Federal Standard
NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
NIST Special Publication 800-88 Revision 2, published September 2025, is the United States federal standard for media sanitization. Federal agencies follow it under FISMA, and HIPAA, PCI DSS, GLBA, and FACTA reference it as the benchmark for lawful disposal. All Green Recycling's data destruction processes are operationally aligned to the NIST SP 800-88 Rev. 2 Clear, Purge, and Destroy categories.
What Is NIST SP 800-88 Rev. 2?
NIST Special Publication 800-88 Revision 2 is the federal guideline for media sanitization, published by the National Institute of Standards and Technology in September 2025. It defines three sanitization categories: Clear, Purge, and Destroy. Federal agencies follow it under FISMA. Private-sector organizations use it as the benchmark cited across HIPAA, PCI DSS, GLBA, and FACTA enforcement guidance.
Publisher: National Institute of Standards and Technology (NIST), U.S. Department of Commerce
Current version: Revision 2, September 2025, superseding Revision 1 (December 2014)
Official URL: doi.org/10.6028/NIST.SP.800-88r2
Legal force: Mandatory for federal agencies under FISMA; de facto benchmark for private-sector compliance audits
Revision 2 updates the 2014 standard to address storage technologies that became dominant after r1: NVMe solid-state drives, eMMC and UFS flash storage, and self-encrypting drives. It aligns with IEEE 2883-2022, strengthens Cryptographic Erase guidance, and restructures the standard around a formal Media Sanitization Program. The three core categories remain. The methods inside them are updated for flash media.
What Does NIST SP 800-88 Rev. 2 Require?
NIST SP 800-88 Rev. 2 requires organizations to categorize media by data sensitivity, select a sanitization category that matches that sensitivity, execute the method, verify the result, document every step, and retain the records. The standard mandates a formal, ongoing Media Sanitization Program rather than ad-hoc disposal decisions.
Category 1: Clear
Definition: Logical techniques that sanitize data in all user-addressable storage locations, protecting against simple non-invasive recovery.
In practice: Software overwrite. Data is not retrievable through the operating system or standard file-recovery tools. A laboratory attacker retains some recovery probability.
When to apply it: Media reused inside the same security boundary; lower-sensitivity data; warranty returns.
Methods: Software overwrite (single or multi-pass); ATA Secure Erase on compatible HDDs; documented factory reset on consumer devices.
Category 2: Purge
Definition: Techniques that render data recovery infeasible using state-of-the-art laboratory methods.
In practice: Data is unrecoverable even under laboratory analysis. The media may stay functional.
When to apply it: Any media leaving the organization’s control; moderate- or high-sensitivity data; media transferred to recyclers or disposal vendors.
Methods: Cryptographic Erase on self-encrypting drives that meet the standard’s conditions (validated encryption plus verifiable key destruction); block erase on flash media; degauss for magnetic media only.
Category 3: Destroy
Definition: Techniques that make data recovery infeasible and render the media permanently non-functional.
In practice: Physical elimination of the media. No recovery is possible by any method. The media cannot be reused.
When to apply it: Highest-sensitivity data (PHI, CUI, cardholder data); end-of-life media with no reuse requirement; any case where Purge cannot be verified.
Methods: Shredding; disintegration; crushing; incineration; degaussing for magnetic media only.
SSD and flash note: Degaussing does not sanitize SSDs, NVMe drives, eMMC, or UFS flash. These store data as electrical charge in NAND cells, not magnetic orientation. Flash devices require Purge via Cryptographic Erase or Destroy via physical shredding.
Verification and documentation
NIST SP 800-88 Rev. 2 treats verification as a required step, not an optional one. After sanitization the organization confirms the action succeeded, either by full verification of every device or by a representative sampling approach for large lots, and records the result. The standard also calls for a documented record that names the media, the category and method applied, the verification outcome, and the personnel involved, so that disposal decisions can be reconstructed during an audit.
