NIST 800-88 Rev. 2 Explained: Clear, Purge, Destroy (2026)

Written and reviewed by the ITAD team at Coretek 360, whose facility is audited to R2v3 and RIOS. About the company.

NIST Special Publication 800-88 is the US federal guideline for media sanitization: how to make the data on a retired drive or device unrecoverable before hardware is reused, sold or scrapped. The current version is Revision 2, published in September 2025, superseding Revision 1 from December 2014 (NIST, 2025). Outside government it matters because regulators punish disposal failures. In 2022 the SEC imposed a $35 million penalty after a firm's retired devices were resold with customer data on them (SEC, 2022), and IBM puts the global average cost of a data breach at $4.99 million (IBM, 2026).

This page answers the questions IT, security and compliance managers ask before a refresh or IT asset disposition project, in four groups:

1. The basics: what it is, what changed, who must follow it
2. Clear, purge and destroy: the three methods, passes, degaussing and shredding
3. Sanitizing specific media: SSDs, cryptographic erase and IEEE 2883
4. Proving it: certificates, HIPAA, penalties and how often sanitization fails in practice

Key Takeaways

• NIST SP 800-88 Rev. 2 (September 2025) defines three sanitization methods, clear, purge and destroy, and bases the choice on the confidentiality of the data, not the type of media.
• Rev. 2 states that "multi-pass overwrite is not needed," calls the DoD 5220.22-M pass counts "obsolete," and says degaussing "does not currently constitute a destroy sanitization technique."
• The guideline applies to federal agencies under FISMA and is voluntary for everyone else. HIPAA, the FTC Disposal Rule and the GLBA Safeguards Rule require secure disposal without naming a standard, and NIST 800-88 is the common way to show it was done.
• A certificate of sanitization should exist for each item of media and record at least the manufacturer, model, serial number, method, technique, tool and version, verification method, and who performed and validated the work.

In this article:

• The basics
• Clear, purge and destroy
• Sanitizing specific media
• Proving it

The basics

What is NIST 800-88?

NIST SP 800-88, "Guidelines for Media Sanitization," is the National Institute of Standards and Technology's guideline for removing data from storage media before the media is reused or disposed of. NIST defines the task this way: "Media sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort" (NIST SP 800-88 Rev. 2, 2025). The document sets out three methods, clear, purge and destroy, and a decision flow for choosing between them.

Rev. 2 uses the term information storage media (ISM) for anything that holds data: hard disk drives, solid state drives, memory, optical disks, tape, "phones, mobile computing devices, networking devices, and office equipment," plus logical storage such as cloud and object storage. It warns that many drives hold more physical storage than the user can see and that "the entire contents should be sanitized." The audience is wider than federal IT: "Protecting the confidentiality of information should be a concern for everyone, from federal agencies and businesses to home users."

What changed in NIST 800-88 Rev. 2?

Rev. 2 keeps the clear, purge and destroy definitions almost word for word from Rev. 1 and changes how techniques are specified: media-specific instructions are gone, IEEE 2883 is the technique reference, and the overwrite and degaussing debates are settled in the text. NIST approved the revision on September 12, 2025, published it on September 26, 2025, and withdrew Rev. 1 (December 2014) the same day (NIST, 2025).

NIST lists the changes in Appendix D (NIST SP 800-88 Rev. 2, 2025). The ones that affect a disposal program (CE is cryptographic erase, covered below):

• "Apart from CE, which is commonly used across all encrypted media, all sanitization technique and tool details have been replaced with recommendations to comply with IEEE 2883, NSA specifications, or an organizationally approved standard."
• The term information storage media (ISM) "replaces electronic (i.e., "soft copy") media" to cover cloud storage and newer media types, and the appendices on media-specific techniques "were removed to improve the document's longevity."
• "The new sanitization process figure has an initial decision point focused on reusing media."
• "Almost all "verification" language has been removed. Full/representative sampling is stated as not being needed unless required by the organization."
• "The "clear" method was clarified such that multi-pass overwrite is not needed. This counters the obsolete DoD 5220.22-M language that mandates a certain number of overwrite passes and patterns."
• Degaussing guidance now "clarifies that it does not currently constitute a destroy sanitization technique, even when it renders an ISM inoperable."
• For cryptographic erase, key sanitization is "based on ISO/IEC 19790 zeroization," the acceptable key types are listed, and the use of externally managed keys is clarified.
• "The issue of trusting the vendor's implementation of sanitization techniques for clear and purge has been addressed."
• Sanitization assurance is introduced, covering "sanitization verification (determines the outcome of the sanitization technique used during the sanitization operation) as well as sanitization validation (decision process to either approve the sanitization as being effective or reject it)."
• "The sample "Certificate of Sanitization" form in Appendix C was updated."

