NIST Special Publication 800-88 is the US National Institute of Standards and Technology’s guidance on media sanitization: making data on storage media unrecoverable before the media is reused, returned, sold, recycled or destroyed. It covers hard drives, solid-state drives, phones, removable media and paper. The current version, Revision 2 from September 2025, focuses on running an organization-wide media sanitization program and points to other standards for technique details. Contracts and IT asset disposition vendors often cite it. This entry is general information, not legal advice.
At a glance
- It defines three sanitization methods: clear, purge and destroy.
- The method should match the sensitivity of the data and the type of media.
- Revision 2 (2025) shifts the focus from device-by-device decisions to an organization-wide sanitization program.
- Apart from cryptographic erase, Revision 2 points to IEEE 2883, NSA specifications or an organization-approved standard for specific techniques.
- Results should be verified, validated and recorded, for example in a certificate of sanitization.
What problem it solves
Retired laptops, servers, phones, copiers and lease-return equipment often still hold customer data, credentials and intellectual property. Deleting files or reformatting a drive usually leaves that data recoverable, and modern solid-state drives and phones store data in ways that simple overwriting may not reach.
NIST SP 800-88 gives organizations a common way to decide how thoroughly each kind of media must be sanitized, to do it with a suitable technique, and to prove it was done. It also gives buyers shared language for contracts with disposal and recycling providers, so “we wipe drives” can be replaced by a specific method, verification step and record.
How it works
Build a program. Revision 2 centers on a media sanitization program: policy, roles, inventory of media, chosen standards and records, so sanitization is handled consistently across the organization.
Classify the data. The organization identifies how sensitive the data on each device is, using the security categorization approach in FIPS 199.
Choose a method. Clear, purge or destroy is chosen based on data sensitivity, the media type, and whether the device will be reused, returned or disposed of. Purge or clear may be preferred over destruction when the media will be reused, sold, donated or returned at the end of a lease. For moderately sensitive data, an owner may accept the risk of clear where no reliable purge technique exists.
Use cryptographic erase where it fits. Cryptographic erase is a purge technique that sanitizes the encryption keys protecting the data, so the encrypted data can no longer be decrypted. It depends on the data having been encrypted with keys that can be reliably sanitized; Revision 2 expands this section and references FIPS 140-3 validation for the cryptographic modules involved. See encryption.
Verify, validate and record. Verification checks that the technique completed, for example by inspecting destruction remnants or tool completion status. Validation is the decision that the data was effectively sanitized, or that the work must be repeated with a stronger method. A certificate of sanitization records each device, the method and who did it.
Sanitization methods
NIST SP 800-88 has no certification levels. Its core structure is three sanitization methods, chosen by data sensitivity and media type.
| Method | What it does | When it is typically used | Typical evidence |
|---|---|---|---|
| Clear | Logical techniques, such as overwriting or a factory reset, through the device’s normal interface; protects against simple, non-invasive recovery | Lower-sensitivity data, or media staying under the organization’s control | Tool completion log, certificate of sanitization |
| Purge | Physical or logical techniques, including cryptographic erase, that make recovery infeasible with laboratory techniques | Sensitive data on media that will be reused, resold or returned | Tool or equipment report, verification and validation record, certificate |
| Destroy | Makes recovery infeasible with laboratory techniques and leaves the media unusable, for example by shredding, disintegrating or pulverizing | Highly sensitive data, failed or unsupported media | Destruction record, witness or video where required, certificate |
The right method also depends on contracts, regulations and your own policy; check with counsel or your auditor where specific rules apply.
When it matters for buyers
- When hiring an IT asset disposition or recycling provider. The contract should name the methods, verification and records you expect.
- When returning leased equipment or cloud hardware. Ask how storage is sanitized before it leaves your control or is reassigned.
- When retiring phones and laptops. Device encryption from day one makes cryptographic erase possible at retirement.
- When an auditor, customer or regulator asks for proof. Certificates of sanitization tied to serial numbers are common evidence.
Our governance, risk and compliance overview covers advisors and platforms that help set and track policies such as media sanitization.
Questions to ask vendors
- Which revision of NIST SP 800-88 does your process follow, and which technique standard, such as IEEE 2883, do you use?
- How do you choose between clear, purge and destroy for each device type?
- How do you verify and validate each sanitization, and do you issue a certificate per serial number?
- Is sanitization done on our site, in transit or at your facility, and how is chain of custody tracked?
- How do you handle solid-state drives, phones and devices that fail sanitization?
- What independent certifications or audits cover your process?
How it differs from IT Asset Disposition (ITAD)
IT asset disposition (ITAD) is the whole process of retiring IT equipment: collection, chain of custody, data sanitization, then reuse, resale or recycling. NIST SP 800-88 focuses on the data part of that process: how to make data on the media unrecoverable and how to prove it. An ITAD provider may follow SP 800-88 for sanitization, but it also handles logistics, asset value recovery and environmental compliance. SP 800-88 is one of many publications in NIST’s Special Publication 800 series, and its media protection practices relate to controls in NIST SP 800-53.
Problems this helps with
- Worried data on retired laptops, drives and phones could leak
- Need proof for auditors that old devices were wiped or destroyed
- Our disposal contract says "NIST 800-88" and we don't know what that requires
- Want to reuse or resell hardware without exposing data
