Media Sanitization: Ultimate Guide to NIST 800-88 Best Practices

Introduction

Every decommissioned hard drive, retired server, and replaced storage device carries residual data that poses a security risk if mishandled. Organizations face mounting pressure to protect sensitive information throughout the entire asset lifecycle, yet the gap between policy and practice remains wide. The consequences of inadequate data sanitization extend beyond theoretical risk—they manifest in regulatory fines, breach disclosures, and erosion of stakeholder trust.

NIST Special Publication 800-88, Guidelines for Media Sanitization, establishes the framework federal agencies and private organizations rely on to ensure data cannot be recovered from retired media. The standard describes media sanitization as a process that renders access to target data infeasible for a given level of effort. This definition acknowledges that absolute certainty is unattainable; instead, the standard focuses on raising the cost and complexity of recovery beyond practical thresholds.

In our editorial review of vendor profiles, we noticed a recurring pattern: the certificate of data destruction referenced in marketing material often differed structurally from the certificate outlined in the vendor's published methodology. This discrepancy underscores why understanding what NIST 800-88 actually prescribes matters. The standard does not mandate a single approach but rather provides a tiered framework—clear, purge, and destroy—that organizations must map to their specific risk profiles and regulatory obligations. Choosing the wrong method, or failing to verify its execution, transforms compliance documentation into liability evidence. The Morgan Stanley case illustrates how chain-of-custody failures compound when sanitization controls are absent.

This guide examines the structure of NIST 800-88, the technical distinctions between sanitization methods, and the operational decisions that determine whether your data destruction program satisfies auditors or exposes your organization to avoidable risk. The goal is not to repeat the standard's text but to clarify how it applies when IT assets move from production to disposal.

Explore nist 800-88, the standard for data sanitization, and understand its implications for effective media sanitization.

Understanding NIST 800-88

NIST Special Publication 800-88 is the federal standard that defines how organizations should sanitize data-bearing media before disposal, reuse, or release from controlled environments. Originally published by the National Institute of Standards and Technology, the framework addresses a fundamental question: how do you prove that sensitive data has been rendered unrecoverable?

The standard establishes three distinct sanitization outcomes—Clear, Purge, and Destroy—each calibrated to different threat models and media lifecycles. This tiered approach allows organizations to match sanitization rigor to data sensitivity and intended media disposition, rather than applying a one-size-fits-all destruction method.

Why NIST 800-88 Matters for Media Sanitization

Without a shared framework, every vendor, auditor, and compliance officer operates from different assumptions about what "secure deletion" actually means. NIST 800-88 provides that common language. It distinguishes between methods that protect against casual data recovery (Clear), those that resist laboratory-grade forensic analysis (Purge), and physical destruction that renders media unusable (Destroy).

For organizations managing decommissioned hardware, the standard answers critical questions: Can this drive be safely resold? Does cryptographic erasure meet our regulatory obligations? When is physical shredding the only acceptable option? These decisions carry real financial and legal consequences, as demonstrated by high-profile vendor failures where inadequate chain-of-custody documentation led to regulatory penalties.

The Three-Tier Framework

The core structure of NIST 800-88 is its three-level taxonomy. Clear methods protect against non-invasive data recovery attempts—think software-based file recovery tools. Purge methods defend against state-of-the-art laboratory techniques, including direct access to storage chips or magnetic force microscopy. Destroy methods physically alter the media so that no data recovery is possible, regardless of resources applied.

Each tier maps to specific technical methods. Clear typically involves logical overwriting or block erase commands. Purge may use cryptographic erasure (for self-encrypting drives), degaussing (for magnetic media), or secure erase commands that reach reserved areas. Destroy means disintegration, pulverization, melting, or incineration—methods that leave no intact storage surface.

The framework does not prescribe a single "correct" method. Instead, it requires organizations to assess data sensitivity, evaluate the threat model, and document the chosen sanitization approach. This risk-based flexibility is both the standard's strength and the source of common implementation gaps—vendors may claim compliance while applying Clear methods to media that regulators expect to be Purged or Destroyed.

Media Sanitization Methods

NIST 800-88 categorizes media sanitization into three escalating levels: Clear, Purge, and Destroy. Each method corresponds to a different intensity of data removal, designed to help organizations choose an approach based on data confidentiality and the intended disposition of the media. Understanding these methods is essential for operators who need to balance security requirements with asset recovery goals.

Clear: Logical Sanitization for Standard Reuse

Clear is the least intensive sanitization method and relies on logical techniques to render data inaccessible through standard system interfaces. This typically involves overwriting all addressable storage locations with non-sensitive data using software commands. Clear is suitable for legacy magnetic hard disk drives (HDDs) where single-pass overwrites can reach all sectors, and the media will be reused in environments with equivalent or lower security requirements.

The method assumes that data recovery would require forensic techniques beyond the capability of typical users. However, Clear is not appropriate for media that will leave organizational control or for storage technologies where logical commands cannot guarantee complete coverage—such as modern SSDs with wear-leveling algorithms or devices with hidden service areas.

Purge: Cryptographic and Physical Techniques for High Assurance

Purge represents a more rigorous sanitization approach, intended to protect against state-of-the-art laboratory attacks. This method employs techniques such as cryptographic erasure (destroying the encryption key on self-encrypting drives), degaussing (for magnetic media), or block erase commands (for flash-based storage). Purge is the recommended method for modern SSDs and NVMe drives, where wear-leveling and over-provisioning can leave data remnants that Clear-level overwrites cannot reach.

Cryptographic erasure is particularly efficient: if the entire volume was encrypted from the start and the encryption key is securely destroyed, the data becomes computationally infeasible to recover. Purge allows media to be reused outside the organization or in lower-security contexts, provided the purge process is validated and documented.

Destroy: Physical Disintegration for Maximum Assurance

Destroy involves physical techniques that render the media unusable: shredding, disintegration, pulverizing, melting, or incineration. This method is reserved for media containing highly sensitive data that cannot tolerate any residual risk, or for devices where Clear and Purge cannot be reliably applied—such as damaged drives, proprietary storage formats, or devices with embedded firmware that resists sanitization commands.

Destruction eliminates the possibility of data recovery but also eliminates any asset recovery value. The choice to destroy should be deliberate, guided by data classification and regulatory requirements rather than default policy. Operators should document the destruction process with serial-level chain-of-custody records, especially when third-party vendors perform the physical destruction.

Selecting the Right Method for Media Type

The appropriate sanitization method depends on both the storage technology and the data's sensitivity. Magnetic HDDs with simple block addressing can often be cleared with a single-pass overwrite. Solid-state drives, NVMe devices, and hybrid storage require purge-level techniques due to their internal architecture. Devices with embedded systems—routers, printers, multifunction devices—may require firmware resets combined with physical destruction of non-volatile memory chips, as logical commands alone can leave configuration data intact.

Organizations should maintain a media sanitization matrix that maps device types to approved methods, validated through testing and updated as new storage technologies emerge. The matrix should reference specific tools, commands, and verification procedures for each category.

Purge vs Clear: NIST Definitions

NIST 800-88 establishes two primary sanitization categories that differ fundamentally in rigor and intended use: Clear and Purge. The distinction is not semantic—it reflects different threat models and recovery resistance thresholds. Clear methods protect against standard data recovery tools; Purge methods defend against state-level laboratory analysis.

Clear: Standard Overwrite for Controlled Reuse

Clear sanitization applies logical techniques—typically overwrite passes using vendor utilities or approved software—to render data unrecoverable by keyboard-accessible tools. This category assumes the media remains within a controlled environment where physical access is restricted and the threat actor lacks specialized equipment. Clear is appropriate when devices move between departments inside the same organization or when redeploying assets to users with equivalent clearance levels.

The method works by writing new data patterns over every addressable sector. For magnetic hard drives, a single-pass overwrite generally suffices under NIST guidance, though legacy standards like DoD 5220.22-M specified multiple passes. Solid-state drives introduce complexity: wear-leveling and over-provisioning mean logical addressing may not reach all physical cells, reducing Clear effectiveness unless combined with cryptographic erasure.

Purge: Laboratory-Resistant Sanitization for External Disposition

Purge methods employ physical or cryptographic techniques designed to resist recovery even when an adversary has unlimited time, funding, and access to forensic laboratories. NIST 800-88 recommends Purge when disposing of assets outside your controlled environment, especially for media that held regulated data: client records, employee personally identifiable information, protected health information, or classified material.

Purge techniques include:

• Cryptographic Erase: Deleting the encryption key when the entire volume was encrypted with a FIPS-validated algorithm. The ciphertext remains, but without the key, data is computationally infeasible to recover.
• Degaussing: Applying a magnetic field strong enough to randomize the magnetic domains on tape or legacy spinning drives. Degaussing renders the media unusable afterward.
• Physical Destruction: Shredding, crushing, disintegration, or incineration to a particle size that precludes data reconstruction.

