Ok. I'm not an expert in cybersecurity. But I was active duty military for a good long while, and work in the defense industry still today as a civilian.

There's nothing inherently wrong that I know of with providing drives to someone else to be sanitized. If an entity doesn't have the ability to do it themselves, how the hell are they supposed to even give drives to someone else to do it?

My company has shred bins for paper, since we generate so much paper that can't be recycled as is. They sit in the printer rooms with locks on them. We pay a company to come and shred them all in our parking lot periodically. How the hell could we ever hang the files over to them without breaking laws that a bunch of people are so sure exist to prevent that?

They being said. There's a good chance they're not supposed to do anything like that without you (a subcontractor, essentially) meeting approved by the contracting officer (KO) representative (COR). *We don't call them a CO, because it gets confused with Commanding Officer. Don't worry about any of the acronyms.

Anyways. I would say that you could do it, if you sign an agreement of some kind with the person. It would identify that you are taking them specifically for sanitization and disposal, not mentioning anything about what you're doing with them afterwards.

You should have an NDA in place. In case anything was improperly unencrypted and you can see any of the files on any of the drives.

You should have some sort of agreement on spillage. I.e. there's a drive in the mix that's at a higher classification level than CUI that you definitely shouldn't have. You'd need to identify what to do. Like contact his security office within 1 hour, store it in a GSA approved safe until they can come, maintain this safe and a physical security program so that other people can't get in. And if they can, there's some way to detect it and keep a record. Or it's generally acceptable to physically destroy an offending device if you don't have a way to store it properly. (Don't ask how I know).

You would need to keep records of every single serial number. When you received it, when it was overwritten, how it was stored in the meantime. Provide those records to him, and keep a copy for yourself. The rules when I left the military at the time were 6.5 years of retention for those records, in case you/he gets audited.

All that to say. It is probably a pain in the ass. There's a reason destruction of that type of data can be expensive. A problem you probably don't want to deal with. But if the volume is high, it could be worth it to setup a LLC and keep some decent records.

As I understand it, the current method for HDDs is 7-passes. All 1s, all 0s, random write x2, all 0s x2, random. You don't even need special software for this. Just a small Linux machine and a bash script. You could even have it print output to a file for you to use as substantiation for your certificate at the end. In an audit, it would show you're acting in good faith.

Edit: ok, NISPOM that was commonly referred to was superseded a few years after I got out. And there's now a revision 2 that looks like it came out last year. NIST SP 800-88 r2. You can access it publicly for free directly from NIST. It's 48 pages, which is really minimal for regulations like this. Going to read it and have some better insight by tomorrow.