The Media Sanitization Program
Revision 2 frames sanitization as an ongoing program rather than a series of one-off events. The program assigns roles, defines how media are categorized by sensitivity, sets the decision logic for choosing Clear, Purge, or Destroy, and governs how records are retained. This program orientation is the structural change that lets an organization show an auditor a repeatable process instead of isolated destruction tickets.
How All Green Recycling Aligns to NIST SP 800-88 Rev. 2
All Green Recycling’s data destruction processes are operationally aligned to NIST SP 800-88 Rev. 2. Each Data Destruction service maps to a specific NIST category, and every Certificate of Destruction names the category and the method used.
| All Green Recycling Service | NIST Rev. 2 Category | Media Types |
|---|---|---|
| Hard Drive Shredding | Destroy | HDD, SSD, NVMe, optical, tape |
| Hard drive crushing | Destroy | HDD, SSD, NVMe |
| Hard drive degaussing | Purge | Magnetic HDD and tape only |
| Cryptographic Erase | Purge | Self-encrypting drives meeting NIST conditions |
| SSD Secure Erase | Clear or Purge | SSD, NVMe (where firmware supports it) |
| Witnessed Destruction | All categories | Chain-of-custody layer over any method |
NIST does not certify vendors. NIST SP 800-88 Rev. 2 is a guideline, not a certification scheme, so no company is “NIST certified.” What matters for an audit is whether the destruction method matches the correct category and whether the Certificate of Destruction documents that method by category and section. All Green Recycling states its alignment as process-conformance, never as a certification claim.
Who Must Follow NIST SP 800-88 Rev. 2?
Federal agencies must follow NIST SP 800-88 Rev. 2 under FISMA (44 U.S.C. §3551 et seq.). Every federal agency operating an information system must run a media sanitization program aligned with the standard. Federal contractors handling federal information systems inherit the same requirement through their contracts.
Private-sector organizations are not directly required by law to follow it. In practice, compliance auditors across major frameworks treat it as the default benchmark:
Healthcare: HIPAA Disposal Rule requires “reasonable and appropriate” disposal under 45 CFR §164.310(d)(2). HHS OCR guidance cites NIST Destroy-level destruction as satisfying it.
Financial services: GLBA Safeguards Rule (16 CFR Part 314) requires proper disposal of customer financial information.
Retail and payments: PCI DSS Media Disposal Requirement 9.4.6 requires destruction meeting accepted industry standards.
Defense contractors: CMMC Media Sanitization requires media sanitization per NIST SP 800-88 for all Controlled Unclassified Information (CUI) media.
Enforcement and Consequences
NIST SP 800-88 Rev. 2 is a guideline, not a law with direct penalties. Failing to follow it triggers enforcement under the regulations that reference it.
HIPAA/HITECH (HHS OCR): OCR fines for improper PHI disposal range from $141 to $2,134,831 per violation category under the inflation-adjusted 2024 tiers. OCR guidance names NIST SP 800-88 as the destruction benchmark.
PCI DSS (card brands): Non-conformant media disposal is a documented audit failure under Requirement 9.4.6. Card-brand fines range from $5,000 to $100,000 per month, plus breach liability.
CMMC (DoD): A contractor that fails a CMMC Level 2 media sanitization assessment cannot hold DoD contracts containing CUI. Contract loss is the direct consequence.
Federal agencies (FISMA): An Inspector General finding that an agency failed to follow NIST SP 800-88 results in a Material Weakness reported to Congress in the annual FISMA report.
Method Selection: Which Sanitization Category Applies?
Match the media type to the NIST SP 800-88 Rev. 2 category that fits the data sensitivity: Clear for reuse inside the same security boundary, Purge for media leaving the organization, Destroy for highest-sensitivity or end-of-life disposal.
| Media Type | Clear | Purge | Destroy |
|---|---|---|---|
| Hard drive (HDD) | Overwrite (single/multi-pass) | ATA Secure Erase; degauss | Shred / crush / disintegrate |
| Solid-state drive (SSD) | ATA Secure Erase (wear-leveling caveat) | Cryptographic Erase per conditions | Shred (if CE not verifiable) |
| NVMe drive | Not recommended | Cryptographic Erase per conditions | Shred |
| Magnetic tape (LTO) | Overwrite | Degauss | Shred / disintegrate |
| Optical media (CD/DVD) | Not applicable | Not applicable | Shred / disintegrate |
| USB / flash drive | Not recommended | Cryptographic Erase per conditions | Shred |
| Mobile device | Documented factory reset | Cryptographic Erase per conditions | Shred |
Authoritative Source and Official Document
NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
Current Version: Revision 2, September 2025
Frequently Asked Questions
What changed between NIST SP 800-88 Revision 1 and Revision 2?
