Standards update · Data sanitization

What NIST SP 800-88 Rev. 2 Changed

NIST published the final NIST SP 800-88 Rev. 2 in September 2025 and withdrew the 2014 revision. The new edition drops the media-by-media technique tables and asks organisations to run a sanitization programme instead. Here is what moved, what stayed and what it means for disposing of IT assets in India.

By DFRTI editorial teamPublished 2 November 2026Reviewed 2 November 2026

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was approved by the NIST Editorial Review Board on 12 September 2025 and published that month. It supersedes NIST SP 800-88 Rev. 1 of December 2014, which NIST's publication page now lists as withdrawn. The authors are Ramaswamy Chandramouli of NIST and Eric Hibbard of Samsung Semiconductor. We checked every point below against the published PDF and NIST's own FAQ for the document, dated 16 July 2026.

The biggest change is one of attitude rather than technique. Rev. 1 was a hands-on manual with long tables telling you how to sanitise a floppy, a tape, a hard disk or a phone. Rev. 2 removes those tables and says, in its own change log, that the focus has shifted to maintaining confidentiality by establishing an agency or enterprise media sanitization programme. For specific techniques it points to IEEE 2883 and to NSA policy manuals, and it says the latest version of those standards should be consulted as storage changes.

The Three Methods, As Rev. 2 Defines Them

The names Clear, Purge and Destroy survive from Rev. 1. The definitions are tighter and a new term, information storage media, replaces the old phrase electronic or soft copy media so that cloud and object storage are covered too.

Clear: Logical techniques applied to all user-addressable storage locations through the same interface a user has, to protect against simple, non-invasive recovery. Typically an overwrite with standard read and write commands, or a factory reset where rewriting is not supported. Rev. 2 states plainly that multi-pass overwriting is unnecessary and that on SSDs with over-provisioning such practices achieve very little.

Destroy: Techniques that make recovery infeasible and leave the media unusable for storage: disintegrate, incinerate, melt, pulverise, shred. Rev. 2 adds that as data density rises, pulverise and shred should be avoided for anything but the lowest security categories, and that bending, drilling or shooting a drive only partly damages it.

Information storage media (ISM): NIST's new umbrella term for physical devices such as SSDs and tape as well as virtual or logical storage such as cloud and object stores. The term exists because an organisation that rents cloud storage cannot shred anything.

Purge: Physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory techniques, while leaving the media potentially reusable. Logical purge includes overwrite, block erase and cryptographic erase through dedicated sanitize commands that bypass the normal read and write abstraction. The document says purge should be used instead of clear when possible.

Cryptographic Erase Gets Its Own Rules

Cryptographic erase (CE) is the one technique Rev. 2 still describes in detail, because self-encrypting drives make it the everyday purge method for modern SSDs and the only workable purge for cloud storage. CE sanitises the keys rather than the data. Section 3.2 sets pre-conditions that must all hold before an organisation relies on it: the cryptographic module must be validated to the current FIPS 140 standard for federal use, no sensitive data may have been written in plaintext before encryption was in place, the algorithm must give at least 128 bits of security strength with a random number generator of matching entropy, and every copy of the target keys must be sanitised by zeroisation as defined in ISO/IEC 19790.

Rev. 2 also lists the key types that count (data-encryption keys, key-wrapping keys, master or key-derivation keys and private key-transport keys, following NIST SP 800-57 Part 1), says when externally managed keys may be acceptable, and asks for traceability of CE operations. The FAQ adds that selective CE of a single partition or file is acceptable only when the organisation is certain the data never left that encrypted boundary.

What Is Different From Rev. 1

Taken from Appendix D, the change log, and the NIST FAQ. These are NIST's own statements, not our reading of them.

All media-specific technique and tool details, except CE, are replaced by a recommendation to comply with IEEE 2883, NSA specifications or an organisationally approved standard. The old Appendix A and the technique tables are gone.
Multi-pass overwrite is declared unnecessary for the Clear method. The DoD 5220.22-M pass counts are called obsolete.
Degaussing is now a physical purge technique for legacy magnetic media only. It is not a Destroy technique even when it leaves the drive inoperable, and it must not be used on flash or hybrid media.
Almost all old verification language is removed. Full or representative sampling of a sanitised drive is not needed unless organisational policy demands it.
A new idea called sanitization assurance has two parts. Verification checks that the technique finished without errors or anomalies. Validation is a management decision that the outcome is good enough for the sensitivity of the data, or that it must be repeated with a stronger method.
The decision flow in Figure 1 now opens with the question of whether the media will be reused, and the whole flow is driven by the confidentiality of the information, not by the media type.
The sample Certificate of Sanitization in Appendix C is updated. A new Appendix B lists device characteristics to ask vendors about, such as recording technology and supported sanitize commands.
Laboratory attacks, and the difference between logical and physical techniques, are described for the first time.

Flash Media and the Decision Flow

Rev. 2 is blunt about flash. Devices with spare cells and wear levelling cannot be fully sanitised by a host-side overwrite because the user interface cannot address every place data has been stored. People who kept using overwrite habits from magnetic disks on flash devices, it says, may be exposing data to unintended disclosure. The answer is a purge through the drive's own sanitize commands or CE, with the caveat that this means trusting the vendor's implementation, a point Rev. 2 raises openly.

The decision flow runs from security categorisation of the information, through whether the media leaves the organisation and whether it will be reused, to a method, then to a validate step, and only then to disposal. Our reading as an educational institute is that this is a management document first. A technician can no longer open it and look up a table. The organisation must have a policy, named roles, trained people, calibrated tools and records.

Categorise the information first, not the device
Prefer Purge over Clear where the media supports it
Use CE only when all the pre-conditions are met and recorded
Validate the result against sensitivity, then issue a certificate

Why It Matters for IT Asset Disposal in India

NIST SP 800-88 Rev. 2 is a United States federal guideline. It is not Indian law and following it does not by itself make anyone compliant with anything in India. It matters because it is the document that Indian buyers, auditors and asset disposal vendors most often name, and because the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), dated 13 November 2025) contain erasure duties under Rule 8 that commence eighteen months after Gazette publication. When a company must show that personal data on a retired laptop was erased, a method that follows a published guideline and ends in a per-device certificate is far easier to defend than a screenshot of a format command.

Three practical consequences follow. First, the common Indian habit of quoting three-pass or seven-pass overwrites as a selling point is now contrary to the guideline being quoted. Second, for SSDs and phones the honest options are a firmware sanitize command, CE or destruction, and the record should say which pre-conditions were checked. Third, any vendor claim of being NIST certified should be treated with care, because NIST does not certify sanitization products or services. It publishes a guideline and leaves the programme to you.

This is an standards update written by the DFRTI editorial team from the sources below. It is not a vendor announcement and DFRTI has not independently tested any product named in it unless the text says so.