When you delete a file, it's not really gone. That's why NIST 800-88 exists, it's the gold standard for data destruction that ensures your sensitive information is permanently and verifiably eliminated.
What is NIST 800-88?
NIST Special Publication 800-88, officially titled "Guidelines for Media Sanitization," is published by the National Institute of Standards and Technology (NIST). It provides comprehensive guidelines for properly sanitizing data from various types of storage media.
Originally developed for federal agencies, the NIST 800-88 standard has been widely adopted by the private sector as the benchmark for secure data destruction. Revision 2, published in September 2025, is the current version; it superseded Revision 1 (2014).
The Three Levels of Media Sanitization
NIST 800-88 defines three distinct levels of data sanitization, each appropriate for different security requirements:
Clear
Clear uses logical techniques to sanitize data, typically through overwriting. This level protects against simple data recovery attempts using standard software tools.
- Allows media to be reused
- Best for: Low-sensitivity data, internal equipment redeployment
- Method: Software-based overwriting of all addressable storage locations
Purge
Purge applies physical or logical techniques that render data recovery infeasible even with state-of-the-art laboratory techniques.
- Higher security than Clear
- Best for: Moderate sensitivity data, equipment being sold externally
- Methods: Degaussing, cryptographic erase, or approved secure overwrite patterns
Destroy
Destroy renders the storage media completely unusable through physical destruction. This is the highest security level.
- Media cannot be reused
- Best for: Highly confidential data, maximum security requirements
- Methods: Shredding, incineration, disintegration, pulverization. Revision 2 notes that partial damage such as drilling or bending does not by itself meet Destroy.
EverTrade's in-house process is NIST SP 800-88-aligned sanitization for eligible reusable drives and physical disabling for end-of-life drives before recycling; we do not represent the physical step as the formal Destroy method. Learn more about our data destruction services.
NIST 800-88 vs Other Standards
| Standard | Origin | Use Case |
|---|---|---|
| NIST 800-88 | US Federal (NIST) | Most comprehensive, widely adopted |
| DoD 5220.22-M | US Department of Defense | Legacy standard, still referenced |
| HIPAA | HHS | Healthcare PHI requirements |
| PCI-DSS | Payment Card Industry | Credit card data |
Which Devices Require NIST 800-88 Sanitization?
Any device capable of storing data should be considered:
- Hard disk drives (HDD) - Traditional spinning drives
- Solid state drives (SSD) - Require special consideration
- USB drives and flash media - Easily overlooked but often contain sensitive data
- Mobile devices - Phones, tablets with internal storage
- Magnetic tapes - Common in enterprise backup systems
- Copiers and printers - Many have internal hard drives
- Network equipment - Routers and switches with configuration data
Why SSDs Require Special Attention
Solid state drives present unique challenges for data sanitization that many businesses don't realize:
- Traditional overwriting doesn't work - SSDs use wear leveling, which distributes writes across the drive, leaving data in inaccessible areas
- Over-provisioning hides data - Extra storage capacity not visible to the operating system may contain old data
- Block remapping - Failed blocks are remapped but may still contain data
For SSDs, NIST 800-88 recommends either cryptographic erase (if supported by the drive) or physical destruction. Many ITAD providers who claim to follow NIST 800-88 don't properly handle SSDs, make sure to ask.
NIST 800-88 Compliance for Houston Industries
Healthcare
HIPAA requires "appropriate safeguards" for PHI disposal. NIST 800-88 is the accepted standard for demonstrating compliance. Certificates of Destruction are essential for audits.
Learn about our healthcare ITAD services →
Financial Services
GLBA, FACTA, and SOX requirements mandate proper destruction of customer financial data. Documentation and audit trails are critical for compliance.
See our financial services solutions →
Energy Sector
Houston's energy companies handle proprietary exploration and operational data. A documented NIST SP 800-88-aligned process can help protect that information when devices are retired.
Legal
Attorney-client privilege extends to digital data. Texas Bar ethics requirements and client file destruction policies make proper data destruction non-negotiable for law firms.
Explore our legal industry services →
How to Verify a NIST SP 800-88-Aligned Process
When evaluating an ITAD provider, verify its process by:
- Requesting written documentation of sanitization methods used
- Requiring Certificates of Destruction that include individual serial numbers
- Verifying the provider follows the current NIST SP 800-88 guidance
- Checking for third-party certifications like NAID AAA
- Asking for a sample certificate before engaging services
Certificate of Destruction: What to Look For
A proper Certificate of Destruction should include:
- Date and time of destruction
- Method used (Clear, Purge, or Destroy)
- Serial numbers of all devices processed
- Technician name who performed the destruction
- Provider identification and applicable downstream credentials
- Chain of custody documentation
Read our complete guide to Certificates of Data Destruction →
Get NIST SP 800-88-Aligned Data Destruction
NIST 800-88 is the standard Houston businesses should demand from their ITAD provider. It can reduce data-exposure risk, support compliance obligations, and provide documentation for audits.