The choice of Purge method depends on media type and reuse intent. Cryptographic erase allows the device to remain functional; degaussing and physical destruction do not.

Decision Framework: Sensitivity and Destination

The standard's decision tree hinges on two variables: data classification and asset destination. If the media contained confidential, regulated, or high-impact data and will leave your physical or administrative control, Purge is mandatory. If the data was low-sensitivity and the device remains on-site under equivalent access controls, Clear may suffice.

Misapplying Clear when Purge is required creates the exact exposure documented in regulatory enforcement actions. When a vendor receives equipment assumed sanitized but recovers data with standard tools, the failure is structural: the method did not match the risk. Purge is recommended when disposing of assets outside your controlled environment, especially for sensitive data like client records or employee data.

Implications of NIST 800-88

NIST 800-88 carries significant weight for organizations managing sensitive data. The standard establishes a technical baseline that maps directly to regulatory compliance obligations across multiple frameworks. When an organization adopts NIST 800-88 protocols, it simultaneously addresses requirements embedded in HIPAA, GDPR, PCI-DSS, and CPRA. This alignment reduces the compliance surface area — instead of maintaining separate sanitization procedures for each regulation, a single NIST-compliant program satisfies overlapping data-destruction mandates.

The standard's implications extend beyond regulatory checkboxes. Organizations that implement NIST 800-88 create defensible documentation trails that withstand scrutiny during audits and breach investigations. The framework's tiered approach — clear, purge, and destroy — provides a decision matrix that connects data classification to sanitization rigor. When an incident occurs, this documented decision logic demonstrates that the organization applied appropriate controls proportional to the data's sensitivity.

Risk Assessment as the Foundation

NIST 800-88 does not prescribe a one-size-fits-all solution. Instead, it requires organizations to perform thorough risk assessments before selecting sanitization methods. This assessment process forces operators to inventory their data holdings, classify information by sensitivity, and evaluate the threat landscape specific to their environment. The standard recognizes that a financial institution's risk profile differs materially from a healthcare provider's, and sanitization decisions must reflect those differences.

Risk assessment under NIST 800-88 involves identifying the data's confidentiality impact level, the media type storing that data, and the intended disposition path. A drive containing customer financial records destined for resale demands purge-level sanitization at minimum. The same drive headed for physical destruction may justify a less intensive clear operation if the destruction process itself provides sufficient assurance. The standard's flexibility allows organizations to calibrate their approach, but it also places the burden of justification squarely on the data custodian.

Operational and Financial Implications

Adopting NIST 800-88 introduces operational complexity. Organizations must maintain current inventories of media types, track which sanitization methods apply to each, and ensure personnel understand the distinctions between clear and purge. This requires training, process documentation, and periodic audits to verify adherence. The standard's technical specificity — referencing overwrite passes, cryptographic erasure, and physical destruction parameters — demands that IT and security teams stay current with evolving storage technologies.

Financially, NIST 800-88 compliance shifts costs from reactive breach response to proactive risk mitigation. Implementing compliant sanitization programs requires investment in validated tools, third-party certifications, and chain-of-custody systems. However, these upfront costs pale against the potential exposure from inadequate sanitization. The Morgan Stanley case illustrates the long tail of non-compliance: regulatory fines, customer notification expenses, and reputational damage that compounds over years.

Implications for Vendor Management

For organizations outsourcing media sanitization, NIST 800-88 establishes the baseline for vendor evaluation. The standard provides a common language to assess whether a vendor's advertised capabilities match their operational reality. Contracts should specify which NIST sanitization tier applies to each media category, require documentation of the methods used, and mandate chain-of-custody records that trace each asset from handoff to final disposition.

The standard also exposes gaps in vendor claims. A certificate stating "NIST 800-88 compliant" without specifying the sanitization method (clear, purge, or destroy) and the validation mechanism is insufficient. Organizations must verify that vendors apply the appropriate method for the data sensitivity level and can produce auditable evidence of execution. This level of scrutiny is not optional — it is the core implication of adopting NIST 800-88 as an organizational standard.

