NIST SP 800-88 Rev. 2 is a guidance document for sanitising data storage media before reuse or disposal. It defines methods such as clearing, purging and destroying, and helps organisations choose a sanitisation level based on the media type and the sensitivity of data that may still be recoverable.
What NIST SP 800-88 Rev. 2 is for
NIST SP 800-88 Rev. 2 is not a product or a control by itself, it is a sanitisation guide for deciding how to clear, purge, or destroy storage media so residual data cannot be recovered beyond an acceptable level.
Its value is that it turns “delete the data” into a defensible media-handling decision. Different media types, data sensitivity, and reuse or disposal scenarios demand different treatment, and the guidance helps organisations avoid under-sanitising material that still contains recoverable information.
For a practical overview of the topic, NHIMG’s Media Sanitisation Guide explains the clear, purge, destroy decision in operational terms.
Sanitisation methods and what they mean
“Clear” is the lightest option and is meant to make data recovery difficult with normal laboratory tools, but not necessarily impossible against advanced recovery methods. “Purge” raises the bar by removing data so it cannot be recovered by feasible laboratory techniques. “Destroy” goes further and renders the media unusable or the data irretrievable by physical destruction or equivalent means.
The important distinction is that these are not interchangeable labels for deletion. A disk that is safe to reuse internally may still be unsuitable for donation, resale, or regulated disposal if the sanitisation method does not match the remaining recoverability risk.
NHIMG’s Data Retention and Secure Deletion Guide connects media sanitisation to retention schedules, legal holds, and secure deletion across the full data lifecycle.
How organisations decide the right sanitisation level
The core decision is based on media type and the sensitivity of the data that may still be present. Organisations should know whether they are dealing with magnetic disks, SSDs, flash media, removable media, embedded storage, or devices with built-in cryptographic erase capabilities, because the most reliable method can differ sharply by technology.
That decision also depends on where the media is going next. Internal reissue, third-party repair, lease return, resale, recycling, and regulated destruction all create different assurance needs, so sanitisation should be aligned to the disposal path rather than treated as a single universal step.
NHIMG’s Data Retention and Disposal Policy Template is useful when you need retention, legal hold, deletion, and sanitisation rules to work together as one policy set.
Evidence, verification, and operational handoff
Sanitisation is only trustworthy when it is verified and documented. Organisations need asset inventory, chain-of-custody discipline, and evidence that the selected method was actually applied to the intended media, especially when devices leave direct control.
That evidence matters because sanitisation failures are often discovered too late, after disposal or redeployment. Post-action review should confirm whether serial numbers, certificates of destruction, wipe records, or destruction logs match the assets that were supposed to be handled.
NHIMG’s NIST SP 800-61 Incident Response Guide is a useful companion when media sanitisation occurs as part of compromise response, because evidence handling and post-incident review often overlap.
Risk and Threat Considerations
Improper sanitisation leaves recoverable data on media that is reused, transferred, sold, or discarded. That creates a direct confidentiality risk, and in many environments it also creates a governance risk because the organisation may believe it has disposed of the asset safely when it has not.
Failure mechanism: The media is cleared when it should have been purged or destroyed, the sanitisation method does not suit the storage technology, or verification records do not prove the right asset was treated. Residual data can then be recovered from discarded, repurposed, or returned devices.
Impact: Sensitive records, credentials, keys, regulated data, or other recoverable information can be exposed after the media has left the organisation’s control, creating breach, legal, and incident-response consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | MP-6 — Media Sanitization | This guidance directly defines how to sanitise media before reuse or disposal. |
| MP-5 — Media Transport | Sanitised media often moves for return, resale, repair, or destruction and needs chain-of-custody controls. | |
| AU-11 — Audit Record Retention | Sanitisation evidence and destruction records must be retained to prove handling and support review. | |
| Recommendation — Apply MP-6 to select clear, purge, or destroy based on media type and data sensitivity. Use MP-5 to protect media during transfer and disposal handoff. Retain sanitisation and destruction records under AU-11 to support verification and investigations. | ||
| ISO/IEC 27001:2022 | A.8.10 — Information deletion | The term is about deleting or sanitising information from storage media before reuse or disposal. |
| A.7.14 — Secure disposal or re-use of equipment | Media sanitisation is central to securely reusing or disposing of equipment and storage devices. | |
| Recommendation — Define deletion and sanitisation procedures under A.8.10 for reused or retired media. Apply A.7.14 to ensure equipment disposal or reuse does not leave recoverable data behind. | ||
Practitioner Guidance
What to watch for: Treat the sanitisation method as an asset-disposition decision, not a disposal afterthought. The right answer depends on the data sensitivity, the media technology, and whether the device will be reused, transferred, or destroyed.
Governance implication: Ownership should sit with the teams that control asset inventory, data classification, and disposal evidence, because sanitisation without traceable proof is operationally weak even when the technical step was performed.
Practitioner takeaway: If the organisation cannot prove what data was on the media, what method was used, and what happened to the asset afterward, it does not really have defensible sanitisation.
Related resources from NHI Mgmt Group
- How should IAM teams implement NIST SP 800-63-4 without treating it as a checkbox exercise?
- How should security teams update password policy for NIST 800-63B Rev. 4?
- Why does NIST SP 800-63-4 matter beyond login security?
- What are the most common mistakes organizations make in a NIST SP 800-171 self-assessment?