Why Wiping Isn't Destroying: NIST 800-88 Guide

“We wiped the drives” sounds like data security but often isn’t. The real question is which of the three NIST 800-88 sanitization methods was used, whether it was appropriate for the media type, and whether it was documented in a way that survives an audit.

TL;DR

“Wiping” is not a defined technical term. It’s a casual word that can describe anything from deleting files to a single-pass overwrite to a multi-pass certified sanitization. When an ITAD vendor or internal IT team says “we wiped the drives,” the question that matters is which NIST 800-88 method did they actually use.

NIST Special Publication 800-88 defines three sanitization methods:

Method	What It Does	When It’s Appropriate
Clear	Logical sanitization protecting against keyboard-level recovery attempts	Reuse within the same organization at the same classification level
Purge	Renders data unrecoverable even to laboratory-grade forensic attempts	Reuse outside the organization, downgrade in classification
Destroy	Physically renders the media unusable and unreconstructable	High-sensitivity data, equipment leaving organizational control entirely

Three things make this distinction matter more than ever in 2026:

Modern storage isn’t traditional HDDs. SSDs and NVMe drives have wear leveling and over-provisioning that defeat simple overwrite. The methods that worked on spinning disks fail on flash.
Compliance frameworks reference NIST 800-88 by name. HIPAA, FedRAMP, PCI DSS, SOC 2, and increasing state privacy laws expect documented method selection, not just “we wiped it.”
Non-obvious storage gets missed. Routers, switches, supervisor cards, and management modules contain flash memory that holds configurations, routing tables, and credentials. A program that addresses drives but ignores networking gear has gaps that show up in audit.

The cost of getting this wrong isn’t always a dramatic breach. It’s the audit finding that requires remediation, the customer review that finds documentation gaps, the SOC 2 control failure that appears in a report, or the slow-burn reputation damage when serial numbers from your equipment surface in places they shouldn’t.

This guide covers what each NIST method actually means operationally, how to match methods to storage types and data classifications, what documentation should accompany each sanitization, and how to evaluate whether a vendor’s “we wiped it” actually means what it should.

The Wiping vs Destroying Confusion

Most data security failures in ITAD don’t come from sophisticated attacks. They come from imprecise language masking imprecise process.

“Wipe” is a word with no defined technical meaning. Different people use it to mean:

“I deleted the files” (which doesn’t sanitize at all)
“I formatted the drive” (which doesn’t sanitize either)
“I ran a software overwrite” (which may or may not be sufficient depending on method and media)
“I ran a NIST-approved sanitization” (which is fine, but the specifics matter)
“I sent it to a vendor who handled sanitization” (where the actual method may be unknown)

When all five conversations use the same word, the result is everyone assumes data was protected when only one of those activities actually protected it.

The same problem affects “destroy.” It can mean physical shredding, drilling holes through drives, cryptographic erasure, secure factory reset, or just “the vendor handled it.” Without method specificity, the word is decorative rather than meaningful.

The fix is treating sanitization as a technical decision with three defined outcomes, not a single binary action with one casual label.

NIST 800-88: The Three Sanitization Methods

NIST Special Publication 800-88 Revision 1, published by the National Institute of Standards and Technology, is the U.S. federal standard for media sanitization. It defines three sanitization categories with specific technical requirements.

Clear

Logical sanitization that protects against keyboard-level recovery attempts. Includes:

File deletion plus directory overwrite
Quick format with overwrite of file system structures
Single-pass overwrite of accessible storage areas
ATA Security Erase (when supported by the drive)

When Clear is appropriate: Equipment staying within the same organization, at the same data classification level. Internal redeployment scenarios. Low-sensitivity environments where simple sanitization meets the risk profile.

Where Clear falls short: Doesn’t protect against laboratory-grade forensic recovery. Inappropriate for media that will leave organizational control. Insufficient for high-sensitivity data classifications.

Purge

Renders data unrecoverable even to laboratory-grade forensic attacks. Methods vary by media type:

Hard disk drives: Multi-pass overwrite (single-pass overwrite is also acceptable under NIST 800-88 Rev. 1, but many organizations prefer multi-pass), degaussing for older drives
SSDs and NVMe: ATA Secure Erase (Enhanced), NVMe Sanitize commands, cryptographic erase for self-encrypting drives
Optical media: Not applicable to Purge; requires Destroy
Tape: Degaussing or multi-pass overwrite

When Purge is appropriate: Equipment leaving the organization but with disposition tracking. Reuse outside the original organization at the same or lower classification. Most enterprise resale and remarketing scenarios.

