NIST Special Publication 800-88 Revision 1, 'Guidelines for Media Sanitization,' is the U.S. National Institute of Standards and Technology's standard for permanently removing data from storage media. It defines three sanitization levels — Clear, Purge, and Destroy — and tells you which to use for each media type and data-sensitivity level.

What is the difference between Clear, Purge, and Destroy?

Clear is a logical overwrite that defeats ordinary recovery tools and is fine for reuse inside an organization. Purge is a stronger sanitize (cryptographic erase, block erase, or overwrite) that defeats laboratory recovery and is the right level for media leaving your control. Destroy is physical destruction — shredding, disintegration, melting — for the highest assurance.

Is NIST 800-88 the same as DoD 5220.22-M?

No. DoD 5220.22-M is an older multi-pass overwrite specification. NIST 800-88 has largely superseded it for modern drives because multi-pass overwrites don't map cleanly to SSDs and flash. Many contracts still name DoD 5220.22-M, and CTS can sanitize to it where required.

Does NIST 800-88 require a certificate?

NIST 800-88 calls for verification and documentation of sanitization. In practice that means a certificate of destruction per device serial number, which is what an auditor or security questionnaire expects.

NIST 800-88 Explained: Clear, Purge, and Destroy

NIST SP 800-88 Rev. 1 is the U.S. standard for media sanitization — permanently removing data from storage media so it cannot be recovered. It’s the reference almost every American data-destruction policy, security questionnaire, and compliance auditor points to. If you retire drives and someone asks “how do you know the data is gone?”, NIST 800-88 is the answer that ends the conversation.

Here’s what it actually says, and how to apply it.

The core idea: match the method to the risk

NIST 800-88 doesn’t prescribe one technique. It defines three levels of sanitization and tells you to choose based on the media type and how sensitive the data is, plus whether the media will leave your control. The three levels are Clear, Purge, and Destroy.

Clear

Clear applies logical techniques — typically a standard overwrite using the device’s normal read/write commands — to sanitize data in all user-addressable storage. It protects against recovery using ordinary, non-invasive tools.

Clear is appropriate when the media will be reused inside the same organization and the data isn’t highly sensitive. It’s the lightest level.

Purge

Purge applies physical or logical techniques that make data recovery infeasible even with state-of-the-art laboratory methods. Depending on the media, Purge can mean:

Cryptographic erase — destroying the encryption key on a self-encrypting drive, which instantly makes all data unrecoverable.
Block erase — a firmware-level command that resets the storage cells (used for SSDs).
Overwrite — for drives that support a verified, thorough overwrite.

Purge is the right level for most drives leaving your control — going to resale, redeployment elsewhere, or recycling — including SSDs, where Clear-level overwrites aren’t trustworthy.

Destroy

Destroy physically destroys the media so it can never be reused: shredding (to a small particle size), disintegration, incineration, or melting. It’s the highest assurance and the right call for failed drives that can’t be verified, or for the most sensitive data.

How the levels map to media

This is where teams get it wrong — applying an HDD technique to an SSD. The media dictates the method:

Magnetic hard drives (HDD): overwrite (Clear/Purge), degauss (Purge — a magnetic field erases the platters), or shred (Destroy).
Solid-state drives (SSD/NVMe): do not rely on multi-pass overwrites. Flash wear-leveling spreads writes across cells, so an overwrite may miss data. Use cryptographic erase or block erase (Purge), or shred to under 2mm (Destroy).
Self-encrypting drives: cryptographic erase is fast and complete.
Magnetic tape: degauss or shred.
Mobile and embedded flash: treat like SSDs.

For the practical breakdown, see SSD vs HDD destruction.

Verify, then document

A sanitization isn’t finished when the command runs — NIST 800-88 calls for verification that it worked, and documentation that it happened. In practice:

Verification: confirm the drive reads clean (for wipes) or reconcile the shred load against the serial manifest (for destruction).
Documentation: a certificate of destruction per serial number, so your audit trail maps to individual assets, not a single bulk statement.

That paper trail is the deliverable an OCR auditor (HIPAA), an examiner (GLBA/FINRA), or a customer security questionnaire actually asks for.

NIST 800-88 vs DoD 5220.22-M

You’ll still see DoD 5220.22-M named in contracts — it’s the older three-pass overwrite spec. It’s not wrong for magnetic drives, but NIST 800-88 has largely superseded it because the multi-pass logic doesn’t fit modern SSDs, and because NIST’s risk-based framework is more complete. IEEE 2883-2022 is the newer standard purpose-built for flash. CTS sanitizes to whichever your policy or contract names.

How this works in practice

When CTS handles a fleet, we classify the data on each device, pick the NIST 800-88 level that fits the media and sensitivity, verify the result, and issue a certificate per serial. Healthy drives that can be safely purged are wiped and resold — recovering value instead of shredding it — while failed or highly sensitive media is destroyed.

That’s the whole point of a standard: it turns “trust us, it’s gone” into a documented, defensible process. See how it runs end to end on our data destruction and hard drive destruction pages, or talk to the team about your fleet.