NIST SP 800-88 Rev 2
NIST's September 2025 revision of the media sanitization guideline: the clear, purge and destroy methods and when each is appropriate, the conditions under which cryptographic erase counts as purge (validated cryptography of at least 128 bits, no prior plaintext, every copy of the target keys zeroized, escrowed and injected keys accounted for, implementation quality evidenced and the operation traceable), and the elements of a media sanitization programme from policy and scope through the decision framework, performance, verification, validation, certificates of sanitization and programme roles, plus the sanitize-command information to obtain from vendors.
NIST SP 800-88 Rev 2 is a compliance framework from United States (federal information systems; adopted internationally as practice) with 4 domains and 30 controls. The largest domains are Section 4: the media sanitization programme (policy, scope, decision framework, performance, assurance, documentation, roles) – NIST SP 800-88 Rev 2 (15 controls), Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2 (11 controls), Sections 1 and 2: purpose, scope, audience, media types, the target of sanitization and decision factors – NIST SP 800-88 Rev 2 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Appendices B and C: device-specific characteristics to obtain from vendors and the sample certificate of sanitization – NIST SP 800-88 Rev 2
| Code | Title |
|---|---|
| nist-sp-800-88-rev-2::B | Obtain from ISM vendors the media type and coercivity, each supported sanitize command with the areas it does not address, its expected duration and any validation results, and its conformance to IEEE 2883, and verify command behaviour rather than trusting the name |
Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2
| Code | Title |
|---|---|
| nist-sp-800-88-rev-2::3 | Categorise the information, assess the media and the confidentiality risk, decide the media's future, then choose and justify the sanitization method |
| nist-sp-800-88-rev-2::3.1 | Use the three methods (clear, purge, destroy) with technology-specific techniques kept current against IEEE 2883, matched carefully to the media type |
| nist-sp-800-88-rev-2::3.1.1 | Clear: logical techniques over the user interface against simple recovery; not for hard copy; avoid multi-pass overwriting on overprovisioned flash; use dedicated sanitize commands or factory reset where rewriting is unsupported |
| nist-sp-800-88-rev-2::3.1.2 | Purge: physical or logical techniques that defeat laboratory recovery while keeping the ISM reusable; prefer purge to clear; choose techniques from IEEE 2883; cryptographic erase may be the only purge option for virtual storage; degauss only magnetic media with a matched degausser |
| nist-sp-800-88-rev-2::3.1.3 | Destroy: render recovery infeasible and the media unusable by disintegrating, incinerating, melting, pulverizing or shredding; partial damage does not count; avoid shred and pulverize for dense media above the lowest category |
| nist-sp-800-88-rev-2::3.2 | Cryptographic erase as a purge technique: sanitize or block access to the keys that encrypt the data; federal agencies use modules validated to the current FIPS 140 standard |
| nist-sp-800-88-rev-2::3.2.1 | Strength of cryptography for CE: at least 128-bit security strength, entropy at least equal to the key length, and the Table 1 requirements on key generation, media encryption, key wrapping and key derivation |
| nist-sp-800-88-rev-2::3.2.2 | Applicability of CE: only where no sensitive plaintext was ever stored since the last sanitization, with caution for long-lived sensitivity, and never trusted where keys were backed up or escrowed without control |
| nist-sp-800-88-rev-2::3.2.3 | Sanitization of keys: zeroize every copy of the target cryptographic keys and all keys beneath them, eliminate unwrapped copies in volatile memory or registers, and consider external key recovery paths |
| nist-sp-800-88-rev-2::3.2.4 | Quality of cryptographic implementations: obtain independent validation or vendor evidence on entropy and key generation, algorithm and mode implementation, key sanitization technique and wrapping strength; federal agencies require FIPS 140 validation |
| nist-sp-800-88-rev-2::3.2.5 | Traceability of CE: document make and model, key generation, media encryption, key wrapping, encrypted and unencrypted areas, key life cycle handling, key sanitization technique, escrow or injection, error handling and interface commands, and how external key copies were dealt with |
Section 4: the media sanitization programme (policy, scope, decision framework, performance, assurance, documentation, roles) – NIST SP 800-88 Rev 2
| Code | Title |
|---|---|
| nist-sp-800-88-rev-2::4 | Make storage sanitization part of data governance with, at minimum, disposal policies and minimum methods, scope and decision criteria, performance of sanitization, adequacy determination and the records needed for compliance |
| nist-sp-800-88-rev-2::4.1 | Storage sanitization policy: align data classification with minimum methods; set disposal and reuse requirements, expected outcomes and acceptable techniques, documentation, roles and competencies, tool calibration and maintenance, and the vendor assurances required |
| nist-sp-800-88-rev-2::4.2 | Scope: unclassified federal ISM never holding FOUO, Privacy Act or PII need no sanitization; otherwise target all user data, treat selective and partial sanitization as risky, and prefer whole-ISM sanitization while allowing partial CE where justified |
| nist-sp-800-88-rev-2::4.3 | Decision framework: identify the confidentiality level under FIPS 199 and SP 800-60, accept clear for moderate data only as a conscious risk decision, weigh purge or clear against destroy for lease returns, environment, reuse, cost and feasibility, and decide on confidentiality rather than media type |
