NIST 800-88 data sanitization is the most widely referenced framework in the United States for making data on retired storage media unrecoverable. It defines three outcomes (Clear, Purge and Destroy) and asks organizations to choose the right one based on the media type, the sensitivity of the data and where the device is going next. This guide explains each method in plain terms, shows how they apply to hard drives, SSDs and network equipment, and outlines the records an auditor will expect to see.
Short answer: what NIST 800-88 data sanitization requires
NIST Special Publication 800-88, Guidelines for Media Sanitization, does not prescribe one tool or one wipe pattern. It requires a decision. For every device leaving your control, you match the confidentiality of the data to a sanitization method that defeats the recovery techniques a realistic attacker could use, then you verify the result and record it. Revision 2 of the guideline was finalized in 2025 and puts more weight on a documented sanitization program and on validation, rather than on a single table of techniques.
- Clear protects against simple, non-invasive recovery such as reading the drive with standard tools.
- Purge protects against laboratory-grade recovery and leaves the media physically reusable.
- Destroy makes the media unusable and recovery infeasible, typically by shredding, disintegrating or incinerating it.
Clear, Purge and Destroy compared
| Method | What it defeats | Media reusable? | Typical techniques |
|---|---|---|---|
| Clear | Keyboard-level and software recovery | Yes | Overwriting user-addressable storage; factory reset on simple devices |
| Purge | Laboratory recovery attempts | Yes (except after degaussing magnetic drives) | Firmware-based sanitize or secure erase commands, cryptographic erase, degaussing |
| Destroy | All known recovery methods | No | Shredding, disintegration, pulverizing, incineration |
When Clear is enough
Clear is appropriate when the data is low sensitivity and the device stays inside the organization, for example a drive being redeployed to another team. Overwriting only reaches the storage the operating system can address, so it does not reach remapped sectors or the over-provisioned areas of flash media.
When Purge is the right call
Purge suits devices that will leave your control but still have resale value, such as servers and storage arrays going to an IT asset disposition program. On modern drives, Purge usually relies on the drive’s own sanitize command or on cryptographic erase, where the encryption key is destroyed so the remaining data is unreadable. Purging lets the hardware be resold or redeployed, which protects recovery value.
When only Destroy will do
Destroy is the right choice for highly sensitive data, for drives that fail a sanitize command, and for media that cannot be verified. Physical destruction is also common where policy simply does not allow drives to leave the building intact. See our guide to hard drive shredding services for how shredding is scoped and documented.
How NIST 800-88 applies to different media
Hard disk drives (HDDs)
Magnetic drives can be cleared by overwriting, purged with an ATA or SCSI sanitize command or a degausser, and destroyed by shredding. Degaussing renders a modern hard drive inoperable, so treat it as a one-way step. Our degaussing services page covers where it fits.
Solid-state drives and NVMe
Flash media behaves differently. Wear leveling and spare blocks mean a software overwrite cannot guarantee every cell was touched, and degaussing has no effect on flash. Purge on SSDs relies on firmware-level sanitize or cryptographic erase, and Destroy requires particle sizes small enough to break up the memory chips themselves.
Network equipment, phones and appliances
Switches, routers and firewalls hold configurations, credentials, VPN keys and logs in flash. Clearing them means erasing the startup configuration and file system and confirming nothing persists after reload. Teams selling hardware through a network equipment buyback program should treat this as a standard step, not an afterthought.
NIST 800-88 data sanitization records auditors expect
A sanitization method is only as defensible as the record behind it. NIST 800-88 asks for verification, and most auditors expect a per-device trail that includes:
- Asset tag and serial number of the device and of each drive removed from it
- Media type and the sanitization method applied (Clear, Purge or Destroy)
- Tool or equipment used, plus the software or firmware version where relevant
- Date, location and the name of the person who performed and verified the work
- Verification result and the final disposition (redeployed, resold, recycled)
That record is normally consolidated into a certificate of destruction issued per asset or per lot. DWC-IT’s secure data destruction services follow DoD and NIST standards, with full chain-of-custody tracking from pickup to final disposal.
Choosing a NIST 800-88 data sanitization method
- If the drive is staying inside the organization and the data is low sensitivity, Clear and verify.
- If the device is leaving your control but has resale value, Purge with a verified sanitize or cryptographic erase.
- If the data is regulated or highly sensitive, or the drive failed verification, Destroy.
- If you cannot verify the result for any reason, escalate to the next level.
For regulated environments, pair this with the sector rules covered in our guide to HIPAA-compliant hard drive disposal.
Frequently asked questions
Is NIST 800-88 a legal requirement?
NIST 800-88 is a guideline, not a law. Federal agencies are expected to follow it, and many regulations, contracts and auditors in healthcare, finance and government point to it as the accepted benchmark for media sanitization.
Is the DoD 5220.22-M three-pass wipe still valid?
Many vendors still reference DoD 5220.22-M, but NIST 800-88 is the framework most auditors now expect. Multi-pass overwriting adds time without adding meaningful protection on modern drives, and it cannot reliably reach every cell on an SSD.
Can a sanitized drive be resold?
Yes. Drives that are cleared or purged and verified can be redeployed or resold, which is how organizations recover value from retired servers and storage. Only destroyed media loses its resale value.
What proof should I keep after sanitization?
Keep a per-device record of serial numbers, method, tool, date, operator and verification result, plus a certificate of destruction or sanitization for each asset or lot.
Next step
If you are retiring servers, storage or network gear and need NIST 800-88 data sanitization, contact DWC-IT with your asset list. We will recommend Clear, Purge or Destroy per device and document every step.
5 responses