RECYCLE DIFFERENT

Linkedin-in Facebook-f Instagram Youtube X-twitter
Proud partner of the Phoenix Suns
Client Portal
Reference · Media sanitization

NIST SP 800-88 Rev. 2, explained

NIST published Revision 2 of its Guidelines for Media Sanitization on September 26, 2025, and withdrew Revision 1 the same day. It is a different kind of document. Instead of telling you which wipe to run on which drive, it asks your organization to run a sanitization program, and leaves the techniques to IEEE 2883. This guide walks through what changed, with the section and page for every claim, so you can check each one against the free PDF.

Sep 26, 2025final; Rev. 1, from December 2014, withdrawn the same day
48 pagesdown from 64 in Rev. 1
0 tablesof technique; Rev. 1 had nine, A-1 to A-9
12 fieldson the certificate, one certificate per device

Walk the decision

Rev. 2's Fig. 1, as three questions. The answer is the minimum method; your policy then names the technique.

1. Will the media be reused?
2. Security categorization of the data
3. Will it leave your organization's control?
Rev. 2 minimum method Purge

Recovery made infeasible even with laboratory techniques, while the device can still be reused. Logical purge uses dedicated sanitize commands; cryptographic erase is one of them.

  1. Media disposal
  2. Reuse media? Yes
  3. Categorization: Moderate
  4. Leaves your control? Yes
  5. Purge
  6. Validate: approve or reject
  7. Document
Fig. 1, §4.3, p. 20 · §3.1.2, p. 10
Rev. 2's sanitization decision flow (Fig. 1): reuse media, then security categorization, then whether the media leaves organizational control, leading to Clear, Purge or Destroy, then validation and documentation. A rejected validation loops back to the start.Rev. 1: low dataskipped reuse questionReject: sanitize againNoYesNoYesNoYesNoYesApproveMedia disposalReusemedia?DestroyLowModerateHighLeaves yourcontrol?Leaves yourcontrol?Leaves yourcontrol?ClearPurgeClearPurgePurgeDestroyValidateresult?Document
Redrawn from Fig. 1, §4.3, p. 20. The lit path follows your answers. The dashed grey branch is where Rev. 1 differed: choose Low and "not reused" to light it. The dotted loop is a rejected validation.
The short version

Five changes that matter to a buyer or an auditor

  1. No more device recipes

    Rev. 1's nine technique tables are gone. Apart from cryptographic erase, Rev. 2 leaves technique to IEEE 2883 or a standard your own policy accepts, so the policy now has to name one.

    §3.1, §4.4, App. D

  2. A program, not a procedure

    Rev. 2 asks for an agency or enterprise sanitization program: a written policy, named roles, tracking of every storage device from arrival to final destination, and records that prove it.

    §4, §4.1, §4.6

  3. Verify, then validate

    Verification checks that the technique finished. Validation is a separate decision to approve the result or reject it and try again. Rev. 1's sampling rules are gone unless your policy keeps them.

    §4.5.1, §4.5.2

  4. Shredding and degaussing were demoted

    Shredding and pulverizing drives should be avoided for anything but the lowest security categories of data. Degaussing no longer counts as destruction, and it never works on SSDs.

    §3.1.2, §3.1.3

  5. A certificate for every device

    Each sanitized device should get a certificate recording at least twelve details, including the tool and its version and who verified and validated the result. Rev. 1's opt-out for bulk low-risk media is gone.

    §4.6, App. C
Rev. 1 to Rev. 2

What changed, line by line

14 real differences. Open any row for what Rev. 1 said and the passage in Rev. 2 that says otherwise. Section and page numbers are the ones printed in each document's footer.

Rewritten

What the document is for

A guide to running an agency or enterprise media sanitization program.
Rev. 1

A hands-on guide to sanitization decisions, with technique recipes for each kind of device.

1.1 (p. 1); 1.5 (p. 4)
Rev. 2 says
“The document's focus has shifted from providing guidelines for hands-on sanitization decisions to maintaining confidentiality of sensitive information”
Appendix D, Change Log (p. 38); Sec. 4 (p. 18)
Removed

Technique tables

Removed. Except for cryptographic erase, technique is out of scope: follow IEEE 2883 or a standard your policy accepts.
Rev. 1

Tables A-1 to A-9 gave Clear, Purge and Destroy recipes per media type, down to named drive commands.

