SUMMARY: NIST SP 800-88 is the leading standard for secure media sanitization, defining how to clear, purge and destroy data so it can’t be recovered. This guide explains what each method means, why verification matters and how BCWipe Total WipeOut helps organizations meet NIST 800-88 Rev 1 requirements through simple wiping and automated reporting. These insights help you choose the right sanitization approach and prove that your data is truly removed.
The NIST SP 800-88 Guidelines for Media Sanitization provide instructions to organizations on how to effectively sanitize hard drives and other electronic media. Released by the National Institute of Standards and Technology, the guidelines are widely followed by the U.S. government and private companies.
Here we will provide an overview of NIST SP 800-88 and the concept of media sanitization. We will then take a closer look at NIST’s 3 ways of dealing with end-of-life data, and finally explain why verifying your sanitization results is essential to following the guidelines.
NIST SP 800-88 Guidelines in a Nutshell
- When?
The NIST SP 800-88 Guidelines for Media Sanitization were first published in 2006. The guidelines were then updated in December 2014, and this first revision (Rev 1) remains the most current version of the guidelines. - What?
The NIST publication is a U.S. government document that provides clear methods of how to delete data from electronic media in a secure and permanent way. By following the guidelines, organizations can feel confident they have taken the necessary steps to minimize the chances of their data being recovered by third parties. - Who?
The NIST SP 800-88 Guidelines for Media Sanitization were originally meant for government use, but are now commonly implemented by many private companies and organizations. While it’s not compulsory to comply with the guidelines, it’s advisable for companies to adopt them in order to ensure their sensitive data is unrecoverable.
What Is Media Sanitization?
Media sanitization is the process of removing data stored on an electronic media device in a way that ensures it cannot be easily retrieved by third parties. After correctly sanitizing a device, the data that has been removed should be unrecoverable even with the assistance of advanced forensic tools. In addition to removing the files and folders from your electronic media device, the sanitization process will securely remove all Data Remanence.
NIST’s 3 Sanitization Methods: Clear, Purge, Destroy
The NIST SP 800-88 Guidelines for Media Sanitization recommends that you remove your data in one of 3 ways: Clearing, Purging, or Destroying.
Clear – Overwriting User-Accessible Storage
Clearing is a sanitization method that involves using software or hardware products to overwrite all user-addressable storage space. The goal of clearing is to replace written data and potentially sensitive information with random data.
Clearing can be applied by using the standard Read and Write commands on your device, and can involve rewriting data with a new value or resetting the device to its factory settings. While your information most likely can’t be retrieved by basic recovery utilities, this sanitization method only provides an intermediate level of protection.
Purge – Defending Against Advanced Recovery Methods
Purging provides more comprehensive sanitization than clearing, as purging protects information against laboratory attacks that use advanced methods and tools to recover data.
Some methods of purging include overwriting, block erasing, and cryptographic erasure. In order to use this sanitization method, you first have to remove Host Protected Areas (HPAs) or Device Configuration Overlays (DCOs) if they exist on your device. Purging can then be applied through the use of dedicated device sanitization commands.
Destroy – When Hardware Cannot Be Reused
Destroying, like purging, protects data from being recovered by state-of-the-art laboratory techniques. A key difference, however, is that after destroying media the device is no longer able to store data.
There are many physical techniques for destroying media, such as disintegrating, incinerating, melting, and shredding. While destruction can be useful for hardware that cannot possibly be reused, in most cases you should alternatively consider purging your media instead. Not only does purging allow you to reuse or donate your devices, this also means you can reduce the amount of harmful electronic waste you produce. Find out more about the benefits of erasing and repurposing your devices.
And Don’t Forget to Verify
Once you have removed the data from your device with your chosen sanitization method, there’s still one last important step: Verify your results.
Verifying your sanitization results is an essential step to maintain confidentiality and should never be skipped. As the NIST guidelines state, there are 2 types of verification methods:
- Verification for every sanitized piece of electronic media
- Verification of a representative sampling of media after sanitization has been completed
In order to prove you have met the NIST SP 800-88 Guidelines for Media Sanitization, you can complete a certificate of media disposition for each piece of media that has been sanitized and verified. To find out more about the process of verification, please consult the NIST guidelines.
About BCWipe Total WipeOut
BCWipe Total WipeOut is a data wiping solution that securely erases entire drives beyond forensic recovery. If you are looking to follow the NIST guidelines for purging your data, BCWipe Total WipeOut makes it simple with a media sanitization solution that allows you to meet the NIST 800-88 Rev 1 standard in just a click. Verifying your sanitization results and completing the necessary certificates can be easily done with the customizable wiping reports feature of BCWipe Total WipeOut – Enterprise Edition.
To get started with Jetico’s secure data wiping solution, begin your free trial of BCWipe Total WipeOut today.
Frequently Asked Questions (FAQs)
NIST SP 800-88 provides guidance on how to remove data from electronic media so it can’t be recovered even with forensic techniques. The guidelines help organizations reduce the risk of data leaks by defining standardized sanitization methods. Although created for U.S. government use they are now widely adopted across many industries.
Clearing overwrites user addressable data and protects against basic recovery attempts. Purging provides stronger sanitization using methods such as block erase or cryptographic erase and protects against advanced lab attacks. Destroying renders the media unusable through physical damage. Purging is often preferred because it preserves the device for reuse and reduces e waste.
Verification confirms that your chosen sanitization method succeeded and that no recoverable data remains. NIST allows verification for every device or for a representative sample depending on organizational needs. Proper verification also enables you to document compliance through certificates of media disposition.
BCWipe Total WipeOut is Jetico’s full drive wiping solution designed to meet NIST 800-88 Rev 1 purging standards. It overwrites all data including hidden areas and generates customizable reports to support verification and auditing. The Enterprise Edition simplifies compliance for large organizations by offering centralized management and documentation.
Yes. NIST SP 800-88 applies to HDDs, SSDs, NVMe drives and other flash based media. Because SSDs handle data through wear leveling and controller managed blocks NIST references techniques such as block erase or full overwriting. Newer IEEE standards offer additional guidance designed specifically for solid state devices. Using a trusted wiping tool ensures proper sanitization across all device types while supporting both NIST and IEEE recommendations.
Related Articles
Data Sanitization 5 Common Myths
Hardware Decommissioning Process: A 5-Step Checklist
The Ultimate Guide to Deleting Files Permanently
IEEE 2883-2022 Standard for Sanitizing Storage
CMMC 2.0 Levels, Controls & Framework for Media Sanitization Requirements
IRS Publication 4812 & How to Comply with Wiping Standards
How to Securely Wipe Your Windows 11 Computer Clean
How to Wipe a Hard Drive on a Dead Computer
How to Wipe an NVMe Drive
How to Delete Files on SSD
How to Obtain a Certificate of Destruction