📡 Telecoms & Utilities IT Disposal

Network equipment is data-bearing equipment

The single most common oversight in this sector is treating routers, switches, firewalls and wireless controllers as hardware rather than as data. They are not empty. A decommissioned device typically retains:

• Running and startup configurations describing your topology in detail
• Local user accounts, community strings and stored credentials
• VPN and tunnel configuration, including pre-shared keys
• ACLs and firewall rules that map exactly where your defences sit
• Certificates, keys and RADIUS or TACACS+ shared secrets
• Logs revealing addressing, naming conventions and connected systems

For an attacker, that is a blueprint. A factory reset is a reasonable first step but is not in itself evidence of destruction, and on some platforms does not clear every storage region.

Critical national infrastructure and NIS obligations

Telecoms operators and utilities providing essential services operate under security obligations that most businesses do not, including the Network and Information Systems Regulations. Asset disposal is part of that picture: equipment leaving your control while still holding configuration or credentials is a security event waiting to be discovered.

Where a site requires vetting, escorted access or pre-notification, raise it at enquiry stage. Some conditions take time to arrange and late notice is the usual cause of a missed slot. Our vehicles are unmarked and GPS-tracked as standard.

Field and remote site equipment

Utilities and telecoms estates are unusually distributed. Alongside the central office and data centre sit exchange and cabinet equipment, substation and pumping station hardware, remote monitoring and telemetry units, ruggedised field laptops and tablets, and vehicle-mounted systems.

Two practical consequences. First, this equipment is frequently the oldest in the estate, because remote kit gets replaced only when it fails. Second, collections may involve many sites with small quantities at each. Tell us the full site list upfront — we can usually plan a route covering several locations, which is far more efficient than treating each as its own job.

SIMs, storage cards and the small items

Field devices and telemetry units often contain SIM cards, SD cards and embedded flash that never appear on an asset register. They may hold connection credentials, APN configuration and cached operational data. If small removable media are present, flag them — they are easy to handle correctly and very easy to overlook entirely.

Phased replacement programmes

Network refreshes in this sector run over months or years rather than as a single event, which creates its own risk: equipment comes out of service in small batches and accumulates in a store room, still holding live configuration, sometimes for years.

That interim period is where most exposure sits. Equipment nobody is responsible for, in a room nobody audits, holding credentials that may still work. Regular scheduled collections throughout a programme are considerably safer than one large clear-out at the end — and being in service more recently, the equipment is also worth more.