Appendix A (pp. 26-40); Appendix C (pp. 46-48)
Rev. 2 says
“Except for cryptographic erase (see Sec. 3.2), technology-specific sanitization techniques are out of scope for this document.”
3.1 (p. 8); 4.4 (p. 23); Appendix D (p. 38)
Narrowed

Overwrite passes

Multi-pass overwrite is not needed, and on SSDs with overprovisioning it achieves very little. Purge is preferred over Clear.
Rev. 1

Clear meant at least one overwrite pass with a fixed value; more passes were optional.

2.5 (p. 9); Table A-5 (p. 31); Table A-8 (pp. 36-39)
Rev. 2 says
“When possible, the purge sanitization method should be used instead of the clear sanitization method.”
3.1.1 (p. 9); 3.1.2 (p. 10); Appendix D (p. 38)
Narrowed

Degaussing

A physical purge technique for magnetic media only, never for flash. Not a destroy technique, even when the drive no longer works.
Rev. 1

A Purge option for magnetic media, and also a Destroy technique when it left the device unusable.

5, Table 5-1 (pp. 24-25); Table A-5 (pp. 31-35)
Rev. 2 says
“At the time of this writing, degaussing is not considered an approved destroy sanitization technique”
3.1.2 (p. 10); Appendix D (p. 38)
Narrowed

Shredding and pulverizing

Shred and pulverize should be avoided for anything but the lowest security categories, because denser, harder media can defeat them.
Rev. 1

Shred, disintegrate, pulverize or incinerate were the standard Destroy entries in every table.

Table 5-1 (p. 25); Appendix A destroy rows (e.g., Table A-5, A-8)
Rev. 2 says
“Pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data.”
3.1.3 (p. 11)
Rewritten

Verification

Check that the tool or equipment completed cleanly. Full or representative sampling is not necessary unless your policy requires it.
Rev. 1

Verify every time, sample at least 10% of the media, and re-check at least 20% of sanitized media with a tool from a separate developer.

4.7, 4.7.3 (pp. 20-22); Appendix B 'Validate', 'Verification' (p. 45)
Rev. 2 says
“Unless explicitly required by organizational policy, elaborate sampling of an ISM's contents (e.g., full or representative) after clear or purge sanitization techniques is not necessary.”
4.5, 4.5.1, 4.5.2 (pp. 24-25); Appendix D (pp. 38-39)
Rewritten

The decision flow

Every path starts with "Reuse media?", and a rejected validation loops back to the start.
Rev. 1

Low-categorization media skipped the reuse question, and a failed check had no path back.

4, Figure 4-1 (p. 17)
Rev. 2 says
“The new sanitization process figure has an initial decision point focused on reusing media.”
4.3, Fig. 1 (p. 20); Appendix D (p. 38)
Expanded

Cryptographic erase

Its own section with hard conditions: 128-bit strength, no earlier plaintext, keys zeroized per ISO/IEC 19790, four eligible key types and ten documentation items.
Rev. 1

Short guidance on when to use it, plus a vendor statement template in Appendix D.

2.6-2.6.3 (pp. 9-11); 4.7.3 (p. 21); Appendix D (pp. 49-51)
Rev. 2 says
“For CE, key sanitization has been defined to be based on ISO/IEC 19790 zeroization.”
3.2-3.2.5 (pp. 11-17); Appendix D (pp. 38-39)
Expanded

What counts as media

Information storage media (ISM), including cloud and object storage, where cryptographic erase may be the only purge option.
Rev. 1

Two types: hard copy and electronic ("soft copy") media.

2.2 (p. 6)
Rev. 2 says
“For an ISM that takes the form of logical/virtual storage (e.g., cloud storage), cryptographic erase may be the only viable purge sanitization technique option.”
2.2 (p. 6); 3.1 (p. 8); 3.1.2 (p. 10); 3.1.3 (p. 11); Appendix D (p. 38)
Rewritten

Certificate of sanitization

Twelve fields, completed for each sanitized device per policy. The opt-out is gone, and so are post-sanitization destination and data backup.
Rev. 1

Thirteen fields, and bulk media of very low confidentiality could skip the certificate altogether.