| nist-sp-800-88-rev-2::4.3.1 | Plan sanitization from the system security plan onward: choose ISM with sanitization in mind, obtain Statements of Volatility and the Appendix B characteristics, identify every ISM inside each item, combine techniques such as CE before shipment, and dispose without sanitization only where disclosure would cause no harm |
| nist-sp-800-88-rev-2::4.3.2 | Security categorisation set early under FIPS 199, SP 800-60 or CNSSI 1253, revisited at least every three years or on significant change, and internal confidentiality labels assigned to uncategorised information such as hard copy |
| nist-sp-800-88-rev-2::4.3.3-4.3.4 | Decide on reuse (destroy is simplest when media will not be reused) and account for who controls the media: maintenance under contract or on-site supervision stays under organisational control, warranty exchanges and other non-returned media do not, and legal rules may treat loss of unsanitized media as a breach |
| nist-sp-800-88-rev-2::4.3.5 | Consider the data protection level alongside organisational control when deciding whether sanitization is necessary |
| nist-sp-800-88-rev-2::4.3.6 | Make and record the risk-based sanitization decision, then put the process, resources, verification steps and interfaces with key officials in place to carry it out |
| nist-sp-800-88-rev-2::4.4 | Perform sanitization by the selected method in line with IEEE 2883 or another policy-approved standard, using the most protective available technique, capturing results and documentation details, and following manufacturer and STIG configuration guidance |
| nist-sp-800-88-rev-2::4.5 | Assure sanitization by inspecting results and deciding adequacy; repeat with a different technique or a stronger method when unacceptable, rechecking reusability |
| nist-sp-800-88-rev-2::4.5.1 | Verify the outcome: inspect destruction remnants and equipment; for logical techniques check tool completion status, errors, anomalies and media health; for physical purge confirm the equipment completed; elaborate sampling is unnecessary unless policy requires it |
| nist-sp-800-88-rev-2::4.5.2 | Validate effectiveness: analyse errors and anomalies, assess confidentiality risk, and reject the sanitization where inaccessible areas, an inappropriate method, unqualified personnel or uncalibrated tools, substandard outcomes or too narrow a scope leave residual risk unacceptable |
| nist-sp-800-88-rev-2::4.6 | Document each sanitized ISM on a certificate of sanitization recording manufacturer, model, serial and property numbers, media type and source, prior category, method, technique, tool and version, verification method and the verifier and validator details; remove old confidentiality markings; track media from introduction to final destination |
| nist-sp-800-88-rev-2::4.7 | Assign programme roles: programme managers and agency heads for governance and resources, the CIO for policy, system owners for protective maintenance contracts, information owners for supervised on-site maintenance, the SAISO for implementation, system security officers for coordination, property management for tracking sanitized ISM, records management for retention advice, the privacy officer for privacy disposition and users for handling information correctly |
Sections 1 and 2: purpose, scope, audience, media types, the target of sanitization and decision factors – NIST SP 800-88 Rev 2
| Code | Title |
|---|---|
| nist-sp-800-88-rev-2::1.1-RET | Consult privacy, FOIA and records retention officials and organisational management before sanitizing, so that Federal Records Act retention duties and business history needs are met |
| nist-sp-800-88-rev-2::2.3 | Target of sanitization: all user data when sensitive data cannot be selectively removed, and the full physical capacity including overprovisioned and compressed areas |
| nist-sp-800-88-rev-2::2.4 | Weigh the decision factors: media type, size and capacity, confidentiality requirement, controlled area, in-house or third party, on-site or off-site, volume, equipment, training, duration and cost |
What is NIST SP 800-88 Rev 2 and who does it apply to?
NIST SP 800-88 Rev 2 is a compliance framework from United States (federal information systems; adopted internationally as practice) with 4 domains and 30 controls. NIST's September 2025 revision of the media sanitization guideline: the clear, purge and destroy methods and when each is appropriate, the conditions under which cryptographic erase counts as purge (validated cryptography of at least 128 bits, no prior plaintext, every copy of the target keys zeroized, escrowed and injected keys accounted for, implementation quality evidenced and the operation traceable), and the elements of a media sanitization programme from policy and scope through the decision framework, performance, verification, validation, certificates of sanitization and programme roles, plus the sanitize-command information to obtain from vendors. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-88 Rev 2 actually require?
NIST SP 800-88 Rev 2 has 30 controls organised across 4 domains. The largest domains are Section 4: the media sanitization programme (policy, scope, decision framework, performance, assurance, documentation, roles) – NIST SP 800-88 Rev 2 (15 controls), Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2 (11 controls), Sections 1 and 2: purpose, scope, audience, media types, the target of sanitization and decision factors – NIST SP 800-88 Rev 2 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-88 Rev 2 do I already cover?
NIST SP 800-88 Rev 2 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST SP 800-88 Rev 2?
Start your NIST SP 800-88 Rev 2 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-88 Rev 2 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 30 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required