What does 3.2 require?

Many ISM now integrate encryption and key management. Given strong cryptography and the right preconditions, those capabilities support a purge technique called cryptographic erase (CE), which sanitizes the keys used to encrypt data or prevents access to them, so that sanitization can be achieved with high assurance far faster than other techniques; the encryption itself does the sanitizing, subject to the constraints in the guideline. Federal agencies use encryption modules carrying current FIPS 140 validation, which gives assurance that a self-encrypting drive meets those preconditions.

NIST SP 800-88 Rev 2 3.2: Cryptographic erase as a purge...

Other controls in Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2

3 Categorise the information, assess the media and the confidentiality risk, decide the media's future, then choose and justify the sanitization method
3.1 Use the three methods (clear, purge, destroy) with technology-specific techniques kept current against IEEE 2883, matched carefully to the media type
3.1.1 Clear: logical techniques over the user interface against simple recovery; not for hard copy; avoid multi-pass overwriting on overprovisioned flash; use dedicated sanitize commands or factory reset where rewriting is unsupported
3.1.2 Purge: physical or logical techniques that defeat laboratory recovery while keeping the ISM reusable; prefer purge to clear; choose techniques from IEEE 2883; cryptographic erase may be the only purge option for virtual storage; degauss only magnetic media with a matched degausser
3.1.3 Destroy: render recovery infeasible and the media unusable by disintegrating, incinerating, melting, pulverizing or shredding; partial damage does not count; avoid shred and pulverize for dense media above the lowest category
3.2.1 Strength of cryptography for CE: at least 128-bit security strength, entropy at least equal to the key length, and the Table 1 requirements on key generation, media encryption, key wrapping and key derivation
3.2.2 Applicability of CE: only where no sensitive plaintext was ever stored since the last sanitization, with caution for long-lived sensitivity, and never trusted where keys were backed up or escrowed without control
3.2.3 Sanitization of keys: zeroize every copy of the target cryptographic keys and all keys beneath them, eliminate unwrapped copies in volatile memory or registers, and consider external key recovery paths

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-88 Rev 2 controls