4.8 (pp. 22-23); Appendix G (p. 56)
Rev. 2 says
“a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies.”
4.6 (pp. 25-26); Appendix C, Fig. 2 (pp. 36-37)
New

Trusting the device vendor

Your policy should say what assurances device vendors must provide, and nobody should assume how a sanitize command behaves.
Rev. 1

Built-in sanitize commands require trust in the vendor; Appendix E listed what to look for.

2.4 (p. 7); Appendix E (p. 52)
Rev. 2 says
“The issue of trusting the vendor's implementation of sanitization techniques for clear and purge has been addressed.”
3.1.1 (p. 9); 4.1 (p. 18); Appendix B (p. 35); Appendix D (p. 39)
Removed

Outsourcing

No outsourcing section. In-house versus third party is a decision factor, and losing control of a device may be a data breach.
Rev. 1

Appendix C.4 recommended due diligence on disposal companies under 16 CFR 682: audits, references, third-party certification.

Appendix C.4 (p. 47)
Rev. 2 says
“An organization's loss of control of an ISM that contains certain types of sensitive data may constitute a data breach.”
2.4 (p. 7); 4.3.4 (p. 22); 4.7.3 (p. 27)
New

Federal scope

Federal unclassified media that never held classified data, FOUO, Privacy Act information or PII do not require sanitization.
Rev. 1

No equivalent statement. It only allowed disposal without sanitization where disclosure would have no impact.

2.5 (p. 8)
Rev. 2 says
“or personally identifiable information (PII) do not require sanitization”
4.2 (p. 18); 4.3.1 (p. 21)
Removed

References

The bibliography was dropped as obsolete; DoD 5220.22-M appears only as history.
Rev. 1

A Selected Bibliography, including DoD 5220.22-M-Sup-1.

1.1 (p. 1); 1.4 (p. 3); Appendix F (pp. 53-55)
Rev. 2 says
“The Bibliography section was eliminated as many documents listed there were obsolete”
1.1 (p. 2); References (pp. 29-31); Appendix D (p. 38); news release 2025-09-26
Methods

Clear, Purge, Destroy, and cryptographic erase

Rev. 2 keeps Rev. 1's three methods and their meaning. What changed is what it says about the techniques that carry them out.

Rev. 2 saysClearPurgeDestroyCryptographic erase
Defeats laboratory recovery §3.1.1-§3.1.3, §3.2
Device can be reused §3.1, §3.1.2, §3.1.3
Allowed for hard copy §3.1.1-§3.1.3
Works on cloud or virtual storage §3.1.2, §3.1.3Not statedOnly by CE

Clear

§3.1.1, p. 9
“This method applies logical techniques to sanitize data in all user-addressable storage locations of an ISM for protection against simple, non-invasive data recovery techniques”
  • Never appropriate for hard copy.
  • Overwriting cannot reach spare cells on flash media with wear leveling.
  • A factory reset can count as Clear on a device that cannot be rewritten, as long as the user interface cannot retrieve the old data.
  • For moderate data, the owner may choose to accept the risk of Clear (§4.3).

Purge

§3.1.2, p. 10
“Purge sanitization techniques apply physical or logical techniques that make the recovery of target data infeasible using state-of-the-art laboratory techniques”
  • Preferred over Clear whenever possible.
  • Logical purge uses dedicated, standardized sanitize commands: overwrite, block erase or cryptographic erase.
  • Degaussing is physical purge for magnetic media only, and many existing degaussers are too weak for newer drives.
  • Leaves the device potentially reusable.

Destroy

§3.1.3, p. 11
“The destroy sanitization method is appropriate for all hard copy and most ISM, except for logical/virtual storage.”
  • Techniques named: disintegrate, incinerate, melt, pulverize, shred.
  • Avoid shredding and pulverizing for anything but the lowest security categories.
  • Bending, cutting, drilling or shooting may only partly damage the media.
  • If the media will not be reused, destroy can be the simplest and most cost-effective method (§4.3.3).