Where Purge falls short: Media with damaged controllers may not respond to Purge commands reliably. High-sensitivity data classifications often require Destroy. Some compliance frameworks (FedRAMP moderate-and-above) require Destroy regardless of intent.

Destroy

Physically renders the media unusable and unable to be reconstructed. Methods include:

Shredding to specific particle sizes (often 2mm or smaller for high security)
Disintegration (mechanical pulverization)
Pulverization (typically thermal or mechanical reduction to powder)
Melting (less common, used for specific high-security scenarios)
Incineration (only via certified facilities)

When Destroy is appropriate: High-sensitivity data classifications. Equipment leaving organizational control entirely. FedRAMP and federal environments. Healthcare and financial services with specific media disposal requirements. Damaged media that can’t reliably accept Purge.

Practical consideration: Destroy eliminates secondary-market value. Equipment that’s destroyed isn’t recoverable for asset recovery. The decision to Destroy vs Purge is partly a data security decision and partly a financial decision.

When Each Method Is Appropriate

The right method depends on three variables: data sensitivity, where the equipment is going, and the compliance framework applying.

Data Classification	Destination	Recommended Method
Low sensitivity	Internal redeployment	Clear
Low sensitivity	External (resale, transfer)	Purge
Moderate sensitivity	Internal redeployment	Clear or Purge (Purge preferred)
Moderate sensitivity	External (resale, transfer)	Purge
High sensitivity	Internal redeployment	Purge
High sensitivity	External (resale, transfer)	Destroy
Federal/FedRAMP moderate+	Any	Destroy
Customer-controlled data	External (resale, transfer)	Per customer contract (often Destroy)
Damaged media	Any	Destroy

The decision framework should be documented per asset, not blanket-applied across an entire retirement project. A single retirement event may include some assets that warrant Clear, some that warrant Purge, and some that warrant Destroy. Sophisticated sanitization operations make these determinations at the asset level.

Why “Wipe” Without Method Is Dangerous

The risk isn’t usually that someone uses the wrong method. The risk is that no method is explicitly selected at all, because “wipe” is treated as a single action rather than a technical decision.

The pattern that produces breaches:

Step	What Happens
Retirement project initiated	“We need to wipe these drives”
Method selection	No explicit decision, vendor defaults to whatever they typically do
Execution	Vendor runs their standard process (often a single-pass overwrite or quick format)
Documentation	“Drives wiped” with no method specification
Equipment leaves	Sold to secondary market
Audit or breach	Method used was insufficient for data classification or media type

Each step is consistent with what the organization thought it was doing. Nobody made an obvious mistake. The mistake was treating method selection as something that happens automatically rather than something that requires deliberate decision-making per asset class.

The fix is operational, not technical. The data destruction policy needs to specify:

Who decides which method applies to which media in which context
What criteria drive the decision (data classification, destination, compliance framework)
What documentation captures the decision and execution
What verification confirms the method was actually performed as specified

Organizations with this discipline don’t have data destruction failures. Organizations without it eventually do.

Storage-Specific Considerations

Different storage technologies have different sanitization characteristics. Methods that work on one media type may fail on another.

Traditional HDDs (Spinning Disks)

Hard disk drives store data magnetically on platters that can be overwritten reliably:

Clear: Single-pass overwrite is generally sufficient under NIST 800-88 Rev. 1, though multi-pass is often preferred operationally
Purge: Multi-pass overwrite, ATA Security Erase, or degaussing
Destroy: Shredding (particle size depending on classification), disintegration, or incineration

HDDs are the easiest media type to sanitize correctly. The methods are well-established and reliable.

SSDs (SATA/SAS)

Solid-state drives use NAND flash with wear leveling and over-provisioning that make traditional overwrite unreliable. Data may persist in over-provisioned blocks that aren’t accessible to standard write commands.

Clear/Purge: ATA Secure Erase (Enhanced), cryptographic erase for self-encrypting drives, or NIST 800-88-validated SSD sanitization tools
Destroy: Shredding to particle sizes appropriate to data sensitivity (typically 6mm or smaller)

Critical: Single-pass overwrite of an SSD using HDD-era tools does NOT sanitize the drive. Data persists in over-provisioned blocks and possibly in spare areas. This is the most common SSD sanitization failure.

NVMe Drives

NVMe drives extend the SSD complications with even more sophisticated controller architectures:

Clear/Purge: NVMe Sanitize commands (Block Erase, Crypto Erase, or Overwrite, depending on what the drive supports), cryptographic erase for self-encrypting drives
Destroy: Shredding at high security particle sizes

The IEEE 2883-2022 standard was published specifically to address modern storage including NVMe. Sophisticated data destruction operations reference IEEE 2883 alongside NIST 800-88 for modern storage handling.