Is NIST 800-88 mandatory, and who has to follow it?

NIST 800-88 applies to federal agencies under the Federal Information Security Modernization Act (FISMA) of 2014 and OMB Circular A-130, and it is voluntary for everyone else; the private-sector rules that govern disposal describe outcomes the guideline is the standard way to demonstrate. NIST states that the publication "may be used by nongovernmental organizations on a voluntary basis" (NIST SP 800-88 Rev. 2, 2025).

None of the US rules below names NIST 800-88 in its text. Each requires that data on retired media be made unreadable and leaves the method to the organization, which is why auditors and contracts fall back on NIST's methods and vocabulary.

Healthcare teams can check a fleet against the healthcare ITAD requirements before a pickup is scheduled.

Is there a NIST 800-88 certification?

No. NIST writes the guideline and certifies no one; the document describes no certification program and says only that it "may be used by nongovernmental organizations on a voluntary basis" (NIST SP 800-88 Rev. 2, 2025). A provider that calls itself "NIST certified" is describing its process, not a credential.

Ask for four things instead: the sanitization method per device (clear, purge or destroy); the tool used, including its version; the verification method, meaning how the provider confirmed each operation completed without errors; and a certificate of sanitization for each serial number rather than one letter covering the pallet.

The audit that does exist is of the facility. R2v3 certifies the whole operation, and SERI's guidance states that "An R2 Facility must be R2 Certified for all Process Requirements that it undertakes" (SERI, 2020). How to read a certificate's scope is explained on the R2v3 certification page.

Clear, purge and destroy

What is the difference between clear, purge and destroy?

Clear protects against simple recovery through the drive's normal interface, purge makes recovery infeasible even with laboratory techniques while leaving the media reusable, and destroy makes recovery infeasible and the media unusable. NIST's glossary definitions in Rev. 2 (NIST SP 800-88 Rev. 2, 2025):

NIST states a preference between the first two methods: "When possible, the purge sanitization method should be used instead of the clear sanitization method." The decision flow in Figure 1 starts by asking whether the media will be reused, then applies the security categorization (NIST's low, moderate and high confidentiality levels) and whether the media is leaving the organization's control, because "The decision process is based on the confidentiality of the information rather than the type of media." Purge and clear "may be more appropriate than destroy" when lease returns, environmental concerns, the cost of the media, or "the desire to reuse the ISM (either within the organization or by selling or donating the ISM)" are in play.

Does NIST 800-88 require 3 passes, and is DoD 5220.22-M still valid?

No. Rev. 2 states that for the clear method "multi-pass overwrite is not needed" and calls the DoD 5220.22-M pass requirements "obsolete" (NIST SP 800-88 Rev. 2, 2025). Section 3.1.1 gives the history: "In the past, hard drives were often erased using multiple overwrite passes (e.g., based on DoD 5220.22-M) with specific binary patterns (e.g., a pattern of all zeros). The number of passes ranged from a single pass to as high as 39."

Its footnote adds that DoD Manual 5220.22-M, the National Industrial Security Program Operating Manual (NISPOM), "is now Part 117 of Title 32, Code of Federal Regulations," and that "In 2006, DoD removed overwriting specifications from NISPOM." Part 117 was codified in December 2020 (32 CFR Part 117, 2020).