Cryptographic erase

§3.2, pp. 11-17
“with CE, sanitization can be performed with high assurance much faster than with other sanitization techniques.”
  • A purge technique, not a fourth method: it sanitizes the keys, so the encrypted data can no longer be read.
  • The only device-level technique Rev. 2 still covers itself.
  • Federal agencies must use encryption modules validated to the current FIPS 140 standard.
  • Counts only under the conditions listed further down this page.
All nine paths, side by side with Rev. 1
Reused?CategorizationLeaves your control?Rev. 2Rev. 1
YesLowNoClearSame
YesLowYesPurgeSame
YesModerateNoClearSame
YesModerateYesPurgeSame
YesHighNoPurgeSame
YesHighYesDestroySame
NoLowNot askedDestroyClear Rev. 1 skipped the reuse question for low
NoModerateNot askedDestroySame
NoHighNot askedDestroySame
Sanitization assurance, §4.5

Verify, then validate

Rev. 1 used both words loosely. Rev. 2 separates them: verification is an inspection, validation is the decision that follows it.

Step 1 · Inspect

Verification §4.5.1, p. 24

“The goal of sanitization verification is to determine the outcome of the sanitization technique used during the sanitization operation.”
Destroy
For destruction: inspect the remnants and identify the equipment used.
Clear Logical purge
For Clear and logical purge: check the tool's completion status, and look for errors, anomalies and the health of the device.
Physical purge
For physical purge such as degaussing: confirm the equipment completed its operation.
Sampling
Full or representative sampling of contents is not needed unless your policy requires it.
If it failed
If the outcome is unacceptable, sanitize again, and re-check that the device is still usable.
Step 2 · Decide

Validation §4.5.2, pp. 24-25

“Sanitization validation results in a decision to either approve the sanitization as being effective or reject it”

Rev. 2's reasons to question a result:

  1. Part of the device is out of reach It looks functional, but some area can no longer be accessed through its interface.
  2. Wrong technique for the media Degaussing an SSD can complete successfully while sanitizing nothing.
  3. Unqualified people or unapproved tools Or equipment that was improperly calibrated.
  4. Done, but not good enough For example, optical disc shreds larger than the policy allows.
  5. Scope too narrow A simple overwrite on an overprovisioned drive can leave much of the user data untouched.
ThenApprove → document it on the certificateReject → repeat with a different technique, or escalate to a stronger method
Documentation, §4.6 and Appendix C

Check a certificate of sanitization

Rev. 2 says each sanitized device should get a certificate, on paper or electronic, recording at least these twelve details. Hold your vendor's certificate next to this list and tick what it has.

  • The wording is "should record at least". Two items are qualified: the property number "if applicable" and the categorization "optional".
  • "Tool used, including version" is its own item. A certificate that names the software but not its version is incomplete.
  • Item 12 is the people who performed verification and validation, six details each.
  • A certificate's value depends on tracking the device from arrival to final destination (§4.6, p. 26).

Fig. 2's sample form, block by block

  1. Person performing sanitization
  2. Media information
  3. Sanitization details
  4. Media destination
  5. Signature and attestation
  6. Concurrence

The form and the §4.6 list don't match one to one: the form adds a destination block and a concurrence signature.

Certificate of sanitization0 of 12 fields
  12. 12Information of individuals performing verification and validation0 of 6
Tick each item the certificate records.
Section 4

What a sanitization program needs

Rev. 2 describes the program rather than the procedure. Here is each piece it names, placed where it falls in a storage device's life.

Tracking for the device's whole life. Records when a device arrives, when it leaves its last place of use, and when it reaches its final destination. Without them, certificates show that some devices were sanitized, not that all were. §4.6, §2.1

  1. 1. AcquireRecord on arrival
  2. 2. In use
  3. 3. RetireRecord at last use
  4. 4. Sanitize
  5. 5. Assure
  6. 6. ReleaseRecord at destination
1 · Acquire

Plan for disposal at the start

Identify sanitization needs before the disposal phase, ask vendors for a statement of volatility, and remember that one computer holds several kinds of storage.

“The need and methods for conducting media sanitization should be identified and developed before arriving at the disposal phase in the system life cycle.”
§2, §4.3.1, App. B
2 · In use

Categorize the data

Use FIPS 199, SP 800-60 or CNSSI 1253, and revisit the categorization at least every three years or after a significant change.

