NIST SP 800-88 Rev. 1: Guidelines for Media Sanitization
The US government standard for sanitizing storage media, and how DestructLog helps you document compliance.
What Is NIST SP 800-88?
NIST Special Publication 800-88 Revision 1 (Guidelines for Media Sanitization) is the US National Institute of Standards and Technology's framework for sanitizing all types of storage media. It defines three categories of sanitization — Clear, Purge, and Destroy — and specifies which methods are effective for each media type. Federal agencies and many commercial organisations reference this standard in their data disposition policies.
The Three Sanitization Categories
Clear
Clear applies logical techniques to sanitize data in all user-addressable storage locations. For magnetic HDDs, this means overwriting all addressable locations with a single character or pattern. Clear is not effective for SSDs, flash devices, optical discs, or paper because those media types do not expose all storage locations to the overwrite command.
Purge
Purge applies stronger techniques designed to resist laboratory recovery. Methods include overwrite with verification, degaussing (demagnetising the media), cryptographic erase (encrypting data and destroying the key), and block erase (for SSDs and flash devices). Purge is applicable to HDDs, SSDs, tape, flash drives, and floppy disks, but not to optical discs or paper.
Destroy
Destroy renders the media physically unusable. Methods include shredding, disintegration, pulverization, and incineration. Destroy is applicable to every media type, including optical discs, paper, and mixed-media assemblies that require disassembly per component.
The Media Sanitization Decision Matrix
The standard provides a matrix mapping which methods apply to which media types. DestructLog embeds this matrix and validates each row against it. Here is the applicability summary:
| Media Type | Clear | Purge | Destroy |
|---|---|---|---|
| Hard Disk Drive (Magnetic) | ✓ | ✓ | ✓ |
| Solid State Drive (Flash) | ✗ | ✓ | ✓ |
| Magnetic Tape | ✓ | ✓ | ✓ |
| Optical Disc (CD/DVD/BD) | ✗ | ✗ | ✓ |
| Flash Drive / USB | ✗ | ✓ | ✓ |
| Floppy Disk | ✓ | ✓ | ✓ |
| Paper Media | ✗ | ✗ | ✓ |
| Mixed Media Assembly | ✗ | ✗ | ✓ |
Why Documentation Matters
An auditor reviewing your disposition process needs to see which assets were sanitized, by what method, on what date, and who verified the work. A generic statement that "assets were sanitized" does not provide the per-asset detail an auditor expects. The sanitization record should list each asset individually with its serial number, media type, and the specific method applied.
DestructLog generates a NIST 800-88 compliant sanitization record that records this information per asset, including citations to the relevant NIST sections for each method-media type combination.
NIST 800-88 and Your Compliance Program
While NIST SP 800-88 was developed for US federal agencies, it has become a de facto standard in commercial ITAD, data center decommissioning, and corporate asset retirement. Integrating its requirements into your disposition documentation shows that your process follows a recognised framework. DestructLog does not itself certify compliance — it is a tool that documents what was entered in a format consistent with the standard's requirements.