Compliance  ·  7 min read

NIST 800-88 Data Sanitization: A Plain-English Guide

NIST Special Publication 800-88, Guidelines for Media Sanitization, is NIST's guidance on sanitizing storage media so the data on it cannot be recovered. Here is what it asks for, in plain terms.

What Is NIST 800-88?

Published by the National Institute of Standards and Technology (NIST), SP 800-88 provides a framework for making data unrecoverable. It is widely adopted not just by the federal government, but by private enterprises, healthcare organizations (for HIPAA compliance), and financial institutions. The current version is Revision 2 (September 2025), which replaced Revision 1 (December 2014).

The standard defines three sanitization methods: Clear, Purge, and Destroy.

Clear

Clear applies logical techniques to sanitize data in all user-addressable storage locations. This is typically achieved by overwriting the drive with a single pass of zeros or random data.

When to use it: For older magnetic hard drives (HDDs) where the data is not highly sensitive. On Solid State Drives (SSDs), an overwrite sent from the host cannot reach spare or remapped blocks, so Purge is the better choice where the drive supports it.

Purge

Purge applies physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques. For SSDs and NVMe drives, this usually means a standardized sanitize command sent to the drive's controller (such as ATA Sanitize or NVMe Sanitize) or a cryptographic erase, which also covers over-provisioned areas the host cannot reach. Rev. 2 no longer lists techniques for each media type; it points to IEEE 2883 for that.

When to use it: For all modern flash storage (SSDs, NVMe, mobile devices) and for any media containing sensitive PII, PHI, or corporate IP. The media can be safely reused or resold after a Purge.

Destroy

Destroy renders target data recovery infeasible and results in the subsequent inability to use the media for storage of data. This involves shredding, incinerating, or pulverizing the drive.

When to use it: When media has failed and cannot be logically purged, or when dealing with highly classified government data.

Verification and Certification

NIST SP 800-88 Rev. 2 covers this under sanitization assurance (Section 4.5) and documentation (Section 4.6).

• Verification: Check that the sanitization technique completed successfully: the tool's completion status, any errors or anomalies, and the health of the drive. Rev. 2 says full or sampled read-back of the drive is not necessary unless your own policy requires it.
• Validation: Decide whether to accept or reject the result. Rev. 2 makes this a separate step from verification (Section 4.5.2).
• Documentation: Rev. 2 (Section 4.6) says a certificate of sanitization should record, among other fields, the manufacturer, model, serial number, media type, method (Clear, Purge or Destroy), technique, tool and version, verification method, and the name, title, date, location and signature of the people who did the verification and validation.

How WipeCert Helps

WipeCert checks what each drive's controller supports. If the drive accepts a device sanitize or cryptographic erase command, WipeCert uses it and the certificate records Purge. If not, WipeCert overwrites the full drive from the host, and the certificate records Clear and says Purge is not claimed. Each certificate is signed and lists the drive details, the method, the technique and how the result was checked. Keep the validation decision, and the title and location of the person who ran the wipe, in your own records alongside it.