Media Sanitization: What NIST 800-88 Rev. 2 Changed
NIST SP 800-88 Rev. 1 was withdrawn in September 2025. Rev. 2 removed almost all of the verification language — which makes per-asset evidence the buyer's requirement, not NIST's.
What Revision 2 changed
NIST Special Publication 800-88 is the federal guideline for media sanitization — the process of rendering data on storage media infeasible to recover for a given level of effort. It is the document that procurement language, internal policy and vendor marketing have leaned on for a decade, usually by name alone. Revision 2 was published in September 2025. Revision 1, published in December 2014, was withdrawn on 26 September 2025 and superseded in its entirety.
Most coverage of that event describes an update. The change that matters to anyone buying disposition services is a removal. Rev. 2 §4.5.1 states that elaborate sampling after a clear or purge “is not necessary” unless organizational policy requires it, and the Appendix D change log records that almost all verification language was removed from the document.
A great deal of procurement language was written against the Rev. 1 text. A clause requiring sanitization “verified per NIST 800-88” was, under Rev. 1, asking for a step the standard described. Under Rev. 2 it asks a vendor to perform a step the cited standard no longer contains. The clause has not become stricter or weaker. It has become unanchored — it points at a document that no longer says the thing it is relying on.
What the removal does not mean
Rev. 2 does not say verification is worthless and it does not prohibit sampling. It says NIST no longer prescribes it, and defers the decision to organizational policy. Per-asset evidence remains the only practical way to demonstrate that a disposition happened as documented, and an auditor asking what became of a specific serial number will not be satisfied by a framework reference.
What changed is the source of authority. The requirement is now yours. If you want it, you write it down as yours — in your policy, and in the contract — rather than importing it by citation.
The three methods, as Rev. 2 defines them
The standard defines three sanitization categories. They form an ordered scale of adversary capability, not a sequence of steps:
- Clear — logical techniques applied through the medium's standard read, write and reset commands, operating on user-addressable storage locations. Protects against simple, non-invasive recovery using commercially available software.
- Purge — physical or logical techniques that render recovery infeasible using state-of-the-art laboratory techniques. This is the threshold to name when media carrying confidential data leaves your control.
- Destroy — renders the medium itself unusable through shredding, disintegration, pulverization or incineration. The option when the medium cannot be reliably sanitized by any other means, or when policy forbids residual risk regardless of technical feasibility.
Clear defends against recovery software. Purge defends against a laboratory. Destroy removes the question by removing the medium. Two organizations retiring identical drives can correctly land on different methods, because the input to the decision is the confidentiality of the data and the security of where the medium is going — not the drive model.
That last check is where most programmes come apart, because the method and the medium do not always agree.
Where the method and the medium disagree
Solid-state media
Flash storage does not write where the host thinks it writes. Wear-levelling spreads writes across the array, over-provisioned capacity is held back from the addressable range entirely, and the controller remaps blocks as they degrade. An overwrite issued through standard commands reaches user-addressable locations — and nothing else.
Rev. 2 §4.5.2 names precisely that gap as a red flag when validating a sanitization claim. Over-provisioned blocks, metadata, cache and unallocated NVM sit outside the scope of a user-addressable overwrite, and a technique whose scope stops at the addressable range has not been shown to have reached the data.
Three approaches survive that objection. Cryptographic erase, where the medium was encrypted throughout its operational life and the key destruction is itself evidenced. The device's own sanitize command, where you can confirm the controller executed it rather than merely accepted it. Or destruction.
Magnetic media
Rotating media is the well-understood case. Overwriting works, and a single pass is sufficient on any contemporary drive when it completes and covers the full addressable range. Multi-pass overwrite patterns are a legacy of recording densities two generations gone; they cost time and buy nothing. Degaussing is effective on magnetic media and does nothing whatever to flash.
Embedded and network storage
Switches, routers, multifunction printers, phones and appliances hold non-volatile storage that no drive-oriented procedure will find: configuration memory, firmware storage, hidden partitions and service areas. A factory reset is a convenience feature, not a sanitization method — device configuration frequently survives one and is recoverable with ordinary tools. Inventory every storage location inside a device, not only its primary volume.
Configuration recovered from a resold network switch is a case we have written up in full.
Certification is not scope
A vendor holding R2v3, e-Stewards or NAID AAA has cleared a bar. Which bar depends on which appendices the certificate actually covers, and a badge on a website does not say.
R2v3 Appendix B covers data sanitization. Appendix B(13) requires sampling sufficient to demonstrate that data is “not recoverable by commercial software.” SERI's own guidance places commercial software “at a level between basic visual inspection for data and forensic laboratory analysis.” That is the Clear threshold. Purge, in both NIST SP 800-88 Rev. 2 and IEEE 2883-2022, is defined against state-of-the-art laboratory techniques.
Appendix B(11)(a) scopes its requirement to user-addressable locations — the same limit Rev. 2 §4.5.2 flags as a validation red flag on solid-state media.
For a tender that means certification and assurance level are two separate lines. “The vendor holds current R2v3” and “the work is performed to an SP 800-88 Rev. 2 Purge” are different asks, and a bidder who satisfies the first has not thereby satisfied the second.
A third line is worth adding: which facility performs the work, and does that facility hold sanitization scope. A vendor without Appendix B is not necessarily unable to destroy data — under SERI's guidance, basic physical destruction can be performed under Core Requirement 7, and sanitization can be outsourced to a qualified downstream vendor. What the absence means is that the enhanced controls, traceability and record-keeping of that appendix do not apply, so a buyer who needs them has to ask where the work is actually done.
Writing verification in, now that NIST does not
Because Rev. 2 defers to organizational policy, the evidence you receive is the evidence you asked for. Four lines do most of the work.
Step 1
Name the revision
Write “NIST SP 800-88 Rev. 2” rather than “NIST 800-88.” The unqualified form now names two documents that disagree, and in a dispute the vendor gets to pick which one they meant.
Step 2
Name the assurance level per lot
Clear, Purge or Destroy, stated against the data classification of that lot rather than applied flat across the engagement. A rack of scrap chassis and a tray of drives out of a claims system do not warrant the same threshold, and pricing one at the other's level wastes money in one direction or accepts risk in the other.
Step 3
Ask for per-asset evidence in your own words
A serialised certificate of sanitization for each data-bearing asset, carrying make, model and serial; the technique applied and the NIST category it maps to; the date; the operator or facility identity; and the outcome. State it as your requirement. Do not attribute it to NIST, because Rev. 2 no longer asks for it on your behalf.
A batch certificate covering a pallet is not auditable against an asset register. It records that something was done to a quantity of things.
Step 4
Name the facility
Which processing location does the work, whether it is owned, leased or subcontracted, and whether that location — not the corporate entity — holds the sanitization scope. A subcontractor is not a mark against a vendor; an undisclosed one is.
| Documentation element | Common practice | What survives an audit |
|---|---|---|
| Standard cited | NIST 800-88 | NIST SP 800-88 Rev. 2, revision named in the contract |
| Assurance level | “Secure data destruction” | Clear, Purge or Destroy, stated per lot |
| Asset identification | Model and quantity | Make, model and serial per unit |
| Method record | Certificate of destruction | Technique applied, mapped to its NIST category |
| Verification evidence | Vendor attestation | The evidence you specified: sampling results, destruction imagery, or a key-destruction record |
| Facility | Vendor name | Processing location named; owned or subcontracted declared |
| Custody | Pickup receipt | Signature and timestamp at every transfer |
What a failed disposition has cost
Morgan Stanley decommissioned two data centres and lost track of the devices. Drives left the premises and were resold with data still on them; the records could not establish what had been sanitized, by whom, or which assets were unaccounted for. The failure was not a sanitization technique that underperformed. It was a chain of custody that could not answer the question.
Four separate proceedings followed, against two different groups of Morgan Stanley entities:
- 2020 — a $60 million Office of the Comptroller of the Currency civil money penalty against Morgan Stanley Bank, N.A. and Morgan Stanley Private Bank, N.A. (OCC news release 2020-134).
- 2022 — a $60 million class action settlement against Morgan Stanley Smith Barney LLC, final approval 5 August 2022 (S.D.N.Y., No. 1:20-cv-05914).
- 2022 — a $35 million SEC enforcement action against Morgan Stanley Smith Barney LLC (SEC press release 2022-168).
- 2023 — a $6.5 million multistate attorneys general settlement against Morgan Stanley Smith Barney LLC (N.Y. Attorney General, November 2023).
Those four figures sum to $161.5 million. No single source reports that total — it aggregates four different kinds of liability across two different groups of entities — which is why the itemization is worth carrying rather than the round number. We have written the case up in full separately.
Common mistakes
Citing the standard without the revision
The most common defect in circulation, and the one that quietly propagates. A policy written in 2019 says “NIST 800-88” and meant Rev. 1. Read in 2026 it appears to say Rev. 2. Nobody edited anything; the referent moved.
Treating certification as scope
“Our vendor is R2v3 certified” answers a different question from “does the facility handling our drives hold sanitization scope, and to what assurance level.” Ask the second one.
Applying drive procedure to flash
An overwrite routine validated on rotating media, applied unchanged to SSDs, produces a clean log and an unexamined remainder. The log is not wrong about what it did. It is silent about what it could not reach.
Accepting a batch certificate for regulated data
A certificate covering “47 hard drives” cannot be reconciled against an asset register that lists 47 serial numbers. If the two cannot be matched, the register is the thing an auditor will test and the certificate is the thing that fails.
Ignoring internal transfers
Media moving between security domains inside the organization — a drive reassigned from finance to a general engineering pool — is a sanitization decision on the same terms as external disposal. Confidentiality of the data and security of the destination determine the method; whether the medium crosses the company boundary does not enter into it.
Having no exception path
Sanitization fails. A drive will not power on, a sanitize command reports an error, verification comes back inconclusive. The escalation is upward — if Clear fails, Purge; if Purge fails, Destroy — and the medium is not released, reused or returned until a method has succeeded. Document the failure and check what else went through the same method on the same equipment, because a failure that is really an equipment fault is never a single failure.
Frequently asked questions
What changed between Rev. 1 and Rev. 2?
Rev. 2 was published in September 2025. Rev. 1, from December 2014, was withdrawn on 26 September 2025 and superseded in its entirety. The substantive change for buyers is the removal of verification language: §4.5.1 states that elaborate sampling after a clear or purge “is not necessary” unless organizational policy requires it, and the Appendix D change log records that almost all verification language was removed. Rev. 1 should not be cited as current guidance, and “NIST 800-88” without a revision number should not be cited at all.
Does Rev. 2 require me to verify sanitization?
No. It defers the decision to organizational policy. Verification is still worth requiring — it is the only thing that makes a disposition record testable — but it is now your requirement and has to be written into your policy and your contracts as one. A clause requiring work “verified per NIST 800-88” no longer points at anything.
What are the three sanitization methods?
Clear applies logical techniques through the medium's standard commands to user-addressable locations, and protects against simple non-invasive recovery. Purge applies physical or logical techniques that render recovery infeasible using state-of-the-art laboratory techniques. Destroy renders the medium physically unusable. The method follows from the confidentiality of the data and the destination of the medium.
Does the standard require a specific number of overwrite passes?
No, and it never did. A single pass is sufficient on contemporary media when it completes and covers the full addressable range. Multi-pass overwriting descends from much lower recording densities and buys nothing today. Pass count was always the less interesting question; whether the technique reaches the whole medium is the one that decides the outcome.
How does Rev. 2 treat SSDs and flash media?
§4.5.2 identifies sanitization scoped to user-addressable locations as a red flag when validating a claim on flash media, because over-provisioning, wear-levelling and controller remapping put real data outside that scope. Cryptographic erase with evidenced key destruction, a confirmed device sanitize command, or physical destruction are the approaches that answer the objection.
Does R2v3 certification mean my vendor performs a Purge?
No. Appendix B(13) certifies to the Clear threshold by its own stated assurance level — data not recoverable by commercial software. Purge is defined against laboratory techniques. If you need Purge, specify it contractually as a separate requirement alongside the certification.
Does NIST certify or list sanitization tools?
No. NIST does not validate, certify or list media sanitization tools, and a vendor advertising a “NIST-certified” wipe is claiming something that does not exist. Evaluating whether a given tool delivers a given assurance level on a given medium is the buyer's job.
Can I reuse media after Clear or Purge?
Yes, when the method completed and you have evidence of it. Clear suits media staying within your control or moving to an environment with equivalent controls. Purge is the threshold before release outside your control. Destroy applies where neither can be trusted on that medium — which, on some flash devices, is the honest answer.
Does this apply to phones, switches and printers?
Yes. The guideline covers non-volatile storage wherever it sits, and embedded devices are the harder case precisely because their storage is not obvious. Configuration memory, firmware storage and service partitions all need to appear in the inventory.
How often should I review my procedures?
When the standard changes — as it did on 26 September 2025 — when you take on a medium your procedures do not cover, after an incident, and annually otherwise. Anything drafted against Rev. 1 needs a read-through now, specifically for clauses that used the standard as their authority for verification.
A method-by-method comparison — overwriting, cryptographic erase, degaussing, shredding and the rest — is covered separately.
Conclusion
The useful reading of Revision 2 is a narrow one. NIST still defines the assurance levels — Clear, Purge and Destroy remain the vocabulary, and they remain precise. NIST no longer tells you how to prove you reached one. Those are two halves of what a disposition programme needs, and only one of them is still available off the shelf.
Which puts the work back where it was probably always going to sit. Name the revision. Name the assurance level, per lot, against the data. Ask for evidence per asset in your own words, because the standard no longer asks on your behalf. Name the facility that does the work and confirm its scope covers it.
Vendor answers will go on citing “NIST 800-88.” The question worth asking back is which revision, and what in that revision they believe requires what they have just claimed. Vendor selection is the other half of this.
Related reading
Data Disposition: Linking Information Lifecycle Management to ITAD
How to Compare Data Destruction Services: Methods & Certifications