§4.3.2
3 · Retire

Decide by the data, not the device

The method follows from the data's confidentiality, whether the device will be reused, and whether it leaves your control. The media type then picks the technique.

“The decision process is based on the confidentiality of the information rather than the type of media.”
§4.3
3 · Retire

Keep the records you must keep

Before sanitizing, check with privacy, FOIA and records-retention officials so nothing that must be preserved is destroyed.

§1.1, §4.7.8
4 · Sanitize

Sanitize the whole device

Target all user data, not just the sensitive files, because data spills into remapped and overprovisioned areas.

“sanitization of the whole ISM is preferred to partial ISM sanitization whenever possible.”
§2.3, §4.2
4 · Sanitize

Use the strongest option available

Perform sanitization per IEEE 2883 or a standard your policy accepts, and where there are several options, choose the one with the most protection.

“The option that provides the most confidentiality protection should be used.”
§4.4
5 · AssureVerify, then validateVerification checks that the technique completed; validation is a decision to approve the result or reject it.§4.5 · see above6 · ReleaseCertificate for each deviceInternal reuse, external reuse, donation, resale or a recycling facility, each with its certificate and tracking record.§4.3.4, §4.6 · see above
Under every stage

A written sanitization policy

It maps each data classification to a minimum method, sets disposal and reuse rules, names acceptable techniques, defines the records to keep, assigns roles, and says what assurances device vendors must give.

“The presence or absence of a storage sanitization policy can significantly impact the effectiveness of an organization's storage sanitization activities.”
§4.1

Named roles

Ten example roles, focused on making the program succeed rather than on who runs the equipment.

  • Program managers and agency heads
  • Chief information officer
  • Information system owner
  • Information owner or steward
  • Senior agency information security officer
  • System security manager or officer
  • Property management officer
  • Records management officer
  • Privacy officer
  • Users
§4.7

Qualified people, calibrated tools

The policy covers personnel competencies and training, and the calibration, testing and maintenance of sanitization equipment.

§4.1, §4.5.2
Section 3.2

When cryptographic erase counts

Cryptographic erase is the one technique Rev. 2 still covers itself, and it is fast. It counts as purge only when all six of these hold. Tick the ones that hold for your devices.

0 of 6 conditions holdCryptographic erase can't be relied on as purge yet.
Myths

14 things people still say, and what Rev. 2 says

Overwriting

DoD 5220.22-M is the standard to follow.

Rev. 2: That overwrite language is obsolete. The NISPOM is now 32 CFR Part 117, which contains no overwrite specification at all.

§3.1.1 fn. 5; App. D; 32 CFR Part 117
Overwriting

A proper wipe needs three or seven passes.

Rev. 2: Multi-pass overwrite is not needed, and on SSDs with overprovisioning it achieves very little. If you need more assurance, use Purge or Destroy.

§3.1.1; App. D
Overwriting

A factory reset never counts.

Rev. 2: On a device that cannot be rewritten, a manufacturer reset can meet Clear, if the user interface cannot retrieve the old data. It is never Purge.

§3.1.1
Degaussing

Degaussing works on SSDs.

Rev. 2: Degaussing should not be used on flash media. Rev. 2's own example: degaussing an SSD can complete successfully and sanitize nothing.

§3.1.2; §4.5.2
Degaussing

A degaussed drive that won't spin up has been destroyed.

Rev. 2: Degaussing is not a destroy technique, even when it leaves a drive inoperable. It can damage the drive and still fail to sanitize the data.

§3.1.2; App. D
Destruction

Shredding is the safest option for any drive.

Rev. 2: Shredding and pulverizing should be avoided for anything but the lowest security categories, because some destructive techniques become ineffective as data density and material hardness increase.

§3.1.3
Destruction

Drilling a hole through a drive destroys the data.

Rev. 2: Bending, cutting, drilling or shooting may only partly damage the media, leaving portions readable with laboratory techniques.

§3.1.3
Cryptographic erase

Deleting the key always sanitizes an encrypted drive.

Rev. 2: Only if no data was ever stored unencrypted, every copy of the key can be sanitized, keys were not escrowed without tight control, and the data won't need to stay secret for decades.

