NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization

Overview

The guide defines sanitization as a process that renders access to target data infeasible for a given level of effort. It stresses that distributed, cloud-based architectures mean data passes through many organisations, systems and media, which increases the number of parties responsible. As access control and encryption improve, attackers may turn to residual data on media that leaves an organisation insufficiently sanitized, so tracking media and effective techniques are critical.

Three methods are defined. Clear applies logical techniques to all user-addressable locations against simple, non-invasive recovery, and multi-pass overwriting is not needed. Purge makes recovery infeasible using state-of-the-art laboratory techniques and can leave the media reusable; it should be used instead of clear where possible. Destroy makes recovery infeasible and the media unusable. Degaussing is no longer a destroy technique and must not be used on flash/SSD; bending, cutting and drilling only partly damage media, and pulverizing or shredding should be avoided for anything but the lowest security categories.

Cryptographic erase (CE) rests on sanitizing encryption keys and may be the only purge option for logical/virtual storage. Its precondition is that no sensitive data was ever stored in plaintext on the media; per ISO/IEC 27040 the algorithm must provide at least 128 bits of security strength and random sources must have entropy at least equal to the key length. Zeroization per ISO/IEC 19790 is the recommended key sanitization technique. CE should not be trusted where keys were backed up or escrowed, and for data that must stay confidential for decades, future cryptographic weakness or quantum computing must be weighed.

Section 4 defines the programme: security categorization (low, moderate, high) revisited at least every three years or on significant change, media reuse, control of media, data protection level, the sanitization and disposal decision, verification, validation and documentation. A sample certificate of sanitization records manufacturer, model, serial number, method, technique, tool and version, and verifier details. Compared with Rev. 1 it shifts focus from hands-on decisions to establishing a programme and defers technology-specific detail to IEEE 2883, NSA specifications or an organisation-approved standard.

Key points

1. Sanitization decisions follow the confidentiality of the information; media type only influences the technique.
2. Three methods: clear, purge and destroy; purge is preferred over clear where possible.
3. Multi-pass overwriting is not required; the old DoD 5220.22-M language is obsolete, and on overprovisioned SSDs such practices give very little protection.
4. Degaussing must not be used for flash/SSD and is not currently a destroy technique; many degaussers lack force for high-coercivity media.
5. Pulverize and shred should be avoided for anything but the lowest security categories.
6. Cryptographic erase: at least 128 bits of security strength, key sanitization by ISO/IEC 19790 zeroization, ECB mode not allowed.
7. CE requires that no sensitive data was ever stored in plaintext; backed-up or escrowed keys undermine trust in CE.
8. The security categorization is revisited at least every three years or on significant change.
9. Sanitization assurance splits into verification (checking the outcome) and validation (approving or rejecting effectiveness); a certificate of sanitization is completed afterwards.
10. Full or representative sampling after clear or purge is not needed unless organisational policy requires it.

Using it in design

• Add media sanitization to the facility's storage and server lifecycle plan at commissioning, and label media with the confidentiality category of the system.
• Ask vendors for a Statement of Volatility and make ease of sanitization a purchasing criterion for servers and storage.
• For self-encrypting drives and CE designs, verify at design stage that key management and backup key copies can be sanitized.
• Contractually require media to be sanitized before leaving organisational control in lease returns and warranty exchanges.
• Design an asset-tracking record with manufacturer, model, serial number, method, technique, tool and version fields for sanitization evidence.
• If an on-site destruction area is planned, decide which method suits which security category rather than defaulting to shredding.

Who should read it

Information security managers, system owners, asset-management teams and data-centre operations staff.

Document contents

1. Executive Summary
2. 1. Introduction
3. 2. Background
4. 3. Summary of Sanitization Methods
5. 3.1.1 Clear Sanitization Method
6. 3.1.2 Purge Sanitization Method
7. 3.1.3 Destroy Sanitization Method
8. 3.2 Use of Cryptography and Cryptographic Erase
9. 4. Media Sanitization Program
10. 4.3 Sanitization and Disposition Decision (security categorization, reuse, control of media, data protection level)
11. 4.5 Sanitization Assurance (verification and validation)
12. 4.6 Documentation
13. 4.7 Roles and Responsibilities
14. Appendix B. Device-Specific Characteristics of Interest
15. Appendix C. Sample Certificate of Sanitization Form
16. Appendix D. Change Log

Related standards

• IEEE 2883
• NIST SP 800-53 MP-6

Read the document

Publication details

Authors

Ramaswamy Chandramouli; Eric A. Hibbard

Publisher

National Institute of Standards and Technology

Year

2025

Document number

NIST SP 800-88 Rev. 2

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.SP.800-88r2

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation