TL;DR / Quick Answer (SEO): A UAE ITAD request for proposal should specify asset types, pickup locations, chain of custody, approved sanitisation methods, verification evidence, downstream recycling and financial settlement. Score vendors against documented controls rather than marketing badges alone. Request sample asset-level reports, exception handling and written accountability before awarding a corporate disposal contract.
An IT asset disposition tender is not just a request for a truck and a recycling certificate. A bank, retailer, logistics company or growing SME retiring equipment must decide what happens to data, which assets can be reused, how the movement is documented and who carries financial and legal risk. UAE search results include ITAD providers promising certifications and fixed outcomes, but a procurement team needs evidence that the proposed controls will work for its actual media and locations. This guide provides a practical RFP structure and a scoring framework that buyers can adapt.
Build a manifest that separates laptops, desktops, servers, network appliances, phones, removable drives, batteries and displays. Include estimated quantities, serial numbers where available, storage type, condition, collection location and whether devices belong to the company or a leasing provider. Identify assets that are still subject to legal holds, return obligations or management enrolment.
State the outcome required for each category: reuse after authorised sanitisation, resale subject to valuation, recycling, or destruction when risk and media condition justify it. A single blanket instruction to 'wipe everything' is not adequate for failed SSDs, encrypted mobile devices and non-storage peripherals. Provide bidders with a representative sample manifest and ask them to identify exceptions rather than making unsupported universal promises.
NIST published SP 800-88 Revision 2 in September 2025, superseding Revision 1. Its emphasis includes an organisation-wide sanitisation programme, applicable techniques, validation and vendor trust. Ask bidders to explain how they select an approved method for the particular media, how they validate and verify results, and what they do when a device cannot be processed normally.
Do not accept 'NIST certified' as a self-explanatory qualification. NIST guidance does not by itself establish that a vendor has been certified by NIST. Request evidence of relevant third-party certifications where they are genuinely required, check scope and expiry directly, and review sample erasure or destruction records with the organisation's security lead. Require a clear escalation route for failed sanitisation.
An RFP should specify who signs at collection, how serial numbers are recorded, how items are sealed and transported, where they are stored, who can access them and when custody transfers. A vendor should be able to explain how a device appearing on the pickup manifest is reconciled with the final disposition record. Missing serials, mixed lots and untracked subcontractor transfers need an explicit exception process.
Request a sample completion pack with the original manifest, intake reconciliation, sanitisation method, verification outcome, final disposition, date, responsible party and any downstream transfer evidence. Ask for a single contact who can resolve mismatches. A certificate without a traceable relationship to the original asset register is weak evidence for an audit.
Ask vendors to separate service fees, transport, testing, data processing, recycling charges and expected resale or buyback credits. Specify whether valuations are fixed, conditional on inspection or subject to deductions. A high indicative resale figure may be less attractive after exclusions, fees and long settlement periods. Compare the net outcome under the same assumed condition mix.
Include payment milestones, dispute windows, liability caps, insurance where applicable, subcontractor controls and how unsold assets are handled. For a corporate fleet, decide whether employee devices can be resold at all under company policy. Do not let an optimistic environmental or revenue forecast override data-security requirements.
An example weighting is data-security controls 30 points, custody and traceability 20, environmental and downstream evidence 15, operational fit 15, commercial transparency 10 and reporting or responsiveness 10. This is a proposed buyer scorecard, not an industry certification or a universal regulatory requirement. Establish pass-or-fail requirements for ownership, sensitive media, confidentiality and legal eligibility before applying weighted scores.
Ask each bidder for a redacted sample report, a process map, escalation contacts and a clear list of exclusions. Score only substantiated responses. If two bidders receive similar totals, run a controlled pilot with a small asset batch and compare actual serial reconciliation, exception handling and reporting timeliness before committing the full fleet.
Request a method statement, sample chain-of-custody records, asset-level sanitisation evidence, exception policy, downstream handling description and a clear commercial schedule. Ask for copies of relevant certifications and verify them independently if they matter to the tender.
No. SP 800-88 Revision 2 is a guidance publication on media sanitisation programmes and controls. A vendor's claim of NIST certification needs independent scrutiny rather than being accepted as proof of accreditation.
Not necessarily. The appropriate sanitisation or destruction choice depends on data sensitivity, media condition, reuse policy and the organisation's approved standard. A qualified security lead should approve the method and verification requirements.
Use the same asset manifest and scope for every bidder, and separate processing fees from estimated resale value. Require disclosure of deductions, payment timing and treatment of failed or missing devices.
The RFP should require segregation, secure custody, an approved alternative disposition and documented exception approval. Do not accept a generic 'wipe completed' record for a drive that could not be accessed.
Yes. A limited, representative batch can test collection, serial reconciliation, verification and report quality. Define success criteria and data-security requirements before the pilot starts.
Rekart has a public ITAD enquiry page for corporate asset disposition. Submit the inventory and required evidence, and request written confirmation of the actual service scope, methods and commercial terms.
Contact the team with the exact equipment, quantity and requirements. Current eligibility, collection, repair scope, commercial terms and documentation must be confirmed in writing; no fixed price or unverified certification is implied by this guide.
Rekart editorial team — guides for certified refurbished tech in the UAE.
