NIST 800-88 Data Destruction: Requirements & Compliant Wipes

NIST 800-88 data destruction provides a framework for sanitizing storage media so data cannot be recovered, with Clear, Purge, and Destroy as the three sanitization categories. Rev. 2 emphasizes risk-based decisions, verification, validation, and documentation based on the data, media, and intended disposition.

An employee returns a laptop. At first glance, it looks ready for its next use.

But the device may still hold recoverable company data. Until that data is properly sanitized, the laptop remains a security and compliance risk.

That’s where NIST 800-88 data destruction comes in.

This guide covers what changed in Rev. 2, what validation and verification mean, how to choose a sanitization approach, why SSDs need different handling, what sanitization records prove, why chain of custody matters before the wipe, and how the process fits into employee offboarding.

What is NIST 800-88 Data Destruction?

NIST SP 800-88 provides guidance for media sanitization: making data on storage media inaccessible according to an organization's requirements and the sensitivity of the information.

It isn't a single technique. It's a framework for deciding which sanitization approach fits, based on:

• Data sensitivity: what's on the device and what it would cost you if it leaked
• Media and storage technology: an HDD, an SSD, and a cloud volume don't behave alike
• Intended IT asset disposition: will the device be redeployed, resold, recycled, or destroyed, and will it be reused inside or outside the organization?
• Organizational requirements: your own policies, contracts, and regulatory obligations

The guidance sorts sanitization into three methods, Clear, Purge and Destroy, which are covered below.

NIST 800-88 Rev. 2: What Changed From Rev. 1? (2025 Update)

NIST finalized Revision 2, finalized in September 2025, supersedes Rev. 1 (2014) and shifts the standard from media-specific technique tables to a program-level approach.

In practice, Rev. 2 asks organizations to run sanitization as a program. NIST's Rev. 2 FAQ says the policy should align the organization's data classification (low, moderate and high confidentiality) with acceptable methods (Clear, Purge and Destroy). It should also set documentation and evidence requirements, including certificates of sanitization, define roles and mandatory personnel training, cover tool configuration, calibration, testing and maintenance, and specify verification and validation protocols.

A Wider Scope: Information Storage Media

Rev. 2 introduces the term information storage media (ISM), replacing the older "electronic (soft copy) media." It covers physical devices such as SSDs and magnetic tape, as well as virtual or logical storage systems such as:

• Cloud storage
• Container storage
• Object storage

For device offboarding, physical media remains the more immediate concern, but the broader scope matters when data exists across multiple storage environments.

Validation vs. Verification

Rev. 2 describes sanitization assurance as two separate steps:

• Verification: Inspecting the outcome of the technique to confirm it completed successfully, without errors or anomalies.
• Validation: A decision made afterward. The organization reviews the verification results against the sensitivity of the data and either approves the sanitization or rejects it. Rejection means repeating it with a different technique or escalating to a stronger method.

A technique can finish without errors and still leave an unacceptable confidentiality risk. Validation is where that call is made.

NIST 800-88 vs. Other Data Sanitization Standards

NIST 800-88 is not the only reference used in media sanitization. Each serves a different purpose.

These standards are not interchangeable.

How IEEE 2883 Fits In

Rev. 2 points organizations toward standards such as IEEE 2883-2022 for specific sanitization techniques. The distinction is straightforward:

• NIST 800-88 → provides the overall media sanitization guidance, including how organizations establish a sanitization program, assess requirements, select an appropriate approach, and document the outcome.
• IEEE 2883 → provides technical guidance on how specific sanitization practices can be carried out for different types of storage media.

→ Think of NIST as the framework for what the sanitization program should achieve, and IEEE 2883 as a technical guide for how to carry it out.

What about DoD 5220.22-M?

DoD 5220.22-M is an older overwrite specification, commonly described as a multi-pass overwrite. It is not current NIST guidance.

NIST's Rev. 2 FAQ says multi-pass overwriting is unnecessary on modern storage: it adds little confidentiality protection and can shorten the life of flash media.

If a contract or policy still names DoD 5220.22-M, ask whether it can reference NIST 800-88 and a technique that fits the storage media.

How to Apply NIST 800-88 in Practice

NIST 800-88 does not prescribe a fixed, seven-step procedure for every device. Instead, it provides guidance for selecting and managing an appropriate media sanitization approach based on the information, storage media, and intended outcome.