Self-Encrypting Drives (SEDs)

Drives with built-in hardware encryption (Opal, Enterprise SED) can be sanitized via cryptographic erase, which destroys the encryption key. Without the key, data becomes mathematically unrecoverable.

Time: Cryptographic erase typically completes in seconds rather than hours
Reliability: Equivalent to Purge if the drive’s cryptographic implementation is sound
Verification: Must verify the key destruction completed successfully

Cryptographic erase is increasingly the preferred Purge method when SED capability exists.

Flash Memory on Networking Equipment

This is the storage type most commonly missed in retirement programs. Routers, switches, supervisor cards, and management modules contain flash memory that holds:

Running and saved configurations
Routing tables and ARP caches
VPN credentials and certificates
SSH keys and authentication data
Operational logs

Sanitization on networking equipment typically requires:

Configuration zeroization (vendor-specific commands)
Factory reset followed by configuration overwrite
For high-security environments, physical destruction of flash chips

Operational reality: Many retirement programs sanitize drives but don’t address networking equipment flash memory. The equipment leaves with sensitive operational data intact.

Tape Media

Tape storage uses different sanitization methods:

Clear: Overwrite at the tape level
Purge: Degaussing (for magnetic tape) or multi-pass overwrite
Destroy: Physical destruction including incineration for high-security environments

Tape is increasingly rare in modern data center environments but persists in archival and backup scenarios.

The Compliance Landscape Requiring Documented Methods

Multiple regulatory and audit frameworks now expect documented sanitization method selection, not just “we destroyed the data.”

HIPAA

The Health Insurance Portability and Accountability Act covers protected health information. The HIPAA Security Rule requires covered entities to implement policies and procedures for disposal of electronic media. The U.S. Department of Health and Human Services recommends NIST 800-88 as the implementation standard.

Practical implication: A HIPAA-covered entity using a generic “wipe” without documented NIST 800-88 method selection is operating outside the recommended implementation guidance, even if the wipe was technically effective.

GDPR

The General Data Protection Regulation, applicable in the EU and to organizations handling EU residents’ data, requires that personal data be properly disposed of when no longer necessary. Article 17 (right to erasure) sets the standard.

GDPR doesn’t prescribe specific sanitization methods, but auditors expect documented procedures that demonstrate disposal effectiveness. NIST 800-88 (or equivalent international standards) is the most commonly referenced framework.

PCI DSS 4.0

The Payment Card Industry Data Security Standard 4.0 includes specific requirements for secure destruction of cardholder data. Requirement 9.4 covers physical security including secure destruction. Requirement 3.5 addresses cryptographic key management including key destruction.

PCI DSS specifically references NIST 800-88 as a recognized standard for media sanitization. Organizations handling cardholder data need documented sanitization processes aligned to NIST methods.

FedRAMP

The Federal Risk and Authorization Management Program covers cloud services serving federal customers. FedRAMP authorization requires NIST 800-88 sanitization with specific method requirements:

Moderate baseline: NIST 800-88 Purge or Destroy
High baseline: NIST 800-88 Destroy required
ITAR-controlled equipment may require additional handling

Cloud providers serving FedRAMP customers need ITAD partners with NIST 800-88 capability across all three methods and ITAR compliance.

SOC 2 Type II

SOC 2 audits examine security controls over an operational period. ITAD practices fall within audit scope:

Documentation of sanitization methods used
Evidence that methods were appropriate to data sensitivity
Chain-of-custody from removal through final disposition
Vendor management for third-party sanitization

Cloud providers and SaaS vendors with SOC 2 obligations need ITAD partners that produce SOC 2-ready documentation.

State Privacy Laws

State-level privacy laws (CCPA/CPRA, Texas Data Privacy Act, Virginia CDPA, and others) increasingly include data disposal requirements. The pattern is toward stricter, not looser, expectations.

