custody from pickup or mail-in receipt through final disposition, cross-referenced to the certificate. |
The practical outcome for you is the same evidence trail the standard exists to produce: proof of which drives were sanitized or destroyed, by what method, on what date — with documentation you can hand to an auditor years later.
If your policy requires a certified vendor
Some organizations — particularly in regulated industries or under specific contract language — are required to use a vendor that holds primary-level NAID AAA certification, not one aligned to its specifications. If that describes your policy, tell us. We will say so honestly rather than stretch the claim, and we can refer you to a certified provider. For everyone else, the question worth asking any vendor is the one the standard itself asks: can you show me per-device verification and documentation? Trace can.
How Trace handles this
Trace runs wiping and physical destruction to NAID AAA / i-SIGMA specifications: free pickup, free verified wipes funded by resale revenue-share, $10/drive physical destruction, a Certificate of Destruction and chain of custody for every batch, and 7-year record retention. We state the certification distinction up front so you can make an informed call.
Ask us about your destruction requirementsRelated answers
- Data wipe vs. physical destruction — which do you need? — when a verified wipe meets your policy and when shredding is required.
- What is a Certificate of Destruction? — the document that proves destruction happened, and what it must contain.
- ITAD FAQ — detailed questions about pickup, wiping, pricing, and documentation.