Here’s a practical workflow for an IT team handling a device during employee offboarding:

A Practical NIST 800-88 Sanitization Workflow

Identify → Classify → Select → Sanitize → Verify → Validate → Document

1. Identify the device and storage media: Confirm which device is being retired through IT asset tracking and identify the storage media it contains.
2. Determine the sensitivity of the information: Assess the type of data stored on the media and the organization's requirements for protecting it.
3. Select a sanitization method: Choose an approach based on the media, data, and intended disposition of the device.
4. Perform the sanitization: Carry out the selected method according to the applicable requirements.
5. Verify the result: Inspect the outcome to confirm the technique completed successfully, without errors or anomalies.
6. Validate the outcome: Review the verification results against the data's sensitivity. Approve the sanitization, or reject it and repeat with a different technique or a stronger method.
7. Document the outcome: Record the asset, the method and technique used, and the evidence that the result was verified and validated.

NIST 800-88 Sanitization Methods: Clear vs. Purge vs. Destroy

The three NIST 800-88 sanitization categories are Clear, Purge, and Destroy. Clear uses logical techniques to sanitize media; Purge uses stronger techniques to make recovery infeasible, and Destroy physically destroys the media.

Here’s how they differ:

In practice:

• Clear typically means a single-pass overwrite using standard read/write commands, or a manufacturer factory reset where rewriting isn't supported. Multi-pass overwriting is unnecessary.
• Purge is intended to make recovery infeasible while potentially preserving the media for reuse. Cryptographic erase can serve as a Purge technique when the storage technology and configuration support it. Degaussing is a physical purge technique for legacy magnetic media, and Rev. 2 does not treat it as a Destroy method.
• Destroy makes sense when reuse isn't intended or when no appropriate sanitization method can be applied.

These categories describe outcomes, not specific techniques. The technique depends on the storage technology and the data.

How Storage Media Changes the Sanitization Approach

The right technique depends on the storage technology, not the device label. Rev. 2 no longer lists techniques by media type. Apart from cryptographic erase, it treats technology-specific techniques as out of scope and points to standards such as IEEE 2883, and to NSA Policy Manual 9-22 for highly sensitive government media.

For a returned laptop, the question is usually SSD or HDD, and whether encryption was enabled from the start. That answer decides whether a cryptographic erase is available or whether the drive needs a different approach.

Why SSDs Change the Sanitization Calculus

SSDs need different sanitization considerations from traditional magnetic hard drives. An HDD stores data magnetically on platters. An SSD stores data in flash memory cells managed by a controller.

That controller uses wear leveling to distribute writes across the drive. As a result, overwriting a file at the logical level does not necessarily overwrite the same physical locations where the original data was stored.

Rev. 2 says flash devices with spare cells and wear leveling make it infeasible to sanitize all previous data through the native read/write interface.

That is why a conventional logical overwrite cannot automatically be assumed to sanitize every underlying location on flash media. Cryptographic erase can serve as a Purge technique, but Rev. 2 sets preconditions. No sensitive data can have been stored in plaintext before the encryption keys were established. The algorithm must be at least 128-bit strength, with a random number generator of matching entropy. The keys must be permanently zeroized. Federal agencies must also use cryptographic modules validated to the current FIPS 140 standard.

Degaussing is not an effective sanitization technique for SSDs because SSDs do not store data magnetically.

That matters whether a device is being redeployed, resold, recycled, or permanently retired. Choosing the right method is only part of the job. The organization also has to document what was done.

What is NIST 800-88 Compliant Data Destruction?

NIST 800-88 compliant data destruction generally refers to sanitization performed according to an organization's applicable NIST 800-88-based requirements and documented for the relevant asset. In an IT offboarding process, that means accounting for the information, media, sanitization approach, outcome, and required assurance before the device moves to its next state.

Why “We Wiped It” Isn't Enough

“We wiped the laptop” tells you that someone performed a task. It does not show whether the right method was selected, whether it completed successfully, or whether the result was verified.

That is what NIST 800-88 compliant data destruction looks like in practice:

Asset identified → method selected → sanitization performed → result verified → outcome validated → documented

Not simply performing a wipe, but being able to trace the sanitization decision and outcome to the specific asset.

What a Certificate of Destruction Must Prove

A certificate of destruction should show what was sanitized, how it was done, and who confirmed the result. You'll often hear it called that, but it's not NIST's term. NIST calls it a certificate of sanitization (Section 4.6, Appendix C), and Rev. 2 says you should complete one for each piece of media you sanitize, following your organization's policies. It can be a piece of paper or an electronic record. NIST's own example is simple: scan each device's barcode into a tracking application as it's sanitized.