The earlier revision had already made the case for one pass on magnetic disks. Rev. 1 stated that "For storage devices containing magnetic media, a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data" (NIST SP 800-88 Rev. 1, 2014). Rev. 2 does not repeat that sentence. It adds that for certain media, "e.g., SSDs with overprovisioning," such practices "should be avoided as very little confidentiality protection is achieved." Extra passes cost time and do not lift the method above clear; if more assurance is needed, NIST's answer is purge or destroy.

Is degaussing NIST 800-88 compliant?

Degaussing is a purge technique for magnetic media only. It is not currently a destroy technique, and it must not be used on solid state drives. Rev. 2 states: "Degaussing should not be used for non-magnetic ISM (e.g., flash storage, such as SSDs)" and "At the time of this writing, degaussing is not considered an approved destroy sanitization technique" (NIST SP 800-88 Rev. 2, 2025).

The limits apply to magnetic drives too. Newer recording technologies use stronger magnetic force, which NIST calls higher coercivity, so many existing degaussers lack the strength to erase them. A degausser can also leave a drive unusable while failing to sanitize the data, which is why a dead drive after degaussing is not evidence of a sanitized drive. The change log says degaussing is not destroy "even when it renders an ISM inoperable."

The flash finding is older. Rev. 1 said in 2014 that degaussing "no longer applies in most cases for flash memory-based devices" (NIST SP 800-88 Rev. 1, 2014), and a 2011 University of California, San Diego study that degaussed flash chips at 14,000 gauss co-planar and 8,000 gauss perpendicular reported, "In all cases, the data remained intact" (Wei et al., USENIX FAST '11, 2011).

Is shredding a hard drive NIST 800-88 compliant?

Yes. Shredding is one of the five destroy techniques NIST defines, and destroy is the simplest route for media that will not be reused. Rev. 2 lists "Disintegrate," "Incinerate," "Melt," "Pulverize" and "Shred," the last defined as a "Process that destroys the media by cutting or tearing it into small particles" (NIST SP 800-88 Rev. 2, 2025). Section 4.3.3 adds that when media "is not intended for reuse within or outside of an organization due to damage or another reason, the simplest and most cost-effective sanitization method can be to destroy the media."

Rev. 2 attaches a caution. "As the density of data and the hardness of the component materials increase on an ISM, certain destructive techniques can become ineffective. Pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data." The concern is particle size: a flash chip that survives in one piece can hold a great deal of data. The standards NIST accepts for the technique itself, in Section 4.4, are IEEE 2883 and NSA/CSS Policy Manual 9-12, the National Security Agency's storage device sanitization manual.

Under R2v3, physical destruction sits under Core Requirement 7(c)(2)(B) rather than Appendix B: "Appendix B certification is not required for any physical destruction methods defined in the NIST Guidelines for Media Sanitization" (SERI, 2020).

Our own position, stated plainly: our R2v3 certificate currently covers logical data sanitization, test and repair, and the downstream recycling chain; drive shredding is performed in house and is not yet within that certificate's scope. We shred drives that fail sanitization or testing and drives whose owners require it, and we purge the rest so the hardware keeps its resale value. The certified data destruction page describes how each path is recorded against the serial number.

Sanitizing specific media

How do you wipe an SSD to NIST 800-88?

Use the drive's own dedicated sanitize command, which is a purge technique, and verify the result; do not rely on overwriting. Rev. 2 explains why: flash devices "that contain spare cells and perform wear levelling make it infeasible for a user to sanitize all previous data using this approach because the device cannot support directly addressing all areas in which sensitive data has been stored" (NIST SP 800-88 Rev. 2, 2025). A solid state drive (SSD) also holds overprovisioned capacity the host never sees, and people who kept applying magnetic-disk overwrite habits to flash "can be exposing their data to increased risk of unintentional disclosure."

The alternative is that "the ISM may support dedicated sanitize commands that address all storage areas more effectively." Rev. 2 does not name specific commands. It directs readers to IEEE 2883 for acceptable purge techniques, "which can include overwrite, block erase, and cryptographic erase using dedicated, standardized device sanitize commands." In the drive command sets, those are the Security Erase and Sanitize commands of the ATA specification for SATA drives and the Sanitize command of the NVMe specification; NIST leaves it to IEEE 2883 to say which qualify as purge for a given drive.

