Every retired laptop, server, or hard drive in your building is a liability until it’s proven otherwise. If your company can’t show, on paper, that old storage media was sanitized correctly, you’re carrying risk you probably don’t know you have.
That’s where NIST 800-88 comes in. It’s the federal standard that defines what “securely erased” actually means, and it’s quickly becoming the benchmark that auditors, regulators, and cyber insurers expect businesses to meet, even outside government.
This guide breaks down what NIST 800-88 is, what changed in the newest revision, and what your business actually needs to do to stay compliant and protected.
What Is NIST 800-88?
NIST Special Publication 800-88, Guidelines for Media Sanitization, is published by the National Institute of Standards and Technology. It gives organizations a consistent, defensible process for destroying data on electronic storage media so it can’t be recovered.
The standard was originally released in 2006 for federal agencies. Revision 1, published in December 2014, became the version most businesses and IT asset disposition (ITAD) providers still reference today. It’s built around three core sanitization methods:
- Clear – Logical techniques (like standard overwrite commands) that protect against basic, non-invasive recovery attempts. Suitable for media being reused inside a lower-risk environment.
- Purge – More advanced techniques, such as cryptographic erase or firmware-level secure erase commands, that protect against laboratory-level recovery attempts. Appropriate for media leaving your organization’s control.
- Destroy – Physical destruction (shredding, disintegration, pulverizing) that makes the media, and the data on it, permanently unusable and unrecoverable.
Which method applies depends on your data’s sensitivity, the type of media, and whether the device will be reused, resold, or scrapped.
An Important Update: NIST Retired Revision 1
Here’s something a lot of “NIST 800-88 guides” online haven’t caught up on yet: NIST officially withdrew SP 800-88 Revision 1 on September 26, 2025, replacing it with Revision 2.
Revision 2 shifts the focus from listing specific sanitization techniques to helping organizations build a full media sanitization program. It also formally separates sanitization into logical and physical techniques and points organizations toward current standards like IEEE 2883:2022 rather than a fixed technique list that ages quickly as new media types appear.
If your vendor contracts, policies, or compliance documentation still cite “NIST 800-88 Rev. 1” as the current standard, it’s worth updating that language, since the underlying document has changed.
Why Secure Data Destruction Matters for Your Business
Data doesn’t stop being sensitive just because a device is decommissioned. Deleted files, formatted drives, and factory-reset devices can often still be recovered with widely available forensic tools. That gap between “deleted” and “actually gone” is exactly what NIST 800-88 exists to close.
Here’s what’s actually at stake when destruction isn’t handled properly:
- Data breach exposure. A single improperly wiped hard drive leaving your building can expose customer records, financial data, patient information, or intellectual property.
- Regulatory penalties. HIPAA, GLBA, FACTA, and various state privacy laws all carry financial and legal consequences for improper data disposal, regardless of intent.
- Loss of chain of custody. Without documented tracking from pickup to destruction, you have no way to prove what happened to a device between removal and disposal.
- Reputational damage. A data leak tied to old, discarded equipment is a hard story to explain to customers or partners, even if the breach happened years after the device left your office.
- Failed audits. Auditors increasingly ask for certificates of destruction and sanitization method documentation, not just a verbal assurance that “it was taken care of.”
In practice, secure data destruction isn’t a one-time task. It’s an ongoing control that has to be built into how your organization retires hardware, every single time.
Clear, Purge, or Destroy: How to Choose the Right Method
Choosing between the three NIST methods comes down to two questions: how sensitive is the data, and where is the media going next?
Scenario | Likely Method |
Internal reuse of low-risk devices | Clear |
Devices being resold or donated | Purge |
End-of-life drives, SSDs, or media with regulated data | Purge or Destroy |
Classified, highly regulated, or non-functional media | Destroy |
A few practical notes from handling this at scale:
- SSDs and flash-based media behave differently than traditional hard drives. Overwriting alone often isn’t reliable due to wear-leveling, so cryptographic erase or physical destruction is usually the safer route.
- Degaussing works on magnetic media but does nothing for solid-state drives, since there’s no magnetic field to disrupt. Using the wrong method for the media type is one of the most common compliance gaps we see.
- “Factory reset” is not the same as sanitization. It removes the pointers to files, not necessarily the underlying data.
What Compliant Data Destruction Actually Looks Like
A defensible sanitization process, whether you handle it in-house or through a partner, needs a few non-negotiable elements:
- Asset inventory and intake – Every device is logged, serialized, and tracked from the moment it’s collected.
- Documented chain of custody – A clear, unbroken record of who had control of the media at every step.
- Method selection based on data sensitivity – Not a one-size-fits-all wipe, but a decision matched to the media type and risk level.
- Verification – Confirming the sanitization actually worked, not just that a process was run.
- Certificate of destruction – A record that includes device details, method used, tool and version, and verification results, available for audit at any time.
Skipping any one of these steps weakens the whole chain. A drive that was correctly wiped but never documented is just as much of an audit risk as one that wasn’t wiped at all.
Common Mistakes Businesses Make With Data Destruction
- Assuming deleting files or formatting a drive is sufficient
- Reusing old DoD 5220.22-M “7-pass wipe” standards on SSDs, where they’re largely irrelevant and can shorten drive life without adding security
- Letting decommissioned equipment sit in storage rooms or closets without a documented plan
- Relying on employees to manually wipe devices with no verification step
- Working with disposal vendors who don’t provide certificates of destruction or chain-of-custody reporting
Any one of these can undo an otherwise strong data security program.
How DES Technologies Helps Businesses Stay Compliant
This is the exact problem we solve for enterprise, healthcare, government, and education clients every day. Our secure data destruction process is built directly around NIST 800-88 methodology, from intake through final certification.
Depending on your risk profile and reuse plans, that can include:
- Secure data erasure using NIST-aligned software methods for media being reused or resold
- Physical data destruction for drives and media that need to be permanently destroyed
- Degaussing for eligible magnetic media
- Full chain of custody tracking from pickup to final disposition, with serialized reporting at every stage
You can see the specifics of our approach on our NIST 800-88 compliance page, including how we document and certify every device that comes through our facility.
Frequently Asked Questions
Is NIST 800-88 legally required for my business?
It’s mandatory for federal agencies and contractors handling federal data, but it’s not automatically required by law for every private business. That said, regulations like HIPAA and state privacy laws don’t specify a technical method, so NIST 800-88 has become the widely accepted way to prove you met a “reasonable” standard of care.
What’s the difference between data erasure and physical destruction?
Data erasure uses software-based methods to overwrite or cryptographically destroy data while leaving the physical media intact and reusable. Physical destruction permanently damages the media itself, so it can never be reused, which is required when data sensitivity is high or the drive is non-functional.
Can deleted data really be recovered from a formatted hard drive?
Yes, in many cases. Formatting and deleting typically remove the file’s address in the system’s index, not the underlying data itself. Specialized recovery software can often reconstruct files unless the media was sanitized using a NIST-approved Clear, Purge, or Destroy method.
Does NIST 800-88 apply to solid-state drives (SSDs) and mobile devices?
Yes. The standard is designed to apply broadly across media types, including SSDs, mobile devices, and other flash-based storage, though the specific technique used differs from traditional hard drives due to how that media stores and manages data.
What should a certificate of destruction include?
At minimum, it should document the device’s manufacturer, model, and serial number, the media type, the sanitization method used, the tool and version used to perform it, and confirmation that the result was verified. This documentation is what makes destruction defensible in an audit.