Coretek 360

Twenty-Five Years in ITAD: Why Coretek Became Coretek 360

Coretek was founded in 2001, R2 certified in 2013 and renamed Coretek 360 in 2026. What changed in IT asset disposition in 25 years, and why the name changed.

The Coretek 360 logo

By Coretek 360

Company page

BlogPublished 15 min read

The Coretek 360 wordmark in brushed silver with a teal glow on a black background

Written by the team at Coretek 360. The company facts in this article are our own; the industry facts are cited to their sources. About the company.

Coretek was founded in 2001 to take retired computers off organizations' hands. In 2026 the company became Coretek 360. The legal entity, Coretek Enterprises LLC, the certificate and the team did not change. The name did, because the job had.

When the company started, there was no Responsible Recycling (R2) standard, no NIST guideline for wiping a drive, and no HIPAA Security Rule in force. Retiring hardware was a hauling problem. Over the next quarter century it became a records discipline, a data security event, a regulated transaction and, handled well, a source of money back to the budget. This article walks through what changed, what the company learned processing more than 5 million assets for more than 2,000 organizations across the US and in 14+ countries, and what the "360" means. For the service itself, start at IT asset disposition.

Key Takeaways

  • The rules that define ITAD today all arrived after Coretek did: the HIPAA Security Rule's compliance date arrived in 2005, NIST SP 800-88 was published in 2006 and the R2 practices in 2008. Coretek earned R2 certification on December 13, 2013 and has held it through the move to R2v3.
  • The media changed under the standard. NIST called the shift to solid state drives "revolutionary" for sanitization in 2014, and its 2025 revision describes multi-pass overwriting as a legacy practice that gives SSDs "very little confidentiality protection."
  • Regulators now treat a bad decommissioning as a compliance failure in its own right: a $60 million OCC penalty in 2020 and a $35 million SEC order in 2022 arose from the same retired hardware.
  • Global e-waste nearly doubled from 2010 to 2022, to 62 million tonnes, with 22.3 percent documented as recycled. Hardware retired whole, wiped and resold is the part of that stream that still holds value.
  • "360" names the full circle one engagement now covers: pickup, data destruction, refurbishment, resale, recycling and the report that ties them together.

In this article:

What retiring hardware meant in 2001

In 2001, the proof that a computer had been retired responsibly was a receipt from whoever took it away. The three documents that define the job today did not exist yet. The HIPAA Security Rule requires policies for "the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored" (45 CFR 164.310). Its compliance date for most covered entities was April 20, 2005 (45 CFR 164.318). NIST published Special Publication 800-88, Guidelines for Media Sanitization, in September 2006 (NIST). The EPA released the Responsible Recycling (R2) practices on October 31, 2008. They came from a working group of "federal and state governments, electronics manufacturers and recyclers, and trade associations" (EPA, 2008).

The volumes were smaller too. The United Nations' first global e-waste series puts 2010, the earliest year it measured, at 33.8 million tonnes (United Nations University, 2015). The habit the company runs on today, writing down the serial number before anything moves, is the one every later rule would formalize.

DateWhat changedWhere it came from
2001Coretek foundedCompany record
April 20, 2005HIPAA Security Rule compliance date for most covered entities45 CFR 164.318
September 2006NIST SP 800-88 publishedNIST CSRC
October 31, 2008EPA releases the R2 practicesEPA
2013R2:2013 published; Coretek R2 certified December 13E-Scrap News; company record
December 2014NIST SP 800-88 Rev. 1: single pass for magnetic media, SSDs change the normNIST CSRC
September 2016FFIEC booklet: "Management should log the disposal of sensitive media"FFIEC
July 1, 2020R2v3 releasedSERI Advisory 22
October 8, 2020OCC assesses a $60 million penalty over a 2016 decommissioningOCC
September 20, 2022SEC orders $35 million over device disposal failuresSEC
June 30, 2023R2:2013 and all its certificates expireSERI Advisory 22
September 2025NIST SP 800-88 Rev. 2 supersedes Rev. 1NIST CSRC
2026Coretek becomes Coretek 360Company record

Lesson one: the standard became the floor

Certification went from a differentiator to the minimum a buyer should check. When R2 began, it was a voluntary set of practices. By the time Coretek certified in December 2013, R2:2013 had been published that summer with an 18-month transition, overseen by the nonprofit Sustainable Electronics Recycling International (SERI). Growth after that was steep. E-Scrap News counted 27 R2 certified facilities in two countries around 2010 and "719 facilities in 31 countries" by November 2017 (E-Scrap News, 2017).

