NIST SP 800-88 Rev 1

United States

6 domains

29 controls

NIST SP 800-88 Revision 1 Guidelines for Media Sanitization.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Clear

3 controls

Controls in the Clear domain of NIST SP 800-88 Rev 1 — 3 controls
Code	Title	Description
MS-CLEAR-1	Clear Sanitization for Logical Reuse	Clear applies logical techniques (typically overwriting user-addressable storage) to protect against simple non-invasive...
MS-CLEAR-2	Clear for ATA Hard Disk Drives	For ATA HDDs, Clear is achieved by overwriting all user-addressable locations with a fixed pattern (e.g., binary zeros)....
MS-CLEAR-3	Clear for Solid State Drives	For SSDs, Clear via overwrite is not reliable due to wear leveling and over-provisioning. Manufacturer reset commands ma...

Decision Framework

3 controls

Controls in the Decision Framework domain of NIST SP 800-88 Rev 1 — 3 controls
Code	Title	Description
MS-DECISION-1	Sanitization Decision Framework	Organizations must determine the appropriate sanitization method based on data confidentiality (Low, Moderate, High), se...
MS-DECISION-2	Media Inventory and Tracking	All storage media must be inventoried with type, serial number, classification of data stored, custodian, and dispositio...
MS-DECISION-3	Roles and Responsibilities	Defined roles must include Program Manager, Information System Owner, Information System Security Officer, Property Mana...

Destroy

8 controls

Controls in the Destroy domain of NIST SP 800-88 Rev 1 — 8 controls
Code	Title	Description
MS-DESTROY-1	Destroy as Highest Sanitization Level	Destroy renders target data recovery infeasible and the media unable to be reused. Methods include disintegration, pulve...
MS-DESTROY-2	Shredding Particle Size for SSDs and Flash	SSDs and flash media require finer shred particle sizes than HDDs because individual memory chips can retain data. Shred...
MS-DESTROY-3	Optical Media Destruction	CDs, DVDs, and Blu-ray discs are sanitized by destruction only (shredding, disintegration, or incineration). Overwriting...
MS-DESTROY-4	Paper and Microform Destruction	Paper records and microforms (microfilm, microfiche) are sanitized by destruction methods such as cross-cut shredding, p...
MS-DESTROY-5	Embedded Storage in Peripherals	Multifunction devices, printers, copiers, fax machines, and scanners often contain hard drives or flash storing scanned...
MS-DESTROY-6	Networking Equipment Sanitization	Routers, switches, firewalls, and load balancers store configuration, credentials, certificates, and cached data. Saniti...
MS-DESTROY-7	Mobile Devices and Tablets	Mobile devices are sanitized by performing a manufacturer factory reset on encrypted devices (cryptographic erase equiva...
MS-DESTROY-8	IoT and Embedded Systems	IoT devices, embedded controllers, and appliances often contain flash storage with credentials and operational data. Whe...

Documentation

3 controls

Controls in the Documentation domain of NIST SP 800-88 Rev 1 — 3 controls
Code	Title	Description
MS-DOC-1	Certificate of Sanitization	Each sanitization action is documented in a Certificate of Sanitization recording media identifiers, method used, tool v...
MS-DOC-2	Third-Party Sanitization Vendor Oversight	When sanitization is outsourced, contracts must require 800-88 conformance, define media types in scope, require Certifi...
MS-DOC-3	Records Retention	Sanitization records must be retained according to organizational and regulatory schedules, typically for the lifetime o...

Purge

8 controls

Controls in the Purge domain of NIST SP 800-88 Rev 1 — 8 controls
Code	Title	Description
MS-PURGE-1	Purge Sanitization for External Release	Purge applies physical or logical techniques that render target data recovery infeasible using state of the art laborato...
MS-PURGE-2	ATA Secure Erase and Sanitize Commands	For ATA drives, Purge uses the SECURITY ERASE UNIT command (Secure Erase) or the SANITIZE DEVICE feature set (block eras...
MS-PURGE-3	SCSI Sanitize for Enterprise Drives	SCSI drives are purged using the SANITIZE command set (overwrite, block erase, crypto erase, exit failure mode). Format...
MS-PURGE-4	NVMe Sanitize and Format	NVMe drives use the Sanitize command (block erase, crypto erase, overwrite) or Format NVM with Secure Erase setting. Cry...
MS-PURGE-5	Cryptographic Erase	Cryptographic Erase (CE) sanitizes media by deleting or replacing the media encryption key used by self-encrypting drive...
MS-PURGE-6	Degaussing of Magnetic Media	Degaussing exposes magnetic media to a strong magnetic field, rendering it unreadable. The degausser must be rated for t...
MS-PURGE-7	Magnetic Tape Sanitization	Magnetic tapes are purged by degaussing with an appropriately rated degausser or by destruction. Overwriting tapes is pe...
MS-PURGE-8	Flash Memory (USB, SD, eMMC) Purge	Removable flash media (USB drives, SD cards, eMMC) typically lack standardized purge commands. Where vendor sanitize is...

Verification

4 controls

Controls in the Verification domain of NIST SP 800-88 Rev 1 — 4 controls
Code	Title	Description
MS-VERIFY-1	Verification of Sanitization	Every sanitization action must be verified. Verification confirms the selected method was correctly applied and that res...
MS-VERIFY-2	Full vs Representative Sampling	Full verification reads all addressable locations to confirm sanitization. Where full verification is impractical (e.g.,...
MS-VERIFY-3	Equipment Testing and Calibration	Sanitization equipment (degaussers, shredders, sanitize utilities) must be tested at acquisition, periodically thereafte...
MS-VERIFY-4	Personnel Competency	Personnel performing sanitization must have documented training appropriate to media types and methods used. Competency...

Your Compliance Coverage

If you comply with NIST SP 800-88 Rev 1, you already cover:

ISO 22000:2018

1 controls mapped

Compare →

ISO/IEC 42001:2023

1 controls mapped

Compare →

ISO 37001:2016

1 controls mapped

Compare →

See all 3 mapped frameworks ↓

Maps to 3 other frameworks

29 total controls

ISO 22000:2018

1 source controls mapped|1 target controls covered

ISO/IEC 42001:2023

1 source controls mapped|1 target controls covered

ISO 37001:2016

1 source controls mapped|1 target controls covered

Compare NIST SP 800-88 Rev 1 with ISO 22000:2018

Frequently Asked Questions

What is NIST SP 800-88 Rev 1?

NIST SP 800-88 Rev 1 is a compliance framework from United States with 6 domains and 29 controls. NIST SP 800-88 Revision 1 Guidelines for Media Sanitization. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does NIST SP 800-88 Rev 1 have?

NIST SP 800-88 Rev 1 has 29 controls organised across 6 domains. The largest domains are Destroy (8 controls), Purge (8 controls), Verification (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does NIST SP 800-88 Rev 1 map to?

NIST SP 800-88 Rev 1 maps to 3 other compliance frameworks. The top mapping partners are ISO 22000:2018 (3% coverage), ISO/IEC 42001:2023 (3% coverage), ISO 37001:2016 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with NIST SP 800-88 Rev 1 compliance?

Start your NIST SP 800-88 Rev 1 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-88 Rev 1 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 29 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required