NIST says a completed certificate should record at least the following. The last three rows go beyond NIST's minimum.

Sample sanitization record (illustrative example)

A certificate is evidence that a sanitization process was performed. It does not replace the decision to select an appropriate method for the media and data.

The record is only one part of the chain, though. Before a device reaches the person or process performing the wipe, there is another question: can you account for where that device was and who handled it? That is where chain of custody becomes important.

Why Chain of Custody Matters Before the Wipe

A certificate is only useful when you can explain the device it belongs to.

Chain of custody connects the physical device to its sanitization record by documenting who had possession, when it was collected, where it went, when it was sanitized, and what happened to it afterward.

→ This continuity matters because a sanitization certificate shows that a device was sanitized, but without a custody trail, it may not establish that the specific device in question remained accounted for from collection through sanitization.

For distributed teams, physical retrieval is therefore part of maintaining custody during employee offboarding.

That retrieval step is also where many IT teams run into operational friction. In GroWrk's State of IT Lifecycle Management 2025 research, 41% of IT professionals identified retrieving hardware after an employee leaves as a major ITAM pain point, while 35% cited employee refusal to return devices and 33% cited shipping logistics as retrieval challenges.

That makes device retrieval the operational starting point for maintaining custody during offboarding.

NIST 800-88 During Employee Offboarding: A Practical Walkthrough

The easiest way to see how NIST 800-88 fits into device offboarding is to follow a laptop from employee exit to its next state.

Once the device is back in the organization's custody, the physical and sanitization workflow looks like this:

Day 0: Employee offboarding initiated
↓
Retrieval: Laptop is collected from the employee. Timing varies by country.

Over the last 12 months, GroWrk recovered 10,257 devices across 98 countries, with a 99% retrieval success rate and a median recovery time of 14 days.
↓
Upon receipt: Asset verification. Serial number and asset ID are confirmed against the asset record
↓
After intake: Chain of custody. Device is tracked through transport, with relevant handoffs recorded
↓
Sanitization: An appropriate sanitization approach is selected based on the media, data requirements, and intended disposition, then performed in accordance with the applicable requirements
↓
Verification: Result is inspected then approved or rejected
↓
Documentation: Certificate or sanitization record is generated
↓
Final disposition: Device is redeployed, remarketed, recycled, or destroyed

The important part is the sequence. Sanitization sits in the middle of a physical device lifecycle, not at the end of it.

Before a device can be sanitized, the organization needs to establish which asset it has, maintain custody as it moves, and determine whether the selected sanitization approach is appropriate. After sanitization, the result needs to be verified, validated and documented before the device moves to its next state.

This gives IT a practical workflow for applying NIST 800-88 principles during device offboarding.

NIST 800-88 Data Destruction Checklist

Use this checklist to make the sanitization workflow easier to operationalize.

Before sanitization

☐ Identify the asset
☐ Identify the storage media
☐ Classify the data
☐ Select the appropriate sanitization method

During sanitization

☐ Maintain chain of custody
☐ Perform the selected method
☐ Record the result

After sanitization

This checklist is a practical operational translation of NIST 800-88 guidance. It does not claim that NIST mandates these exact steps in a fixed sequence.

How GroWrk Applies NIST 800-88 to IT Asset Disposal

Secure data destruction starts before the wipe and doesn't end when the wipe is finished.

For GroWrk, the wipe is one part of a larger physical device lifecycle:
Retrieve → track → maintain custody → sanitize → verify → document → redeploy or dispose

The process starts when a device leaves an employee's hands. GroWrk coordinates the retrieval, tracks the device during its return, coordinates sanitization as a physical step, and routes the device to its next destination.

For distributed teams, that process often crosses borders.

GroWrk supports device lifecycle operations across 150+ countries, including localized logistics and customs handling. Once a device arrives, its next step depends on its condition and intended use. Healthy devices can be refurbished and routed to new hires, while end-of-lifecycle devices can be sent to certified e-waste partners, with chain of custody maintained throughout.

GroWrk wipes returned devices as part of its IT asset disposal process, with chain-of-custody records maintained from pickup through final disposition.

The key is maintaining control of the asset throughout that lifecycle. The device needs to remain accounted for from retrieval through sanitization and final disposition, with each step documented along the way.

→ See how GroWrk manages device retrieval, sanitization, and offboarding from pickup through final disposition