NIST adds that the commands "require trust and assurance from the ISM vendor that the commands have been implemented as expected." That caution has a documented basis. In the 2011 UC San Diego study, researchers tested 12 SSDs; 8 reported supporting the ATA SECURITY feature set, and of the 7 that could be checked, "only four executed the "ERASE UNIT" command reliably." One drive "reported that sanitization was successful, but all the data remained intact" (Wei et al., USENIX FAST '11, 2011).

The authors concluded that "each implementation of the security commands must be individually tested before it can be trusted to properly sanitize the drive." The drives are fifteen years old; the lesson is the one Rev. 2 formalizes as verification and validation.

In our facility, Averase, Coretek 360's sanitization tool, issues the drive's native sanitize command (NVMe Sanitize or ATA Security Erase, depending on the interface), reads back the completion status and drive health, and writes the method, technique, tool version and result to the record for that serial number. A drive that returns an error or fails verification does not enter a sales channel; it is shredded.

What is cryptographic erase, and when can you use it?

Cryptographic erase (CE) is a purge technique that destroys the encryption key rather than the data, so the ciphertext left on the drive cannot be decrypted. NIST's glossary defines it as "A purge sanitization technique in which key sanitization is applied to one or more keys providing confidentiality protections for the encrypted target data, making recovery of the decrypted target data infeasible" (NIST SP 800-88 Rev. 2, 2025). Only the key is sanitized, not the stored data, and for cloud or virtual storage NIST says it "may be the only viable purge sanitization technique option."

The conditions are strict. Rev. 2 states that ISO/IEC 27040 "specifies that no sensitive data has previously been stored on the ISM in plaintext form (i.e., not encrypted) as CE can only sanitize keys related to encrypted data." If a drive ran unencrypted before encryption was turned on, CE does not reach that data.

Escrowed keys are another problem: CE "should not be trusted on ISM that have been backed up or escrowed unless the organization has a high level of confidence regarding how and where the keys were stored and managed outside of the ISM." Federal agencies "must use encryption modules that have been validated to the current FIPS-140."

Rev. 2 also tightened the definitions, basing key sanitization on "ISO/IEC 19790 zeroization" and listing the acceptable key types. It notes one long-horizon caveat: if "computational capabilities (e.g., quantum computing) made it feasible to recover keys," the data could become recoverable, and "For such situations, CE may not be an acceptable sanitization technique." For data that must stay secret for decades, pair CE with block erase or choose destroy.

What is IEEE 2883, and how does it relate to NIST 800-88?

IEEE 2883-2022, "IEEE Standard for Sanitizing Storage," is the technical standard Rev. 2 points to for the sanitization techniques per media type; NIST sets the methods and the program, and IEEE 2883 supplies the technology-specific techniques. IEEE describes its scope as "Methods of sanitizing logical storage and physical storage, as well as providing technology-specific requirements and guidance for the elimination of recorded data." It was approved on June 16, 2022 and published on August 17, 2022 (IEEE SA, 2022).

The relationship is established on the NIST side. Rev. 2 states that "As storage technology evolves, these sanitization techniques need to be updated on a regular basis, so the latest version of standards (e.g., IEEE 2883) should be consulted," and Section 4.4 says sanitization should be performed "in a manner that complies with IEEE 2883" or another standard the organization approves, such as NSA/CSS Policy Manual 9-12 (NIST SP 800-88 Rev. 2, 2025). For a buyer, "NIST 800-88 compliant" now means a technique that IEEE 2883 or an approved standard accepts for that media, performed under NIST's method, verification and documentation rules. Ask your provider which edition of IEEE 2883 its tooling follows.

Proving it

What should a certificate of sanitization include?