Choosing the Right Sanitization Methods

Selecting the appropriate media sanitization method is not a one-size-fits-all decision. Organizations must match the sanitization technique to the sensitivity of the data, the media type, and the intended disposition of the asset. NIST 800-88 provides a framework for this decision, but the standard leaves considerable discretion to the data owner—which means the burden of classification and method selection falls squarely on your organization.

Start with Data Classification

Before any sanitization occurs, you must know what data lives on the media. Define clear categories that trigger specific sanitization requirements. Highly sensitive data—personally identifiable information (PII), protected health information (PHI), financial records, or intellectual property—typically warrants Purge or Destroy methods. Less sensitive data, such as internal documents destined for redeployment within a controlled environment, may be acceptable for Clear methods.

The classification step is where most organizations stumble. Without a documented taxonomy that maps data types to sanitization methods, you're left making ad hoc decisions under time pressure. Establish a written policy that answers: What data triggers Purge? What data permits Clear? What scenarios require physical destruction? This policy becomes the foundation of your compliance posture.

Match Method to Media Type and Reuse Intent

Once you've classified the data, consider the media type and what happens next. A hard drive destined for internal redeployment may be a candidate for Clear (cryptographic erase or a single overwrite pass), provided the data was low-risk. The same drive leaving your custody—sold, donated, or recycled—should be Purged or Destroyed, regardless of data sensitivity, because you lose control of the verification chain.

For solid-state drives, the calculus shifts. Wear-leveling and over-provisioning mean that software overwrites may miss data in reserved areas. Cryptographic erase is the preferred Purge method for SSDs, but only if the drive's firmware is trustworthy and the encryption was enabled from the start. When in doubt, physical destruction is the only method that guarantees data inaccessibility across all SSD architectures.

Mobile devices, network equipment, and embedded systems present their own challenges. Factory resets often leave configuration data, certificates, or logs intact. For these assets, network switches in particular have demonstrated that "successful" sanitization commands can still leave recoverable data. The safest approach for high-risk embedded media is physical destruction or, at minimum, a vendor-specific secure-erase utility verified through independent testing.

When to Escalate to Physical Destruction

Physical destruction is the fail-safe. If the data is highly sensitive, if the media type is difficult to verify (proprietary firmware, unknown wear state), or if the asset is leaving your chain of custody without ongoing oversight, Destroy is the conservative choice. Shredding, disintegration, and incineration eliminate the possibility of data recovery, but they also eliminate reuse value and generate disposal costs.

The decision to destroy should be deliberate, not reflexive. For organizations with robust asset tracking and verified sanitization processes, Purge methods can deliver equivalent data security while preserving the residual value of the hardware. The key is documentation: if you can't produce a serialized record showing that a specific drive was Purged using a verified method, destruction may be the only defensible path.

The cheapest sanitization method is the one you can prove worked when the auditor asks.

Case Studies and Examples

Real-world failures demonstrate why NIST 800-88 compliance cannot be treated as a checkbox exercise. The consequences of inadequate media sanitization extend beyond regulatory fines—they erode customer trust, trigger litigation, and expose organizations to years of remediation costs.

The Morgan Stanley Case: A $100M+ Lesson in Chain-of-Custody Failure

Morgan Stanley's 2016 data center decommissioning remains the canonical example of ITAD failure. The firm hired a moving company—not an ITAD specialist—to decommission equipment containing unencrypted client data. The subcontractor failed to sanitize devices before resale, and hard drives containing personal information for millions of customers appeared on auction sites.

The breach triggered a cascade of consequences: a $60 million settlement with the Office of the Comptroller of the Currency, a $35 million class-action settlement, and years of reputational damage. The core failure was not technical—it was contractual and procedural. Morgan Stanley lacked enforceable chain-of-custody documentation and failed to verify that the vendor followed any recognized sanitization standard.

This case underscores a principle embedded in NIST 800-88: sanitization is not a one-time event but a documented process with verifiable outcomes at every handoff. When chain-of-custody documentation fails, the entire compliance framework collapses.

Private-Sector Adoption of NIST 800-88

While NIST 800-88 was developed for federal agencies, it has become the de facto standard in the private sector. Organizations across healthcare, finance, and technology reference NIST 800-88 in vendor contracts, audit frameworks, and incident response plans. The standard's three-tier taxonomy—Clear, Purge, Destroy—provides a common language for specifying sanitization requirements without prescribing specific tools or techniques.