Documentation Requirements: What a Real Certificate of Destruction Includes

The Certificate of Destruction (CoD) is the audit-ready record of sanitization. A CoD that meets professional standards includes:

Element	Detail
Asset identifier	Serial number, asset tag, or other unique identifier
Media type	HDD, SSD, NVMe, tape, networking equipment flash, etc.
Sanitization method	NIST 800-88 Clear, Purge, or Destroy with specific technique
Standard referenced	NIST 800-88, IEEE 2883, DoD 5220.22-M, or other applicable standard
Date and time	When sanitization was performed
Technician identifier	Who performed the sanitization
Verification method	How completion was verified (read-back, sample verification, witness, etc.)
Chain of custody	From receipt through final disposition
Disposition	What happened after sanitization (reuse, destruction, recycling)
Witness signature	When required by data classification

A CoD that says only “drive wiped” with a date isn’t audit-ready. It doesn’t demonstrate which method was used, whether it was appropriate to the media, or whether it was verified.

Sophisticated ITAD operations produce per-asset CoDs at this depth as standard documentation. Vendors that produce only summary “we processed X drives” reports operate at a fundamentally different level than vendors that produce per-asset audit trails.

How to Evaluate a Data Destruction Vendor

Five questions that separate genuine NIST 800-88 capability from generic “we wipe drives” claims:

1. Method selection process

“How do you select which NIST 800-88 method to apply per asset?”

The answer should reference data classification, destination, media type, and compliance framework. Vendors that have a “we always do X” answer aren’t doing actual method selection.

2. Modern storage handling

“How do you handle NVMe, SSDs, and self-encrypting drives differently than traditional HDDs? What standards do you reference?”

The answer should include NIST 800-88 plus IEEE 2883 for modern storage. Vendors that don’t mention IEEE 2883 are operating with potentially outdated methods for modern equipment.

3. Non-obvious storage

“How do you address flash memory on networking equipment, supervisor cards, and management modules?”

The answer should include vendor-specific zeroization procedures and physical destruction options. Vendors that don’t address networking equipment flash have a meaningful gap.

4. Documentation depth

“What does your Certificate of Destruction include, and can you provide a sample?”

The CoD should include the elements listed earlier. If a vendor’s “sample CoD” is a one-page summary, that’s the documentation depth you’ll receive.

5. Verification and chain of custody

“How do you verify sanitization completion, and what chain-of-custody documentation accompanies the equipment?”

The answer should reference specific verification methods (read-back, sample testing, witness signatures for high-sensitivity assets) and continuous documented chain-of-custody from receipt through final disposition.

Frequently Asked Questions

What’s the difference between wiping and destroying data?

“Wiping” is informal terminology that can describe anything from deletion to certified sanitization. “Destroying” specifically refers to NIST 800-88 Destroy methods that physically render the media unusable. The terms aren’t interchangeable, and using them imprecisely creates real audit and compliance gaps. Best practice is to use the NIST 800-88 vocabulary (Clear, Purge, Destroy) when discussing sanitization rather than “wipe” or “destroy” alone.

Is overwriting a drive enough to destroy data?

It depends on the media type. For traditional HDDs, a properly executed single-pass overwrite meets NIST 800-88 Clear or Purge standards depending on verification. For SSDs and NVMe drives, simple overwrite is insufficient because of wear leveling and over-provisioning. Modern storage requires ATA Secure Erase, NVMe Sanitize commands, cryptographic erase, or physical destruction.

What is NIST 800-88?

NIST Special Publication 800-88 Revision 1 is the U.S. federal standard for media sanitization, published by the National Institute of Standards and Technology. It defines three sanitization categories (Clear, Purge, and Destroy) with specific technical requirements for different media types. NIST 800-88 is referenced by HIPAA, PCI DSS, FedRAMP, and most enterprise data destruction policies as the implementation standard.

What are the three NIST 800-88 sanitization methods?

Clear (logical sanitization protecting against keyboard-level recovery), Purge (renders data unrecoverable even to laboratory-grade forensic attacks), and Destroy (physically renders the media unusable and unable to be reconstructed). The appropriate method depends on data sensitivity, destination, and applicable compliance framework. NIST 800-88 provides specific technical implementations for each method by media type.

How do you destroy data on SSDs?

SSDs require methods that account for wear leveling and over-provisioning. Acceptable approaches include ATA Secure Erase (Enhanced) for SATA SSDs, NVMe Sanitize commands for NVMe drives, cryptographic erase for self-encrypting drives, or physical destruction (shredding to appropriate particle sizes). Standard HDD overwrite tools do not reliably sanitize SSDs because data can persist in over-provisioned blocks that aren’t accessible to write commands.

What is IEEE 2883?

IEEE 2883-2022 is a standard published by IEEE in 2022 that addresses sanitization of modern storage technologies including NVMe drives, shingled magnetic recording (SMR), and other current-generation media. It complements NIST 800-88 by providing more granular guidance for storage types that emerged after NIST 800-88 Rev. 1 was published in 2014. Sophisticated data destruction operations reference both standards.

