NIST SP 800-88 Explained: Clear, Purge and Destroy for Corporate Storage Media
By Ali Hassan, Editor, MAH Recycling
Ask three IT teams what “NIST wiped” means and you’ll get three answers. One means a quick format. Another means whatever the wipe tool reported. Only a few mean a documented decision tied to the media type. That last answer is the one an auditor accepts.
What Is NIST SP 800-88?
NIST SP 800-88 is a US federal guideline on media sanitization, meaning it makes access to data on storage media infeasible for a given level of effort. Revision 1 appeared in 2014. Revision 2 was published in September 2025 and shifts attention from picking a tool to running a sanitization program.
Clear, Purge, Destroy at a Glance
| Method | What it does | Typical fit | What to record |
|---|---|---|---|
| Clear | Logical techniques through normal read/write commands | Lower-risk media staying in-house | Tool, version, result per device |
| Purge | Stronger logical or physical techniques, such as cryptographic erase | Media leaving your control, higher-sensitivity data | Command used, verification outcome |
| Destroy | Physically makes the media unusable, such as shredding | Failed drives, top-tier data, no reuse | Method, date, serial number |
Choose the lightest method that matches the data’s sensitivity and where the device is going next.
What Changed in Revision 2
- Program focus. It is built around a governance process that aligns with standards such as ISO/IEC 27040 and NIST SP 800-53.
- Less faith in overwrites. The revision moves away from multi-pass overwriting on hard drives, a habit left over from older DoD-era routines.
- Clear carries risk on modern media. Flash storage in particular can retain data a simple overwrite never touches.
- Cryptographic erase. It gets its own treatment, since destroying the encryption keys can render the data unreadable.
Read the publication for exact wording before writing it into policy.
Why Old Habits Fail on SSDs and Cloud Storage
SSDs spread writes across cells through wear leveling, so an overwrite can miss data in reserved areas. That’s why a “wiped” laptop SSD needs a purge technique the drive itself supports, or physical destruction.
Virtual and cloud storage add another wrinkle. You can’t shred a volume you don’t physically hold, and NIST’s own revision FAQ treats virtual media as a separate focus area.
Aligned vs Certified: The Point Vendors Blur
NIST publishes guidance. It doesn’t accredit vendors or issue “NIST certificates.” So when a provider claims to be “NIST certified,” ask what that means.
The accurate phrase is “aligned with NIST SP 800-88.” It means the vendor’s methods follow the guideline’s logic, and that is the wording we use at MAH Recycling on purpose. Management-system certificates like ISO 14001 vouch for how a company operates. They don’t prove which sanitization method touched your drive.
NIST is also a US publication, not a UAE regulation. Many organizations in Dubai and Sharjah adopt it as a benchmark and write it into their own policy.
How to Choose a Method in Five Steps
- Classify the data on the media.
- Identify the media type: HDD, SSD, tape, phone, or virtual.
- Decide whether the device will be reused or retired.
- Match it to Clear, Purge, or Destroy.
- Verify the result and keep a per-device record.
A failed drive that no longer answers commands can’t be purged. It goes straight to destruction.
Need a method matched to your fleet? See our data destruction services.