A certificate of sanitization should be completed for each item of media and record what was sanitized, how, with what tool, how the result was verified, and who did it. Rev. 2 Section 4.6 states that "a certificate of sanitization (see Appendix C) should be completed for each ISM that has been sanitized, per the organization's policies," in paper or electronic form, and that "the certificate should record at least the following details" (NIST SP 800-88 Rev. 2, 2025):

• Manufacturer
• Model
• Serial number
• Organizationally assigned media or property number (if applicable)
• Media type (i.e., hard copy or ISM)
• Media source (e.g., user, computer)
• Pre-sanitization confidentiality categorization (optional)
• Sanitization method (i.e., clear, purge, destroy)
• Sanitization technique (e.g., degauss, overwrite, block erase, CE)
• Tool used, including version
• Verification method
• Information of individuals performing verification and validation: name, position or title, date, location, contact information, and signature

The sample form in Appendix C adds whether the unit was operational or damaged, a validation result, the media destination (internal reuse, external reuse, recycling facility, manufacturer, other), and a signature attesting "that the information provided on this statement is accurate to the best of my knowledge." NIST favors electronic records because they "will likely provide the fastest search capabilities and the best likelihood of being reliably retained."

The certificate has to reconcile against the inventory that left your building. Section 4.6 warns that if tracking breaks down earlier in the chain, "sanitization records will only show that specific ISM were sanitized and not whether the organization is effectively sanitizing all ISM that have been introduced into the operating environment." Coretek 360's per-serial certificate records the same fields NIST lists, and the NIST 800-88 compliance page shows how each one maps to Section 4.6.

Does HIPAA require NIST 800-88?

No. The HIPAA Security Rule requires disposal and media re-use procedures for electronic protected health information (ePHI) and names no standard for carrying them out. The regulation at 45 CFR 164.310(d)(2) reads: "(i) Disposal (Required). Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored," and "(ii) Media re-use (Required). Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use" (45 CFR 164.310).

NIST 800-88 enters through practice rather than regulation. Because the rule names no method, a covered entity has to show that the procedure it chose made the ePHI unrecoverable, and an auditor or breach investigator asks what that procedure was and what record proves it. Clear, purge or destroy under Rev. 2, with a certificate per serial number, is the answer that needs no further explanation. The HIPAA disposal requirements page walks through the device and media controls standard for a hospital or clinic refresh.

What happens if drives leave the building unsanitized?

The organization that owned the data is held responsible, and US penalties have run from about $1.2 million to $60 million over the past fifteen years. In each case the organization handed hardware to someone else without confirming the data was gone.

In September 2022 the SEC announced that Morgan Stanley Smith Barney LLC would pay a $35 million penalty for failures that began when the firm hired a moving and storage company with no data destruction experience to decommission thousands of hard drives and servers. That company sold the devices to a third party, some were resold on an internet auction site with unencrypted customer data, and "approximately 15 million customers" were affected. The firm also lost track of 42 servers during a hardware refresh. The SEC's enforcement director said, "MSSB's failures in this case are astonishing" (SEC, 2022).

In October 2020 the Office of the Comptroller of the Currency assessed a $60 million civil money penalty against Morgan Stanley Bank, N.A. and Morgan Stanley Private Bank, N.A. over the 2016 decommissioning of two data centers. The OCC found the banks "failed to adequately assess the risk of subcontracting the decommissioning work, including exercising adequate due diligence in selecting a vendor and monitoring its performance; and failed to maintain appropriate inventory of customer data stored on the decommissioned hardware devices" (OCC, 2020).

Healthcare has its own example. According to a summary by the law firm Hunton Andrews Kurth, HHS announced in August 2013 that Affinity Health Plan would pay $1,215,780 to settle allegations over ePHI left on the hard drives of leased photocopiers returned to the leasing company, affecting approximately 350,000 individuals; CBS News had purchased one of the returned copiers and found the data (Hunton Andrews Kurth, 2013). Copiers, printers and network gear are information storage media under Rev. 2 and belong on the same inventory as the servers.

How often does sanitization fail in practice?

Often enough that nearly a third of surveyed organizations cite a redeployed device or drive as a cause of a data leak. The Blancco 2026 State of Data Sanitization Report, based on fieldwork by Coleman Parkes in January and February 2026 among 1,460 cybersecurity, IT, compliance and sustainability leaders at enterprises of over 5,000 employees, found that 38% of organizations had suffered a data leak in the previous twelve months, and "redeployed devices or drives storing sensitive data" was cited as a cause by 32%.