The move to R2v3 was a filter, not a renewal. SERI released R2v3 on July 1, 2020, required every new certification audit from January 1, 2021 to be against R2v3, and set a hard stop: "June 30, 2023 | R2:2013 Standard and all certificates expire." A facility that wanted to keep its certificate had to pass a Transition Audit, which SERI defines as "a full system audit to R2v3 requirements" (SERI, 2023). Eight days before the deadline, 927 facilities had made it, 647 of them from R2:2013, and an estimated 82 were still on the old standard (E-Scrap News, 2023). Coretek's certificate came through that audit and is listed in SERI's public directory today, alongside the company's RIOS certification; both are on the R2v3 certification page with links to the registries.

The EPA's reasoning for certification is the buyer's reasoning. Certification programs "Offer a way to assess the environmental, worker health, and security practices of entities managing used electronics." They "require destruction of all data on used electronics," and there is "continual oversight by the independent accredited certifying body" after the certificate is issued (EPA, 2026). The lesson the company drew is that a certificate is a scope, not a badge. Shredding is performed in house by Coretek 360 and is not yet covered by our R2v3 certificate, which covers data sanitization, test and repair, and the downstream recycling chain. We are actively working to add it. A buyer who checks the scope line in the directory knows exactly what the audit covered.

Lesson two: the drive changed under the standard

The second lesson is that a sanitization method belongs to a media type, and the media type did not hold still. NIST's 2006 guideline was written for a magnetic world. Its December 2014 revision said plainly that "a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied." The same document called the arrival of solid state drives "revolutionary (as opposed to evolutionary)" from a sanitization perspective, because "Degaussing, a fundamental way to sanitize magnetic media, no longer applies in most cases for flash memory-based devices" (NIST, 2014).

The September 2025 revision finished the thought. Rev. 2 describes the old practice of "multiple overwrite passes (e.g., based on DoD 5220.22-M)" as history. It warns that "For certain ISM (e.g., SSDs with overprovisioning), such practices should be avoided as very little confidentiality protection is achieved," and it sets out cryptographic erase as a purge technique for drives with built-in encryption (NIST, 2025). Two authorities did not move at the same speed. The FFIEC's 2016 examination booklet still told banks that "To be effective, overwriting may have to be performed many times" (FFIEC, 2016), nearly two years after NIST said one pass was enough for magnetic media.

On the floor, that means the wipe tool, the technique and the verification have to be chosen per drive, and the certificate has to say which were used. That is why every Coretek 360 certificate names the NIST 800-88 method, the technique and the verification result for one serial number, and why a drive that fails verification is escalated to destruction rather than wiped again and hoped for. The methods and what changed in the 2025 revision are covered in NIST 800-88 Rev. 2 explained.

Lesson three: disposal became a compliance event

By 2016, examiners were asking for a disposal log with named fields. The FFIEC Information Security booklet of September 2016 says "Management should log the disposal of sensitive media. Logs should record the party responsible for disposal, as well as the date, media type, hardware serial number, and method of disposal," and adds that "Contracts with third-party disposal firms should address acceptable disposal procedures" (FFIEC, 2016). Healthcare had been there since 2005: the Security Rule's device and media controls require procedures for disposal and for "removal of electronic protected health information from electronic media before the media are made available for re-use" (45 CFR 164.310).

Two penalties for one decommissioning

Then the penalties arrived, and they arrived twice for the same hardware. In October 2020 the Office of the Comptroller of the Currency assessed a $60 million civil money penalty against two national banks over "the 2016 decommissioning of two Wealth Management business data centers." It found that the banks "failed to effectively assess or address risks associated with decommissioning its hardware" and "failed to maintain appropriate inventory of customer data" on it (OCC, 2020). In September 2022 the Securities and Exchange Commission ordered the affiliated broker-dealer to pay $35 million over the same events. A moving and storage company with no data destruction experience had been hired to decommission thousands of hard drives and servers, and some were resold online with customer data still on them (SEC, 2022).

The record outlives the hardware. The machines in those cases were gone within months; the missing inventory and the missing vendor diligence produced findings four and six years later. Coretek 360's deliverable is built for that timeline, a serialized disposition report and a certificate per drive that a compliance team can produce years after the pickup. How that looks for a regulated client is shown in the bank engagement in chain of custody for examiners.

Lesson four: the volume kept growing, and the value went with it

The e-waste stream nearly doubled over the company's second decade. The UN's Global E-waste Monitor 2024 reports "A record 62 million tonnes (Mt) of e-waste was produced in 2022," up 82 percent from 2010, with "less than one quarter (22.3%)" documented as properly collected and recycled, and projects 82 million tonnes by 2030 (UNITAR, 2024). The same report values the recoverable natural resources left unaccounted for in a single year at US $62 billion.