This flexibility allows organizations to adapt the framework to evolving storage technologies while maintaining a consistent risk-management posture. However, flexibility also creates ambiguity. A contract that simply requires "NIST 800-88 compliance" without specifying the sanitization tier, verification method, or documentation format leaves room for misalignment between buyer expectations and vendor execution.

Evaluating ITAD Providers: A Practical Checklist

When selecting an ITAD vendor, the gap between marketing claims and operational reality becomes visible only through structured evaluation. NIST 800-88 provides the framework, but enforcement requires specific documentation and third-party validation.

These steps align with the evidence-gathering approach required for regulatory audits. If a vendor cannot produce documentation that survives scrutiny during the contracting phase, the same gaps will reappear during an incident investigation.

Frequently Asked Questions about NIST 800-88

What is the difference between NIST 800-88 Revision 1 and Revision 2?

NIST 800-88 Revision 2 supersedes Revision 1, which was published in December 2014. The updated publication refines guidance on media sanitization methods and reflects advances in storage technology. Organizations working with current hardware should reference Revision 2 to ensure their sanitization practices align with the most recent federal standard.

When should I use Clear versus Purge?

The choice between Clear and Purge depends on the sensitivity of the data and whether the media will remain within a protected environment. Clear methods apply logical techniques that prevent standard data recovery tools from reconstructing information, suitable when media stays under organizational control. Purge methods employ more rigorous processes—physical or cryptographic—designed to protect against state-level adversaries and laboratory-grade recovery attempts. Understanding the technical distinction between Clear and Purge is critical for maintaining compliance and preventing catastrophic data breaches during hardware decommissioning.

Does NIST 800-88 apply to cloud storage?

NIST 800-88 primarily addresses physical media—hard drives, SSDs, magnetic tapes, and removable devices. Cloud storage introduces a layer of abstraction where the customer does not control the underlying hardware. Organizations relying on cloud providers should verify that the provider's data-destruction practices align with NIST principles, particularly for cryptographic erasure and the destruction of encryption keys. Contractual language should specify sanitization methods and require documentation equivalent to what NIST 800-88 prescribes for physical media.

What documentation should I expect after sanitization?

A compliant sanitization process generates a certificate of destruction or erasure that includes the serial number of each asset, the method applied (Clear, Purge, or Destroy), the date of sanitization, and the identity of the party performing the work. In editorial reviews of vendor profiles, certificates referenced in marketing material sometimes differ structurally from those outlined in published methodologies. Operators should request sample certificates during the vendor-selection process and confirm that the format matches regulatory expectations and internal audit requirements. For more on vendor verification, see The ITAD Industry's 30-Year Verification Gap — And the Three-Layer Platform Closing It.

Is degaussing still a valid Purge method?

Degaussing remains a valid Purge method for magnetic media, including traditional hard drives and tapes. However, it is ineffective against solid-state drives, which store data using electrical charges rather than magnetic fields. Organizations must match the sanitization method to the media type; applying degaussing to an SSD provides no security benefit and creates a false sense of compliance.

Can I reuse media after applying a Clear method?

Yes. Clear methods are explicitly designed to enable media reuse within the same organization or security domain. After clearing, the media can be repurposed for lower-sensitivity workloads or redeployed to other users within the protected environment. Purge methods also allow reuse in many cases, though Destroy methods—such as shredding—render the media permanently unusable.

What happens if I skip sanitization?

Skipping sanitization exposes the organization to data breaches, regulatory penalties, and reputational harm. Unsanitized media that enters secondary markets or disposal streams can be acquired by adversaries who extract residual data using forensic tools. The consequences scale with the sensitivity of the data: a breach involving customer records, health information, or financial data triggers mandatory disclosure, regulatory investigation, and often significant financial liability.

Best Practices for Compliance with NIST 800-88

Compliance with NIST 800-88 is not a one-time checkbox exercise. It requires systematic planning, execution, and documentation across the entire lifecycle of media sanitization. Organizations that treat the standard as a living framework—rather than a static policy document—are better positioned to satisfy regulatory requirements and withstand audit scrutiny.

Conduct Thorough Risk Assessments Before Sanitization

Before selecting a sanitization method, perform a risk assessment that accounts for the sensitivity of the data, the type of media, and the threat model relevant to your organization. NIST 800-88 emphasizes that the choice between Clear, Purge, and Destroy should be driven by the confidentiality impact level of the information. High-value data on SSDs, for example, may require cryptographic erasure followed by physical destruction, while low-sensitivity data on magnetic drives may be adequately addressed through software-based overwriting.

