NIST SP 800-88

NIST Special Publication 800-88, Guidelines for Media Sanitization, is the US National Institute of Standards and Technology guidance on removing data from storage media before reuse, release or disposal. The current version is Revision 2, published in September 2025, which supersedes Revision 1 (December 2014), the version much older study material still cites. It defines three sanitisation methods: Clear, which protects against simple non-invasive recovery; Purge, which makes recovery infeasible with state-of-the-art laboratory techniques; and Destroy, which achieves the same while leaving the media unable to store data again. Revision 2 recasts the guidance as a media sanitisation programme, drops most media-specific technique detail in favour of the IEEE 2883 standard, and notes that for cloud and other virtual storage, cryptographic erase may be the only viable purge option.

The guideline links the choice of method to the security categorisation of the information’s confidentiality (in the FIPS 199 sense), whether the media will be reused, and whether it will leave organisational control. It also asks for the outcome to be verified and validated, and documented in a certificate of sanitisation. The three methods correspond to clearing, purging and physical destruction, and the process as a whole is media sanitisation.

Exam relevance: a scenario may name the guideline or simply describe media that has to be retired. Candidates are expected to know the three methods in order of strength, what each one defends against, and that the right method depends on the media type as well as the sensitivity.