NIST SP 800-88 Revision 2, published September 2025, supersedes Revision 1 from December 2014. Revision 2 adds explicit guidance for NVMe SSDs, eMMC, UFS flash storage, and self-encrypting drives that Revision 1 did not adequately cover. It strengthens Cryptographic Erase conditions, aligns with IEEE 2883-2022, and restructures the standard around a formal Media Sanitization Program. The three categories, Clear, Purge, and Destroy, remain the framework. The methods inside each category are updated for modern flash media.
Is NIST SP 800-88 Rev. 2 mandatory or voluntary?
NIST SP 800-88 Rev. 2 is mandatory for federal agencies under FISMA. For private-sector organizations it is not a direct legal requirement. HIPAA, PCI DSS v4.0.1, GLBA, FACTA, and CMMC 2.0 all reference it as the benchmark for adequate disposal. If your organization handles patient records, cardholder data, financial information, or federal contracts, auditors expect NIST-conformant destruction documentation.
Can degaussing satisfy NIST SP 800-88 Rev. 2 for SSD destruction?
No. Degaussing is listed under Purge and Destroy for magnetic media only. SSDs, NVMe drives, eMMC, and UFS flash store data as electrical charge in NAND cells, not magnetic orientation, so degaussing has no effect on the data. SSDs require Purge via Cryptographic Erase where the drive meets the standard’s conditions, or Destroy via physical shredding when erase cannot be verified.
How does All Green Recycling satisfy NIST SP 800-88 Rev. 2 requirements?
All Green Recycling’s data destruction processes are operationally aligned to NIST SP 800-88 Rev. 2. Shredding and crushing map to Destroy, Cryptographic Erase and degaussing map to Purge, and software wiping maps to Clear. Every Certificate of Destruction names the NIST category and the method applied to each serialized device. All Green Recycling states this alignment as process-conformance, not as a NIST certification, because NIST does not certify vendors.
What documentation does an auditor expect for NIST-aligned destruction?
Auditors expect a Certificate of Destruction that records the date and location, the NIST SP 800-88 Rev. 2 category, the destruction method, and a serialized asset inventory with one line per device. The Certificate of Destruction issued by All Green Recycling includes these fields plus technician and witness signatures where witnessed destruction was requested, which supports HIPAA, CMMC, FISMA, and PCI DSS audits.
What NIST category applies to end-of-life media leaving the organization?
For media leaving the organization permanently, NIST SP 800-88 Rev. 2 recommends Purge or Destroy based on data sensitivity. For high-sensitivity data including PHI, CUI, and cardholder data, Destroy via physical shredding is the standard choice. Shredding eliminates the media entirely and leaves no recovery pathway regardless of storage technology or encryption status.
When does Cryptographic Erase qualify as Purge under Revision 2?
Cryptographic Erase qualifies as Purge only when specific conditions are met. The drive must have encrypted all stored data with a validated encryption implementation from the moment it was first used, and the sanitization must verifiably destroy the encryption keys so the ciphertext cannot be decrypted. If data existed on the drive before encryption was enabled, or if key destruction cannot be confirmed, Cryptographic Erase does not meet the Purge bar and the device should be destroyed instead. All Green Recycling applies Cryptographic Erase only where these conditions hold and routes everything else to physical destruction.
Need media sanitization and destruction services that satisfy NIST SP 800-88 Rev. 2?
Bonded · Insured · Certificate of Destruction · Methods follow NIST SP 800-88 Rev. 2