{ "version": "2026-08-03", "source": { "title": "NIST SP 800-88r2, Guidelines for Media Sanitization", "published": "2025-09-26", "url": "https://doi.org/10.6028/NIST.SP.800-88r2", "note": "Revision 1 was withdrawn on the day Revision 2 was published." }, "licence": "CC BY 4.0", "note": "Method definitions and the certificate field list derive from NIST SP 800-88r2, a US Government work not subject to copyright. Explanatory notes, the revision comparison and the decision logic are original and licensed CC BY 4.0. No IEEE 2883 content is reproduced.", "methods": [ { "id": "clear", "name": "Clear", "plain": "Overwrite or factory-reset through the same interface a user has, so ordinary recovery tools find nothing.", "resists": "Simple, non-invasive recovery through the standard interface: undelete utilities, file carving, a drive mounted in another machine.", "afterwards": "Media stays fully usable. Clear techniques typically have no effect on the life or performance of the device.", "whenRight": "Reuse inside your own organisation, where the media never leaves your control and the data was not sensitive enough to justify a method that might shorten the device's life. It is the weakest of the three and Revision 2 is explicit that purge should be preferred wherever it is available.", "commonError": "Trusting it on flash. A clear technique built on ordinary writes cannot reach a solid-state drive's overprovisioned area, so a substantial quantity of user data can survive untouched while the tool reports success. The report is accurate about what it did and silent about what it could not reach.", "exampleTechniques": [ "Overwrite user-addressable locations with a non-sensitive value", "Menu-driven reset to factory state where rewriting is not supported" ] }, { "id": "purge", "name": "Purge", "plain": "Use the device's own sanitise commands, or a physical technique, so that recovery is infeasible even in a laboratory.", "resists": "State-of-the-art laboratory recovery. This is the highest assurance available that still leaves you a working device.", "afterwards": "Media is left in a potentially reusable state, which is what makes purge the sensible default for lease returns, resale, donation and anything you would rather not send to landfill.", "whenRight": "Most of the time. Revision 2 says plainly that where a purge technique exists it should be used instead of clear, and purge is frequently more appropriate than destroy once you account for lease obligations, the environmental cost, the residual value of the hardware and the practical difficulty of destroying some media properly.", "commonError": "Assuming every device has one. Not all media offer a reliable purge technique, and the guidance says so. Where none exists you are choosing between accepting the residual risk of clear and destroying the device, and that is a decision to record rather than to make silently.", "exampleTechniques": [ "Dedicated sanitise commands implemented by the device", "Block erase", "Cryptographic erase, where the conditions in section 3.2 hold", "Degaussing, for exclusively magnetic media, subject to the caveats below" ] }, { "id": "destroy", "name": "Destroy", "plain": "Render the media unusable, and the data unrecoverable, by physical means.", "resists": "Recovery, to the extent the technique is actually effective against that material. Which is not a given, and is the point most often skipped.", "afterwards": "Nothing. The device is gone, along with its residual value and any prospect of proving later what was on it.", "whenRight": "High-sensitivity data, media with no trustworthy purge technique, or a device that has already failed and cannot accept commands. A drive that will not spin up cannot be purged, and that is the honest reason most destruction happens.", "commonError": "Treating shredding as the strongest option available. Revision 2 says pulverise and shred techniques for information storage media should be avoided for anything but the lowest security categories of data, because as areal density rises the fragments get large relative to the data they hold. Cutting or drilling a device may damage it only partly and leave portions readable in a laboratory.", "exampleTechniques": [ "Disintegrate", "Incinerate", "Melt", "Shred or pulverise, subject to the density caveat above" ] } ], "changes": [ { "id": "techniques-out-of-scope", "topic": "Per-media-type technique tables", "rev1": "An appendix set out, media type by media type, which technique satisfied each method: overwrite this, block erase that, degauss the other.", "rev2": "Deleted. Apart from cryptographic erase, technique and tool detail is explicitly out of scope, replaced by a direction to comply with IEEE 2883, an NSA specification, or a standard your own