Does encryption replace the need for data destruction?

Cryptographic erase (destroying the encryption key on a self-encrypting drive) is a recognized Purge method under NIST 800-88. For drives with proper hardware encryption implementations, cryptographic erase produces the same sanitization outcome as overwrite, in significantly less time. However, encryption doesn’t eliminate the need for sanitization, it provides a specific Purge method that’s appropriate for encrypted drives.

What does a Certificate of Destruction need to include?

A professional Certificate of Destruction should include the asset identifier, media type, NIST 800-88 method used with specific technique, applicable standards referenced, date and time, technician identifier, verification method, chain of custody from receipt through final disposition, and final disposition outcome. Summary “we processed X drives” reports without per-asset detail don’t meet professional standards for audit-ready documentation.

What sanitization is required for HIPAA, GDPR, or PCI DSS compliance?

None of these frameworks prescribe specific technical methods, but all require documented procedures that demonstrate effective sanitization. NIST 800-88 is the most commonly referenced implementation standard for HIPAA and PCI DSS. GDPR doesn’t reference a specific standard but expects documented procedures equivalent to recognized international standards. PCI DSS 4.0 specifically mentions NIST 800-88 as a recognized standard for media sanitization.

Should networking equipment be destroyed differently than servers?

Yes, in important ways. Networking equipment (routers, switches, supervisor cards, management modules) contains flash memory holding configurations, routing tables, credentials, and operational data. Server sanitization typically addresses drives. Networking equipment sanitization requires vendor-specific zeroization procedures, configuration overwrite, and for high-security environments, physical destruction of flash chips. Many retirement programs address servers but leave networking equipment flash memory intact, creating real data security gaps.

The Bottom Line

“We wiped the drives” isn’t a data destruction strategy. It’s a phrase that may or may not describe a process that may or may not protect the data.

The fix isn’t a different vendor or a better tool. It’s treating sanitization as a technical decision with three NIST 800-88 outcomes (Clear, Purge, Destroy), selected per asset based on data classification, destination, and compliance framework, and documented in per-asset Certificates of Destruction that survive audit examination.

Organizations that operate at this level don’t have data destruction failures. The failures consistently happen in operations that treat sanitization as a single action with one casual label rather than a decision tree with documented outcomes.

The compliance frameworks pushing this discipline aren’t arbitrary. HIPAA, PCI DSS, GDPR, FedRAMP, SOC 2, and state privacy laws all increasingly expect documented method selection because that’s the only way to demonstrate sanitization effectiveness across the variety of media types and data classifications in modern environments.

For organizations decommissioning equipment at scale, the operational fix is concrete: write a sanitization policy that specifies decision criteria, train procurement and IT to ask vendors method-specific questions, require per-asset CoDs with NIST 800-88 method documentation, and verify vendors actually do what their proposals claim.

None of this is unusual. It’s the documentation discipline that separates ITAD programs that pass audit examination from those that don’t.

How ROC Telecom Helps

ROC Telecom operates as an R2v3, RIOS, NIST 800-88, and ITAR-compliant data destruction specialist:

All three NIST 800-88 methods (Clear, Purge, Destroy) with method selection per asset based on data classification, destination, and applicable compliance framework
IEEE 2883 capability for NVMe and modern storage technologies that don’t respond reliably to legacy HDD methods
Per-asset Certificates of Destruction documenting media type, NIST 800-88 method used, technician, verification, and chain of custody
Networking equipment sanitization including flash memory on routers, switches, supervisor cards, and management modules
Physical destruction in a 24/7 surveilled, restricted-access facility for high-sensitivity equipment
Cryptographic erase for self-encrypting drives, delivering Purge-equivalent sanitization with significantly faster completion times
ITAR-compliant handling for FedRAMP-relevant and export-controlled equipment
SOC 2-ready documentation with audit response capability for cloud providers and SaaS vendors with their own audit obligations

15+ years of ITAD experience, $25M+ in client capital recovered, 45M+ pounds diverted from landfill.

Request a Free Data Destruction Program Assessment

Tell us about your retirement equipment and data classification requirements. A specialist will reach out to discuss the appropriate NIST 800-88 method selection, documentation requirements, and the right engagement model for your situation. No commitment, no spam.

Prefer to talk directly? Call 585-406-1249 or email info@roctelecom.com.

"*" indicates required fields

Related reading:

Why Wiping Isn’t Destroying: A 2026 Guide to NIST 800-88 Data Sanitization and the Stakes of Getting It Wrong