§3.2.2; §3.2.3
Proof

Every wiped drive must be read back or sampled.

Rev. 2: Not unless your own policy requires it. Verification checks the tool's completion status, errors, anomalies and the device's health.

§4.5.1
Proof

A certificate proves you sanitize everything.

Rev. 2: A certificate's value depends on tracking the device from arrival to final destination. Without that, records only show that specific devices were sanitized.

§4.6
Status of the document

Rev. 1 is still current.

Rev. 2: NIST withdrew Rev. 1 on September 26, 2025, the day Rev. 2 was published, and superseded it in its entirety.

Rev. 1 withdrawal notice
Status of the document

Rev. 2 tells you which command to run on each device.

Rev. 2: It no longer does. Apart from cryptographic erase, technique details were replaced with a pointer to IEEE 2883, NSA specifications or an organizationally approved standard.

§3.1; App. D
Status of the document

A tool can be "NIST 800-88 certified."

Rev. 2: NIST describes no product certification for this guideline, and naming a product in a NIST publication implies no endorsement.

Front matter
Status of the document

SP 800-88 is legally mandatory for every business.

Rev. 2: Nongovernmental organizations may use it on a voluntary basis. A contract, regulation or certification can still require it separately.

Authority, front matter
Timeline, to scale

Eleven quiet years, then three months

Rev. 1 stood from 2014 until a single public draft in July 2025; the final came ten weeks later.

  1. Original SP 800-88 published
  2. Rev. 1 published
  3. IEEE 2883-2022 published
  4. IEEE approves a project to revise 2883
  5. IEEE 2883.1-2025 (recommended practice) published
  6. July to October 2025, enlarged
    1. Rev. 2 public draft released, the only one
    2. Public comments close
    3. Rev. 2 final; Rev. 1 withdrawn the same day
  7. NIST publishes an FAQ on Rev. 2

IEEE 2883 is where the techniques went

Rev. 2 cites "IEEE 2883" without a year and tells readers to consult its latest version. The current edition is IEEE 2883-2022, sold by IEEE; a revision has been under way since September 2024. IEEE 2883.1-2025 is a recommended practice for using its methods. Write policy against "IEEE 2883 or its current successor", and record the edition you actually applied.

Small inconsistencies in the text

  • The prose says data is categorized "low, medium, and high"; Fig. 1 and FIPS 199 say "moderate". This guide uses moderate.
  • Reference [22] dates IEEE 2883.1 to 2022. IEEE published it as IEEE 2883.1-2025 on June 19, 2025.
  • The certificate field list in §4.6 and the sample form in Fig. 2 don't match one to one: the form has a "person performing sanitization" block, a concurrence block and a destination block the list doesn't name.
  • NIST's own FAQ on Rev. 2 (July 16, 2026) refers to "NSA Policy Manual 9-22" and to "NSF's EPL". The documents are NSA/CSS Policy Manual 9-12 and the NSA Evaluated Products Lists. Where the FAQ and the guideline disagree, follow the guideline.

The law may require it

Rev. 2 is voluntary for businesses, but 36 states and DC have laws requiring personal data to be protected or destroyed at disposal. See every state's data disposal law and e-waste law.

Before you hand over a drive

Six questions for your ITAD vendor

  1. Which standard do you sanitize to?

    Rev. 2 expects IEEE 2883 or a standard your policy accepts. "NIST 800-88 compliant" on its own no longer names a technique.

  2. Show me a certificate for one drive

    Check it against the fields above, especially the tool and its version, the verification method, and who verified and validated.

  3. How do you track a device from pickup to final destination?

    Rev. 2 says a certificate means little without records at intake, at last use and at the destination.

  4. What do you do with SSDs?

    Degaussing does not sanitize flash. Ask for Purge, or a destroy method suited to the data's category.

  5. Who approves or rejects the result?

    Validation is a decision by a person, not a line in a log.

  6. If you use cryptographic erase, how is it documented?

    Ask for the details §3.2.5 lists: key generation, wrapping, escrow, the key sanitization technique and the rest.

Techbros

Certified data destruction and recycling for businesses

We are an R2v3, NAID AAA and ISO/IEC 27001 certified ITAD company based in Scottsdale, Arizona. We collect retired IT from offices, data centers and facilities, destroy the data under a documented chain of custody, and issue a Certificate of Destruction for every project.