policy names as acceptable.", "soWhat": "If your disposal policy cites 800-88 for a technique, it now cites a document that no longer contains one. The policy needs to name the standard that does, and IEEE 2883 has to be bought, which is a procurement action rather than a drafting one.", "stillMisreported": true }, { "id": "programme-not-procedure", "topic": "What the document is for", "rev1": "A guide to making hands-on sanitisation decisions.", "rev2": "A guide to establishing an organisational media sanitisation programme: policy, scope, roles, verification, validation and records.", "soWhat": "The assessable unit moved. An auditor following Revision 2 asks to see a policy that maps your data classifications to minimum acceptable methods, and evidence the programme runs, rather than watching someone wipe a laptop.", "stillMisreported": false }, { "id": "ism", "topic": "What counts as media", "rev1": "Hard copy and electronic, or soft copy, media.", "rev2": "Hard copy and information storage media, or ISM, a term chosen to cover logical storage such as cloud, and emerging physical media including DNA, ceramic and glass.", "soWhat": "Cloud storage is now inside the frame, and it is the one case where destroy is unavailable: you cannot shred a bucket. Cryptographic erase, with keys you control, is the only method that reaches it.", "stillMisreported": false }, { "id": "degauss", "topic": "Degaussing", "rev1": "Treated as a destruction technique for magnetic media, and widely written up as such.", "rev2": "Not considered an approved destroy technique at the time of writing. It sits with the physical purge techniques, and Revision 2 notes that many existing degaussers lack the force for modern magnetic media and can damage a drive's servo tracks while failing to sanitise the target data.", "soWhat": "Worst of both outcomes: an unusable drive and unsanitised data, recorded as destroyed. If you own a degausser, its rated field strength needs checking against the coercivity of the media you actually hold.", "stillMisreported": true }, { "id": "shred", "topic": "Shredding", "rev1": "A straightforward destruction technique, and the default mental image of secure disposal.", "rev2": "To be avoided for information storage media except at the lowest security categories. Rising areal density means a fragment can still hold a great deal.", "soWhat": "This inverts what most disposal contracts specify. If you are buying shredding as your highest assurance option for high-sensitivity data, Revision 2 disagrees, and a purge before the device leaves the building is the stronger control.", "stillMisreported": true }, { "id": "verify-validate", "topic": "Checking the work", "rev1": "Verification, treated as one activity.", "rev2": "Verification and validation, separated. Verification asks whether the operation completed. Validation asks whether the outcome is acceptable for data of that sensitivity, and is where residual risk is formally accepted.", "soWhat": "A tool reporting success is verification. Nobody has done validation until someone with authority has looked at what the technique could not reach and accepted it in writing.", "stillMisreported": false }, { "id": "ce", "topic": "Cryptographic erase", "rev1": "Present, with less structure around when it can be relied on.", "rev2": "Given its own section with explicit conditions: the strength of the cryptography, whether CE applies to that device at all, sanitisation of the keys themselves, and the quality of the implementation. Key sanitisation is pointed at ISO/IEC 19790 zeroization.", "soWhat": "Cryptographic erase is fast and high assurance when the conditions hold and worthless when they do not. Self-encrypting drive claims are a vendor assurance question, which is why Revision 2 asks what guarantees the media vendor provides.", "stillMisreported": false } ], "mediaClasses": [ { "id": "hard-copy", "label": "Paper and other hard copy", "kind": "hard-copy", "destructible": true, "note": "Clear is never appropriate for hard copy under any conditions. There is no interface to overwrite through, so the choice is destruction." }, { "id": "hdd", "label": "Magnetic hard disk drive", "kind": "ism", "destructible": true, "note": "The one class where degaussing is technically relevant, and the class where Revision 2 withdrew degaussing from the approved destroy techniques. Modern recording methods have raised coercivity beyond what many installed degaussers produce." }, { "id": "ssd", "label": "Solid-state drive or NVMe", "kind": "ism", "destructible": true, "note": "Overprovisioned capacity sits outside the user-addressable space, so an overwrite-based clear leaves data behind while reporting success. A device sanitise command or cryptographic erase is the technique