Global e-waste generated, 2010 to 2030 Million tonnes per year. 2030 is the UN business-as-usual projection;each Monitor edition re-estimates earlier years. 2010 33.8 2014 41.8 2016 44.7 2019 53.6 2022 62.0 2030 (projected) 82.0 Source: UN Global E-waste Monitor series: 2014, 2017, 2020 and 2024 editions
Source: UN Global E-waste Monitor series: 2014, 2017, 2020 and 2024 editions.

The inflow is not slowing. IDC counted 75.8 million PCs shipped in the third quarter of 2025, up 9.4 percent on the year, and attributed the growth to "the need to replace an ageing installed base" and a Windows 11 transition "likely to push well into 2026" (IDC, 2025). Every one of those shipments retires a machine.

The fourth lesson reshaped the company most: a retired asset is worth more whole than shredded, and the standards agree. NIST's preference is explicit: "When possible, the purge sanitization method should be used instead of the clear sanitization method," because purge "preserves the ISM in a potentially reusable state" (NIST, 2025). A verified wipe keeps a laptop sellable; a shredder does not. Over 25 years Coretek moved from a company that removed hardware to one that tests, refurbishes and resells it through its sales channels and returns the proceeds itemized by serial number. What determines how much comes back is covered in how to recover value from retired IT assets.

Why the name changed in 2026

The company renamed itself because "disposition" no longer described the engagement. One contract now runs the full circle: scheduled pickup under chain of custody, data destruction to NIST 800-88 with a certificate per drive, testing and refurbishment, resale, responsible recycling of what is left, and a serialized report that closes every asset out. "360" is that circle. Coretek 360 is the trade name of Coretek Enterprises LLC, headquartered in North Carolina. The certificates are held by that legal entity, and the registry entries are being updated to show the trade name alongside it.

The second reason is room. Managed IT, cybersecurity, cloud and networking services are planned offerings, not current ones; the old name said hardware and nothing else, and the new one leaves space without claiming anything early. ITAD is the business today and the only service this article describes.

What did not change is everything a buyer verifies. The R2v3 certificate, first earned in December 2013, is the same. The team that logs the serial numbers is the same. The record of more than 5 million assets processed for more than 2,000 organizations belongs to the same company. A client who signed with Coretek will see the new name on the same report.

What we would tell a buyer in 2026

The 25-year summary fits in five checks, and each one comes from a lesson above:

  1. Check the certificate scope, not the logo. Open the provider's entry in the SERI directory and read the scope line. Ask which services it covers and which it does not.
  2. Ask which NIST 800-88 technique applies to each media type, and how a wipe is verified. The answer should differ for a hard disk and an SSD.
  3. Ask for the record before the pickup. A certificate per serial number and a disposition report are deliverables; agree on their fields in the contract.
  4. Put disposal in the contract. The FFIEC's examiners, HHS and the SEC all looked for the vendor terms first.
  5. Ask what comes back. Working equipment should be wiped, resold and itemized, not shredded by default.

Frequently asked questions

Is Coretek 360 a new company?

No. Coretek 360 is the trade name adopted in 2026 by Coretek Enterprises LLC, founded in 2001. The legal entity, the certifications, the team and the client history are continuous; the public name and the website changed.

Did the certifications change with the name?

No. The R2v3 certificate, first earned as R2 on December 13, 2013 and carried through the R2v3 transition audit, and the RIOS certification are unchanged. The certificates are held by Coretek Enterprises LLC, and the registry entries are being updated to show the Coretek 360 trade name; the R2v3 certification page links to both directories so the current entry can be checked.

Does "360" mean Coretek 360 offers managed IT or cybersecurity now?

Not yet. Those services are planned, and the name leaves room for them. Today Coretek 360 delivers IT asset disposition and hardware lifecycle services: pickup, data destruction, refurbishment, resale, recycling and the serialized report. Anything beyond that will be announced when it is available.

The next 25 years start with the same habit

Everything in this article traces back to one practice: log the serial number before the asset moves. The standards, the sanitization methods, the examiners and the volumes all changed around that habit, and the name has now changed with them. If you have hardware to retire, send Coretek 360 the inventory and you will get back a custody plan, the sanitization method for each media type, and a residual value estimate through the contact page.

Sources

Have hardware to retire?

Tell Coretek 360 what you are retiring and we will recover its value, destroy the data to standard, and take the rest off your plate.

Get a quote

Newsroom