When the user is retiring systems, upgrading storage and servers, returning leased equipment, or redeploying storage devices, it is critical to protect the company information they contain, but simply erasing the used disks is not enough to make the data permanently inaccessible. Sanitizing equipment and surfaces requires two steps: cleaning and sanitizing. Cleaning removes the soil deposits, and sanitizing (sterilizing) destroys microbes that are left on the clean surface. If the surface is still dirty, the soil protects the microbes from sanitizing agents. Once you no longer require backed-up data or its expiration date has passed, you must either archive or destroy it depending on your organization's data retention policies. If you store data on site, you might use various data sanitization techniques to fully destroy it, based on the storage medium. If possible, obtain a certificate of destruction, so that in the event of an IT organization audit, the auditor can examine and verify evidence of data destruction activities. If you store data off site, such as in cloud backup storage, your cloud vendor must destroy your customer data for you. You must then verify that the data has been properly and fully destroyed and cannot be recovered.