The same survey measured the opposite failure, destroying hardware that still worked. It found that 43% of mobile devices, 35% of laptops and desktop PCs, and 44% of data center assets were still functional when they were destroyed. Software-based sanitization before disconnection was followed by only 32% of respondents for mobile devices, 18% for laptops and desktops, and 23% for data center assets (Blancco, 2026).

Those figures describe the same mistake from both ends. Working hardware is destroyed because nobody trusts the wipe, and drives wiped without a verified method leak anyway. A purge under Rev. 2, verified and recorded per serial, closes both gaps.

Related resources

• NIST 800-88 compliance at Coretek 360: how clear, purge and destroy are performed on each media type and how the certificate fields map to Section 4.6.
• Certified data destruction: logical sanitization, shredding for failed drives, and the serial-level record each path produces.
• R2v3 certification: what the standard audits, what our certificate covers, and how to read any provider's scope.
• NIST SP 800-88 Rev. 2 at the NIST Computer Security Resource Center: the official landing page with the full PDF, publication history and change log.

Still have questions?

Every fleet raises its own questions: self-encrypting drives with escrowed keys, leased units that must go back working, copiers nobody inventoried. Send a list of what you are retiring, with device types and the kind of data they held, through our contact page, and we will reply with a sanitization plan per device class and a quote.

Sources

• NIST, SP 800-88 Rev. 2, "Guidelines for Media Sanitization," September 2025 (landing page with the full-text PDF). https://csrc.nist.gov/pubs/sp/800/88/r2/final
• NIST, SP 800-88 Rev. 1, "Guidelines for Media Sanitization," landing page, December 2014 (withdrawn September 26, 2025). https://csrc.nist.gov/pubs/sp/800/88/r1/final
• Legal Information Institute, 45 CFR 164.310, HIPAA Security Rule physical safeguards. https://www.law.cornell.edu/cfr/text/45/164.310
• Legal Information Institute, 16 CFR 682.3, FTC Disposal Rule. https://www.law.cornell.edu/cfr/text/16/682.3
• Legal Information Institute, 16 CFR 314.4, GLBA Safeguards Rule. https://www.law.cornell.edu/cfr/text/16/314.4
• Legal Information Institute, 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), December 21, 2020. https://www.law.cornell.edu/cfr/text/32/part-117
• SERI, "R2v3 Appendix Applicability Guidance," version 2, October 19, 2020. https://sustainableelectronics.org/wp-content/uploads/2021/01/R2v3-Appendix-Applicability-Guidance-20.10.19.pdf
• IEEE Standards Association, IEEE 2883-2022, "IEEE Standard for Sanitizing Storage," August 17, 2022. https://standards.ieee.org/ieee/2883/10277/
• Wei, Grupp, Spada and Swanson, University of California, San Diego, "Reliably Erasing Data From Flash-Based Solid State Drives," USENIX FAST '11, February 2011. https://www.usenix.org/legacy/events/fast11/tech/full_papers/Wei.pdf
• IBM, "Cost of a Data Breach Report," 2026. https://www.ibm.com/reports/data-breach
• SEC, Press Release 2022-168, "Morgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information of Millions," September 20, 2022. https://www.sec.gov/news/press-release/2022-168
• OCC, News Release 2020-134, "OCC Assesses $60 Million Civil Money Penalty Against Morgan Stanley," October 8, 2020. https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-134.html
• Hunton Andrews Kurth, Privacy and Information Security Law Blog, "HHS Settles with Affinity Health Plan Over Photocopier Security Breach," August 15, 2013. https://www.hunton.com/privacy-and-cybersecurity-law-blog/hhs-settles-with-affinity-health-plan-over-photocopier-security-breach
• Blancco, "Blancco Report: Cybersecurity Anxiety is Driving Organizations Toward Costly Data Protection Measures," survey with Coleman Parkes (fieldwork January and February 2026, n=1,460), May 19, 2026. https://blancco.com/blancco-report-cybersecurity-anxiety-is-driving-organizations-toward-costly-data-protection-measures/