that reaches it, and both depend on the vendor having implemented them honestly." }, { "id": "flash", "label": "USB stick, SD card or other removable flash", "kind": "ism", "destructible": true, "note": "Same wear-levelling problem as a solid-state drive with none of the management interface. Cheap, rarely inventoried, and the media most likely to leave a building unrecorded." }, { "id": "tape", "label": "Magnetic tape", "kind": "ism", "destructible": true, "note": "Exclusively magnetic, so degaussing genuinely applies as a physical purge, subject to matching the degausser to the tape's coercivity. Check whether the cartridge memory chip is in scope of whatever you do." }, { "id": "optical", "label": "Optical disc", "kind": "ism", "destructible": true, "note": "Write-once media cannot be overwritten, so there is no clear or logical purge technique. Destruction is the method, and the effectiveness question is fragment size." }, { "id": "mobile", "label": "Phone, tablet or embedded device", "kind": "ism", "destructible": true, "note": "Storage is usually soldered and usually encrypted, so the factory reset that discards the encryption keys is a cryptographic erase in everything but name. Its assurance rests entirely on the vendor's key handling." }, { "id": "cloud", "label": "Cloud or other logical storage", "kind": "ism", "destructible": false, "note": "New to Revision 2's scope, and the case where destroy simply does not exist as an option: the physical media is not yours and is shared. Cryptographic erase with keys you hold and can destroy is the only method that reaches it, which is an architectural decision made long before disposal." } ], "certificateFields": [ { "id": "manufacturer", "label": "Manufacturer", "required": true }, { "id": "model", "label": "Model", "required": true }, { "id": "serial", "label": "Serial number", "required": true }, { "id": "propertyNumber", "label": "Property or asset number", "required": false, "hint": "Your own inventory reference, which is what ties this record back to the asset register." }, { "id": "mediaType", "label": "Media type", "required": true }, { "id": "source", "label": "Media source", "required": true, "hint": "Where it came from: a named user, a specific machine, a store." }, { "id": "categorisation", "label": "Pre-sanitisation confidentiality categorisation", "required": false }, { "id": "method", "label": "Sanitisation method", "required": true }, { "id": "technique", "label": "Sanitisation technique", "required": true, "hint": "The specific operation performed: overwrite, block erase, cryptographic erase, degauss, disintegrate." }, { "id": "tool", "label": "Tool used, including version", "required": true }, { "id": "verificationMethod", "label": "Verification method", "required": true }, { "id": "performedBy", "label": "Performed by", "required": true }, { "id": "verifiedBy", "label": "Verified by", "required": true }, { "id": "date", "label": "Date", "required": true }, { "id": "location", "label": "Location", "required": false } ], "ukNotes": [ { "id": "vocabulary", "heading": "The NCSC does not say clear, purge or destroy", "body": "It splits sanitisation into non-destructive, meaning the device can be reused, and destructive. There is no clean mapping onto NIST's three methods, so a policy citing both needs to state which vocabulary governs rather than assuming a reader will translate." }, { "id": "media-agnostic", "heading": "The NCSC treats all storage media the same way", "body": "Where NIST's structure invites a per-media-type answer, the NCSC guidance explicitly declines to differentiate, and applies one approach across drives, flash, tape and optical. That is a deliberate simplification for an OFFICIAL threat model, not an oversight." }, { "id": "classification", "heading": "It is scoped to OFFICIAL", "body": "The guidance is proportionate to the threat model for OFFICIAL data and states that it will not protect against a skilled, well-funded laboratory. Media that has held data classified SECRET or above falls under separate guidance entirely." }, { "id": "particle", "heading": "Six millimetres", "body": "Where destruction is required, the NCSC gives a particle size of 6 mm or less, and asks that the size be verified rather than assumed from the shredder's rating. NIST gives no equivalent figure, so a UK disposal specification is usually better written against this one." }, { "id": "reset", "heading": "Factory reset on encrypted devices", "body": "For encrypted devices the NCSC points at the manufacturer's factory reset, on the basis that it discards the encryption keys and leaves the data unreadable. That is cryptographic erase under another name, and it inherits the same dependency on the vendor having handled the keys properly." } ] }