NIST 800-88 Data Destruction Explained: What IT Teams Need Before Retiring Devices

That's why most IT and compliance teams point to one standard when they talk about wiping retired devices: NIST Special Publication 800-88, Guidelines for Media Sanitization. This guide explains what NIST 800-88 actually requires, what changed in the latest revision, and what documentation you should expect from any buyback or ITAD partner.

What is NIST 800-88?

NIST SP 800-88 is a set of guidelines from the U.S. National Institute of Standards and Technology for sanitizing storage media, so that data can't be recovered once a device leaves your control. It's widely used by government agencies, schools, healthcare organizations and private companies as the benchmark for responsible device disposal and reuse.

Importantly, NIST 800-88 isn't a single software tool or a "number of overwrite passes." It's a framework for choosing the right sanitization method based on the type of media and the sensitivity of the data, then verifying and documenting the result.

Clear, Purge and Destroy: the three levels

NIST 800-88 describes three categories of sanitization:

• Clear. Uses standard read/write commands to overwrite user-addressable storage, or resets the device to factory state. It protects against simple, non-invasive recovery. Suitable for lower-risk data or devices staying within the organization.
• Purge. Uses methods such as dedicated firmware sanitize commands or cryptographic erase that make data recovery infeasible even with advanced lab techniques. This is the typical target for devices leaving your organization for resale.
• Destroy. Physically renders the media unusable through shredding, disintegration, pulverizing or incineration. Used when media can't be purged, has failed, or holds the most sensitive data.

The key point for IT teams: a device can be properly sanitized and still be reused. Purge-level sanitization lets a working device go back into the market, which is what makes buyback programs possible without trading off security.

What changed in NIST 800-88 Revision 2

NIST published SP 800-88 Revision 2 in September 2025, replacing the 2014 Revision 1. The core idea of Clear, Purge and Destroy remains, but the focus shifted in a few important ways:

• Program-level guidance. Rev. 2 emphasizes building an organization-wide media sanitization program as part of disposal or reuse, not just making device-by-device decisions.
• Updated techniques. Instead of detailed tool tables, it points to current standards such as IEEE 2883 and NSA specifications for sanitization methods.
• Expanded cryptographic erase guidance. It adds detail on key types, key sanitization and when externally managed keys may be acceptable.
• Vendor trust. It puts new emphasis on establishing trust in how vendors implement sanitization.

That last change matters for anyone using an outside partner. Under Rev. 2, "they said they wipe the drives" isn't enough. You should understand and be able to document how your partner sanitizes devices.

Why a factory reset isn't enough

A factory reset is convenient, but on its own it may not meet your organization's obligations. Depending on the device, a reset may not sanitize all storage areas, and it usually leaves no verifiable record for the specific device. If an auditor asks you to prove that a particular laptop was wiped before it was sold, "we reset it" won't hold up.

Before devices leave your control, also remember the steps that protect resale value and prevent lockouts:

• Remove devices from MDM and Apple Business Manager or Apple School Manager
• Turn off Activation Lock / Find My and Google account protections
• Deprovision Chromebooks in the Google Admin console

What is a Certificate of Data Destruction?

A Certificate of Data Destruction is the document that proves your devices were sanitized. It's what you hand to an auditor, a compliance officer or a state reviewer. A useful certificate should include:

• The serial number of every device covered
• The sanitization method used and the standard followed (for example, NIST SP 800-88)
• Whether each device was cleared, purged or destroyed
• The date of sanitization and who performed it
• Your organization's name and a reference to the specific shipment or pickup

A certificate that lists only a total device count, with no serial numbers, is much weaker evidence. Serial-level tracking is what ties each retired asset back to your records.

Questions to ask your ITAD or buyback partner

1. Which standard do you follow, and is it NIST SP 800-88?
2. Which method do you use for each device type (laptops, phones, tablets, Chromebooks)?
3. How do you verify that sanitization worked?
4. Do I get a serial-tracked certificate, and how quickly?
5. What happens to media or devices that can't be wiped?
6. How is my equipment secured between pickup and sanitization?

How Refreshed Tech handles data destruction

Every device Refreshed Tech buys is sanitized to NIST 800-88 at our facility in Ashley, Indiana. You receive a serial-tracked Certificate of Data Destruction and serial-level inspection logs, and any media that can't be reused goes through certified destruction. For schools, our records are built to be audit-ready for state reviews.

That means you can recover value from retired devices through a buyback, without trading off security or compliance.

Retire devices with confidence

Whether you're refreshing a corporate laptop fleet or a district's Chromebooks, start with a partner who can document every device. See our enterprise buyback program, our education program, or request a quote to get itemized pricing within one business day.

This article is general information, not legal or compliance advice. Check your organization's own policies and regulatory requirements.