NIST SP 800-88 explained: Clear, Purge and Destroy
NIST SP 800-88 is the U.S. National Institute of Standards and Technology guideline for media sanitization. It defines three outcomes: Clear protects against simple recovery, Purge protects against laboratory recovery, and Destroy makes the media unusable. The right choice depends on the media type, how sensitive the data was, and whether the device will be reused.
Why the standard exists
Deleting files or reformatting a drive removes the index to the data, not the data itself. Recovery software can read it back. NIST SP 800-88 gives organizations a common vocabulary for how thoroughly data has been removed, so that a disposal record means the same thing to the vendor, the client and an auditor.
It replaced the older habit of citing “DoD 5220.22-M” overwrite passes, a method designed for magnetic disks that does not account for how solid-state drives store data.
Which revision is current
NIST published Revision 2 of SP 800-88 in September 2025 and withdrew Revision 1, which dated from 2014. The three outcomes below carry over. If a policy, contract or vendor document still cites Revision 1, ask for it to be updated to the current revision.
The three outcomes
- Clear: overwrite all user-addressable storage with non-sensitive data, or use a factory reset. Protects against keyboard-level recovery tools. Suitable for lower-sensitivity media staying inside the organization.
- Purge: use techniques that defeat state-of-the-art laboratory recovery: firmware sanitize commands, block erase or cryptographic erase. The media remains usable, so it is the standard choice for equipment that will be resold.
- Destroy: shred, disintegrate, pulverize or incinerate so the media cannot be read or used again. Required by some policies regardless of resale value.
Why SSDs are different
Solid-state drives spread writes across memory cells and keep spare capacity the operating system cannot see. An overwrite may never touch some of the old data. For SSDs and NVMe drives, Purge means using the drive's built-in sanitize or cryptographic erase commands, which act on all cells, then verifying the result. IEEE 2883 gives detailed technique guidance for modern storage interfaces.
Verification is part of the method
A sanitization step without verification is an assumption. A credible process samples or reads back the media after the operation and records the result against the drive serial number. Drives that fail should be physically destroyed, and the record should say so.
What to ask for on a certificate
- Each media serial number, and the host device serial if the drive came out of a computer
- The NIST outcome (Clear, Purge or Destroy) and the specific technique
- The verification result and date
- A reference that ties the certificate to your pickup manifest
Related
This guide is general information, not legal advice. More resources.