Risk assessments should be documented and revisited whenever media types, data classifications, or regulatory obligations change. This ensures that your sanitization procedures remain aligned with both the standard and the evolving threat landscape.

Establish Clear Chain-of-Custody Documentation

Chain-of-custody documentation is the operational backbone of NIST 800-88 compliance. Every asset that contains or has contained sensitive data must be tracked individually—from the moment it leaves active service to final disposition. Serial numbers, asset tags, data classification labels, and timestamps should be recorded at each transfer point.

When engaging third-party vendors, ensure that custody logs are integrated into the vendor's reporting system. Gaps in the chain—such as batch-level tracking instead of serialized records—create audit exposure. The R2v3 Certification: The Ultimate Guide to Costs and Easy Verification framework provides additional context on how certification standards intersect with chain-of-custody requirements.

Align Sanitization Methods with Regulatory Frameworks

NIST 800-88 serves as the technical foundation for media sanitization, but organizations must also map its methods to the specific requirements of HIPAA, GDPR, PCI-DSS, and CPRA. Strict compliance with NIST 800-88 helps organizations satisfy these frameworks by ensuring that data destruction is both effective and auditable.

For example, HIPAA's disposal rule requires that electronic protected health information be rendered unreadable and indecipherable. A Purge-level sanitization method—such as cryptographic erasure or degaussing—meets this standard, while a Clear-level method may not. Similarly, GDPR's right to erasure demands that personal data be irretrievably destroyed when no longer needed, which aligns with the Purge or Destroy categories.

Maintain a compliance matrix that maps each regulatory obligation to the corresponding NIST 800-88 method. This document becomes a reference point during audits and demonstrates that your sanitization program is designed to meet multiple frameworks simultaneously.

Verify Vendor Capabilities and Certifications

When outsourcing media sanitization, verify that the vendor's documented methodology aligns with NIST 800-88 and that their certifications are current and relevant. Request copies of the vendor's sanitization procedures, equipment specifications, and sample certificates of destruction. Compare these documents against the vendor's public claims to identify any discrepancies.

In our editorial review of vendor profiles, we have observed that the certificate of data destruction referenced in marketing material often differs structurally from the certificate outlined in the vendor's published methodology. This gap is not always evidence of fraud, but it signals the need for closer due diligence. Ask vendors to clarify which methods—Clear, Purge, or Destroy—they apply to each media type, and confirm that their equipment is calibrated and maintained according to manufacturer specifications.

Implement Continuous Monitoring and Periodic Audits

Compliance is not static. Establish a schedule for internal audits that reviews sanitization logs, chain-of-custody records, and vendor performance. Periodic audits should also assess whether your risk assessments remain accurate in light of new threats, media types, or regulatory changes.

Consider engaging third-party auditors to validate your sanitization program annually. Independent verification adds credibility to your compliance posture and can surface procedural weaknesses before they become audit findings.

Conclusion

NIST 800-88 provides the definitive framework for media sanitization, rendering access to target data infeasible for a given level of effort. The standard's distinction between Clear, Purge, and Destroy methods gives organizations a structured decision tree anchored to data sensitivity and threat model. When applied correctly, these techniques protect against both casual recovery and laboratory-grade reconstruction attempts.

Compliance with NIST 800-88 is not a one-time checkbox. It demands documented chain-of-custody, validated sanitization processes, and continuous alignment between policy and practice. The standard's wide adoption across both federal agencies and the private sector underscores its role as the benchmark for secure data destruction. Organizations that treat the framework as a living operational discipline — rather than a procurement formality — close the gap between stated methodology and verifiable outcomes.

In our editorial review of vendor profiles, we noticed a recurring pattern: the certificate of data destruction referenced in marketing material often differed structurally from the certificate outlined in the vendor's published methodology. This discrepancy highlights why understanding what NIST 800-88 actually prescribes matters. The choice between Purge and Clear should be guided by the sensitivity of the data and the potential risk of exposure, not by convenience or cost alone. When you evaluate a vendor or design an internal process, The ITAD Industry's 30-Year Verification Gap — And the Three-Layer Platform Closing It offers a framework for closing the loop between claims and evidence.

Media sanitization is a technical discipline with compliance, financial, and reputational stakes. NIST 800-88 gives you the standard; execution determines whether it protects you or becomes another line in an incident report.