Book a business pickupCall (877) 321-4823
For policy owners and writers

Update your citation, or cite this guide

Policies that still cite Rev. 1 point to a withdrawn document. Here are the addresses to replace, and the current citation.

https://csrc.nist.gov/pubs/sp/800/88/r1/finalhttps://csrc.nist.gov/pubs/sp/800/88/r2/final
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdfhttps://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf
https://doi.org/10.6028/NIST.SP.800-88r1https://doi.org/10.6028/NIST.SP.800-88r2

Cite Rev. 2 in a policy

Chandramouli R, Hibbard EA (2025) Guidelines for Media Sanitization. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-88r2. https://doi.org/10.6028/NIST.SP.800-88r2

Link to this guide

How this guide was made

Sources and method

  • We read NIST SP 800-88 Rev. 2 and the withdrawn Rev. 1 in full, from NIST's own PDFs, and checked every quotation on this page word for word against the Rev. 2 text.
  • Section and page numbers are the ones printed in each document's footer. In the Rev. 2 PDF, add nine to reach the PDF page.
  • IEEE 2883 is a paid standard, and this guide does not quote or paraphrase it. It describes only what Rev. 2 says about it and what IEEE publishes about it.
  • DoD 5220.22-M's status was checked against 32 CFR Part 117 on the eCFR.
  • Reviewed October 27, 2026.

Primary sources

This guide summarizes a NIST publication for orientation. It is not legal advice and does not replace the document itself; read the guideline before relying on any point. Spotted an error? Email recycle@techbrosaz.com with the section, and we will check it.

FAQ

Questions people ask about Rev. 2

Is NIST SP 800-88 Rev. 1 still valid?

No. NIST withdrew Rev. 1 on September 26, 2025, the day it published Rev. 2, and states that Rev. 2 supersedes it in its entirety. Contracts and policies that cite Rev. 1 should be updated.

What changed in NIST SP 800-88 Rev. 2?

Rev. 2 moved from hands-on technique guidance to an enterprise media sanitization program. The per-device technique tables were removed in favor of IEEE 2883 or an organizationally accepted standard; verification was split into verification and validation; shredding, pulverizing and degaussing were narrowed; cryptographic erase got its own detailed section; and the certificate of sanitization was trimmed to 12 fields completed for each device.

Does Rev. 2 require DoD 5220.22-M or multiple overwrite passes?

No. Rev. 2 calls the DoD 5220.22-M overwrite language obsolete and says multi-pass overwrite is not needed. On SSDs with overprovisioning, multiple passes achieve very little; Purge or Destroy is the way to get more assurance.

Is NIST 800-88 mandatory for private companies?

Not by itself. Rev. 2 says nongovernmental organizations may use it on a voluntary basis. A contract, a regulation or an industry certification can still require it, and many state laws require businesses to destroy personal data at disposal.

What is the difference between verification and validation?

Verification inspects the outcome: did the tool or equipment complete, with no errors or anomalies? Validation is the decision that follows: approve the sanitization as effective, or reject it and repeat with a different technique or escalate to a stronger method.

What should a certificate of sanitization include?

Rev. 2 section 4.6 lists at least: manufacturer, model, serial number, property number if applicable, media type, media source, pre-sanitization categorization (optional), sanitization method, sanitization technique, tool used including version, verification method, and the name, title, date, location, contact information and signature of the people who verified and validated it.

Can a product be NIST 800-88 certified?

NIST does not run a certification program for SP 800-88, and its publications state that naming a product implies no endorsement. Claims of "NIST 800-88 certified" describe the vendor's own assessment, not a NIST approval.

Where did the sanitization techniques go?

Rev. 2 points to IEEE 2883, the IEEE Standard for Sanitizing Storage, or to a standard your organization's policy accepts, such as NSA/CSS Policy Manual 9-12. IEEE 2883 is sold by IEEE; Rev. 2 tells readers to consult its latest version.

Retiring drives that hold sensitive data?

Techbros handles data destruction and recycling for businesses, with a certificate for every project.

Book a pickupCall (877) 321-4823