NIST SP 800-88 Rev. 2: The Changes That Matter for Your Wipe Policy

Plenty of data disposal policies still quote the 2014 edition of NIST SP 800-88. That edition was superseded when Revision 2 was approved in September 2025, and the new version changes the shape of the guidance as much as its content. A policy written around the old technique tables now points at material NIST has withdrawn.

Our NIST sanitisation guide for IT teams explains Clear, Purge and Destroy from first principles. This article is narrower: it lists what changed in Revision 2 and what we would rewrite in a typical wipe policy as a result.

What is the biggest change in NIST SP 800-88 Rev. 2?

The emphasis moves from technique tables to running a sanitisation programme. Organisations are asked to decide roles, map risk to Clear, Purge or Destroy, check outcomes and keep records, rather than follow a per-device cookbook.

NIST describes this as a move towards an enterprise media sanitisation programme covering both reuse and disposal. Revision 2 also uses the term information storage media, which takes in logical and cloud storage as well as physical drives. If your policy only mentions hard drives and USB sticks, widen it.

Where have the technique tables gone?

They were removed. Apart from cryptographic erase, which stays in the main text, NIST now points to IEEE 2883-2022, NSA specifications or an organisation's approved standard for media-specific techniques.

That has a practical consequence for policy wording. Rather than copying interface commands into your procedure, name the method level and point operators to IEEE 2883 or your approved standard for the detail. Our explainer on IEEE 2883-2022 covers how that standard is organised.

Does Clear still need multiple overwrite passes?

No. Revision 2 clarifies that Clear does not need multi-pass overwriting, and describes repeated passes as past practice. If a single pass is not enough assurance, move up to Purge or Destroy rather than adding passes.

This finally retires the habit of quoting a three-pass government pattern as a current requirement. For SSDs with spare capacity, extra passes achieve very little anyway, because the host cannot reach the areas that matter.

What happened to verification?

Most of the old verification language was removed, and full or sampled read-back is now needed only if your organisation requires it. In its place, Revision 2 introduces sanitisation assurance: verification plus validation.

• Verification asks whether the technique completed as expected: tool status, errors, anomalies and media health for Clear and logical Purge, or inspection of remnants for Destroy.
• Validation is the accept or reject decision: was the data effectively sanitised for its sensitivity? NIST gives examples of operations that can finish yet fail validation, such as degaussing an SSD or a simple overwrite of media with hidden spare capacity.

Build both into your workflow. Record what the tool reported, then have a named person accept the result or escalate it.

Are there new limits on degaussing and destruction?

Yes. Degaussing is limited to magnetic media with a suitably matched degausser, is not an approved Destroy technique even if the drive stops working, and must never be used on flash. Destroy requires that laboratory recovery is infeasible and the media can no longer store data.

Partial physical damage can leave data recoverable, so a drive with a hole in it is not automatically destroyed.

What changed for cryptographic erase?

The guidance was rewritten and consolidated. Key sanitisation now references zeroisation as defined in ISO/IEC 19790, acceptable key types were updated, and guidance was added on externally managed keys and on trusting vendor implementations.

Our article on the four conditions for cryptographic erase turns these points into a practical checklist.

What should a sanitisation record contain now?

NIST lists minimum fields including manufacturer, model, serial number, asset number, media type and source, the method (Clear, Purge or Destroy), technique, tool and version, verification method, and the name, date and signature of whoever verified and validated the result.

A record is only as good as the tracking behind it, so connect it to your asset register from the day a device arrives to the day it leaves.

What should I change in my wipe policy?

Cite Revision 2, define the programme, point technique choice to IEEE 2883 or an approved standard, remove multi-pass rules, add verification and validation, tighten degaussing and cryptographic erase rules, and update the record template.

• Replace references to Rev. 1 and note that its technique tables are withdrawn.
• Set out roles, risk mapping to Clear, Purge or Destroy, and how exceptions are handled.
• Adopt wording that covers cloud and logical storage.
• Delete any mandatory pass counts.
• Add a validation step with a named approver.
• Restrict degaussing to matched magnetic media.
• Align cryptographic erase procedures with the updated key guidance.
• Refresh the record template to the minimum fields.

How do RedKey USB tools map to Revision 2?

RedKey USB supports Clear and Purge methods described in international guidance, using drive commands or overwriting depending on the disk, and is designed to follow NIST SP 800-88 methods. NIST does not test or approve products, so the mapping and validation remain your decision.

For records, RedKey USB Professional and Ultimate save a PDF report for each erasure, capturing the disk, method, date, time and result, with space for asset and operator details in supported editions. The Home edition shows results on screen only. Use the report as your verification evidence, then add your own validation sign-off.

Frequently asked questions

When was NIST SP 800-88 Rev. 2 published?

It was approved in September 2025 and supersedes Revision 1 from 2014.

Does NIST approve data erasure software?

No. NIST publishes guidance and does not test or approve products. Organisations decide whether a tool and method meet their needs.

Is a single overwrite pass enough under Rev. 2?

For Clear, multi-pass overwriting is not required. If one pass is not enough assurance, move to Purge or Destroy.

Ready to erase your own devices? See RedKey USB Professional. Related reading: NIST Data Sanitisation Guide for IT Teams and Understanding IEEE 2883-2022.