NIST Data Sanitisation Guide for IT Teams

A retired laptop with a clean-looking desktop can still hold regulated data in unallocated space, hidden partitions, firmware-managed sectors or remapped blocks. That is why NIST media sanitisation guidance matters. For IT teams, MSPs and asset disposition workflows, sanitisation is not about making files disappear from view. It is about applying an appropriate method, checking the reported result and retaining records for audit scrutiny.

What is NIST 800-88 and what does compliant data wiping mean?

NIST SP 800-88 Rev. 2, approved in September 2025, is US guidance on running a media sanitisation programme. Aligning with it means choosing Clear, Purge or Destroy by risk, using a technique suited to the media, verifying and validating results, and keeping a certificate for each item.

What the NIST guidance covers

The current NIST media sanitisation guidance is NIST SP 800-88 Revision 2. It provides a risk-based framework for sanitising media before reuse or disposal. Rev. 2 defines Clear, Purge and Destroy as sanitisation methods and points organisations to current technology-specific standards, such as IEEE 2883, for detailed techniques.

That framework matters because one method does not fit every case. A laptop being redeployed internally has a different risk profile than an SSD leaving your control through resale or recycling. A hospital, financial institution, school district or government contractor may also need stricter documentation than a small business handling a routine refresh.

Clear, Purge and Destroy

Clear

Clear typically means removing data in a way that protects against non-invasive recovery techniques. In operational terms, this often applies when a device will remain within organisational control. For traditional magnetic drives, overwriting can meet this objective when performed correctly. For modern devices, the exact method depends on how the media manages data internally.

Clear is often appropriate for lower-risk reuse scenarios, but it is not the safe default for every retirement project. If a device is leaving the company, contains highly sensitive data, or has storage characteristics that limit overwrite effectiveness, Clear may not be enough.

Purge

Purge is a stronger sanitisation outcome designed to protect against more advanced recovery efforts. Depending on the media, Purge may be achieved through cryptographic erase, block erase commands, firmware-based sanitise functions or other approved techniques.

This is where many organisations make mistakes. They assume a standard reformat, factory reset or quick overwrite provides the same assurance. It does not. Purge is commonly the right target when devices are moving outside your control but remain physically intact for resale, lease return or certified recycling. For SSDs and many flash-based devices, Purge is often better aligned with how the technology stores and remaps data than legacy overwrite assumptions.

Destroy

Destroy means rendering the media unusable through a physical method intended to make practical recovery infeasible at the assurance level that method provides. Disintegrating, incinerating or melting media falls into this category. NIST SP 800-88 Rev. 2 says shredding and pulverising should be avoided for anything but the lowest security categories, and partial damage such as crushing or drilling may leave data recoverable. Destroy is often required when media is damaged, cannot be sanitised reliably, or contains data so sensitive that retaining device value is secondary.

Destroy can provide high assurance, but it also eliminates remarketing value and may complicate sustainability goals. For many ITAD programmes, that cost trade-off matters.

Why media type changes the decision

Hard disk drives behave differently from solid-state drives. On HDDs, controlled overwriting has historically been effective because data is written more predictably to physical sectors. SSDs are different. Wear leveling, overprovisioning, garbage collection and bad block management mean some data may not be addressed by a simple overwrite pass. SSD sanitisation often depends on supported sanitise commands or cryptographic techniques rather than assumptions carried over from spinning disks.

The same issue applies to mobile devices, embedded flash and hybrid storage environments. A process that works on one class of hardware may be incomplete on another. If your inventory includes mixed endpoints from multiple OEMs, method selection should be part of standard operating procedure, not left to technician judgment in the moment.

Common mistakes that create compliance gaps

The biggest failure is confusing deletion with sanitisation. Deleting files, emptying the recycle bin, reinstalling the OS or running a factory reset does not meet the standard for secure media sanitisation. Those actions may remove user access, but they do not reliably remove underlying data.

Another common problem is applying one blanket method to every device. Simplicity matters, but not if it produces inconsistent results across HDDs, SSDs and mobile devices.

Documentation is another weak point. Even when sanitisation itself is done correctly, some organisations cannot show what happened, when it happened, which asset was affected or which method was used. That becomes a problem during audits, investigations, client reviews or regulated disposal events.

Building a defensible sanitisation workflow

A defensible process starts before any wipe begins. Assets should be identified, categorised by media type and mapped to a disposition path such as redeploy, return, resale or destroy. That decision should drive the sanitisation objective.

Policy should define which methods are approved for which devices. For example, an HDD headed for internal reuse may qualify for Clear, while an SSD leaving organisational custody may require Purge. Unsupported, damaged or non-functional media may move directly to Destroy because verification is not possible.

Verification is where mature programmes separate themselves from ad hoc cleanup. You need a device-level record of the selected method and reported result, including device identifier, sanitisation method, result status, timestamp and operator or system attribution where applicable. For regulated organisations, this records how data risk was managed through a repeatable control.

Where software wiping fits

Software wiping fits best when the media is functional, the device still has value, and the selected method aligns with the storage technology and your policy. This is common during employee offboarding, lease returns, refresh cycles and internal redeployment.

You can sanitise devices at scale without destroying the asset, while maintaining a documented, repeatable process. For teams that process large volumes, licensing also matters. Recurring per-device costs can make sanitisation more expensive than it needs to be when wipe demand spikes during refresh projects.

RedKey USB is our purpose-built, USB-based tool for repeatable secure erasure with unlimited wipes and no subscription overhead. NIST guidance does not certify commercial products. Organisations remain responsible for selecting methods that match media type, risk and disposition path, then retaining records of the reported result.

Turn the guide into a decision tree

The best way to use NIST sanitisation guidance is to turn it into a policy-backed decision tree. Start with three questions. What type of media is this? Is the device staying in your control or leaving it? What level of assurance is required based on the data and the business context?

That approach keeps teams from defaulting to the fastest available method. If the goal is maximum resale value, software sanitisation and verification may be the right path. If the media is failing or the exposure threshold is extremely low, physical destruction may be the better business decision.

There is no single answer that fits every endpoint fleet. What should stay constant is the standard: use an approved method, verify the outcome and keep the record. Make sanitisation routine, measured and defensible so every retired device leaves with assurance instead of assumptions.

Frequently asked questions

Which products satisfy NIST 800-88?

NIST does not certify or list products. A tool can apply NIST-aligned methods, but meeting the guidance depends on your method selection, validation and records.

How should a business choose software that supports NIST 800-88 guidelines?

Check that it uses Purge-capable techniques for each media type, especially SSDs, reports results per drive and describes its NIST alignment accurately.

What changed in NIST SP 800-88 Rev. 2?

Rev. 2 focuses on running a sanitisation programme, removes the old media-specific tables in favour of IEEE 2883, drops multi-pass overwriting, and introduces sanitisation assurance through verification and validation.

Our FAQ explains how RedKey USB's methods relate to NIST terms; NIST does not certify products. Related reading: Data Destruction Standards That Matter and Understanding IEEE 2883-2022.