NAID AAA Certification is an independent, audit-based credential administered by i-SIGMA (formerly NAID) that verifies a secure destruction company follows documented security, screening, and destruction procedures. Providers must pass scheduled and surprise audits covering physical security, employee background checks, and chain-of-custody controls to earn and keep it. It is the closest thing the shredding industry has to a verifiable safety standard, though it certifies a company's practices — it does not guarantee any single job goes perfectly.
What NAID AAA actually checks
The certification covers the operational details that matter most when someone else is destroying your sensitive paper or media.
Employee screening. Certified companies must background-check employees who have access to confidential material, including criminal history checks, before those employees are allowed near client documents.
Physical and operational security. Auditors review locked collection containers, secured trucks and facilities, access controls at destruction sites, and how material is handled between pickup and destruction — the chain of custody.
Destruction process and equipment. The standard specifies acceptable particle sizes and equipment types so that destroyed material cannot reasonably be reconstructed, whether the job is on-site shredding, plant-based shredding, or media/hard-drive destruction.
Insurance and liability coverage. Certified operators must carry adequate insurance, which matters if something goes wrong during transport or destruction.
How the audits actually work
What separates NAID AAA from a company simply claiming to be "secure" is the audit structure. Certified locations undergo scheduled audits and unannounced audits by trained, independent auditors — not self-reported checklists. Certification applies at the facility or operation level and must be renewed on a regular cycle, so a company can lose it if practices slip. i-SIGMA maintains a public certification directory where you can look up a specific company or location and confirm whether its certification is current, because certificates can lapse or be revoked.
It's worth being precise here: a comparison or referral directory that lists a "secure destruction company" as NAID AAA certified is only reporting a public record — it does not itself certify or endorse anyone. Always confirm current status directly in i-SIGMA's own directory before you rely on it.
Why this matters more than marketing claims
Almost any shredding company can advertise that it is "secure" or "compliant." NAID AAA matters because it converts those claims into something checkable: a specific certification number, a specific facility, and a renewal date, backed by an outside auditor rather than the company's own word.
This is especially relevant given the legal exposure businesses carry around document disposal. The FTC's Disposal Rule under FACTA requires businesses to take reasonable measures when discarding consumer report information, and the FTC's broader data-security guidance treats secure disposal as a basic expectation for any business handling personal data. Organizations covered by HIPAA or GLBA carry additional, sector-specific obligations for health and financial records. None of this is legal advice — obligations vary by industry and jurisdiction — but in each case, the business doing the discarding is the one regulators hold accountable, not just the vendor it hired. Working with a NAID AAA certified provider is one of the more defensible ways to show you took disposal seriously.
Certification vs. a certificate of destruction
These two terms get confused often, but they answer different questions. NAID AAA Certification is about the company: does this provider's ongoing operation meet an audited security standard? A certificate of destruction is about a single job: it documents that your specific materials were destroyed, on what date, by what method, and where. A certified company should issue a certificate of destruction for every job as a matter of course — but you should ask for and keep that document regardless of certification status, because it's your own proof of compliance if you're ever audited or sued.
Frequently asked questions
Is NAID AAA required by law? No. It's a voluntary industry certification. Some laws (like FACTA's Disposal Rule) require "reasonable measures" for disposal without naming a specific certification, which is exactly why an audited, third-party standard is useful evidence of due diligence.
Does NAID AAA cover mobile and plant-based shredding equally? Yes, in principle — certification can apply to on-site (mobile) operations, plant-based destruction, and electronic media destruction, though a given facility or provider may be certified for some services and not others. Check the directory entry for the specific service you need.
How often is certification renewed? Certified providers are subject to ongoing scheduled and unannounced audits on a recurring cycle set by i-SIGMA, and certification is tied to compliance with the current audit rather than a one-time approval.
How to choose and verify a secure destruction company
Start with the i-SIGMA NAID AAA directory and confirm the exact legal entity and location you're hiring is listed as currently certified — not just that the company's website displays a logo. Ask what services the certification covers (paper, hard drives, backup media) and whether that matches your job. Request a certificate of destruction for every service, and confirm it lists the date, method, and location of destruction. If you're comparing multiple local providers, a directory can help you find who operates in your area and surface public information about them, but treat that as a starting point for research, not as a substitute for checking i-SIGMA's directory yourself.