NIST 800-88 Data Erasure: Clear, Purge & Destroy Explained
NIST SP 800-88 is the best-known guide to media sanitization. This page explains the Clear, Purge and Destroy methods, what changed in Revision 2, and how it applies to UK organisations wiping hard drives and SSDs.
What Is NIST SP 800-88?
NIST Special Publication 800-88, Guidelines for Media Sanitization, is the most widely referenced guidance on how to remove data from storage media. It is published by the US National Institute of Standards and Technology. The current edition, Revision 2, was finalised in September 2025 and supersedes Revision 1 from December 2014.
NIST defines sanitization as a process that renders access to the target data on the media infeasible for a given level of effort. In practice, organisations around the world use its framework when they write disposal policies, choose erasure methods and ask suppliers for proof.
No. It is a US publication and not a UK legal requirement. It is, however, used internationally as a benchmark for good practice, and it maps well to what UK GDPR expects: appropriate security and the ability to demonstrate it. See our guide to GDPR and data erasure.
Clear, Purge and Destroy
NIST groups sanitization into three methods, each giving a stronger level of assurance.
| Method | What it does | Typical techniques | Media afterwards |
|---|---|---|---|
| Clear | Protects against simple, non-invasive data recovery using the device's normal interfaces | Logical overwrite of user-addressable storage; reset commands where proven effective | Reusable |
| Purge | Protects against laboratory-grade recovery attempts | Firmware commands such as ATA Secure Erase or NVMe Sanitize; cryptographic erase; block erase on flash | Usually reusable |
| Destroy | Makes the media unusable and recovery infeasible | Shredding, disintegration, incineration by a specialist | Not reusable |
Which one do you need?
The right level depends on how sensitive the data is and where the device is going next. Equipment that stays inside your organisation may only need Clear. Equipment leaving your control, or holding sensitive personal or health data, is better served by Purge or Destroy. Faulty drives that cannot be wiped should be destroyed. Our data destruction service covers this.
What Changed in Revision 2?
Revision 2 shifts the focus from hands-on technique tables to running a proper media sanitization programme.
| Topic | Revision 1 (2014) | Revision 2 (2025) |
|---|---|---|
| Main focus | Media-specific sanitization techniques | Establishing an organisation-wide media sanitization programme |
| Technique detail | Detailed tables per media type | Points to current industry standards rather than listing every technique |
| Verification | Verification described as part of the process | Stronger emphasis on validating that sanitization was effective |
| Scope | Physical media focus | Adds the idea of logical sanitization for modern and virtual environments |
| Status | Superseded | Current edition |
The core Clear, Purge and Destroy model remains. What is new is the expectation that you document policy, assign responsibility, validate your methods and trust the tools you use.
How Many Overwrite Passes Are Enough?
Older standards, such as the DoD 5220.22-M method, called for multiple overwrite passes. NIST guidance recognises that on modern drives a single verified overwrite pass is effective, and repeated passes add time without meaningful extra protection. Multi-pass methods are largely a legacy habit.
What matters far more is whether the method actually reaches all of the storage. That is the real difference between hard drives and SSDs, covered below.
SSDs, NVMe and Cryptographic Erase
Flash storage uses wear levelling and hidden over-provisioned space, so software overwriting from the operating system can miss data. For SSDs, NIST-style Purge relies on:
- Firmware sanitize commands (for example NVMe Sanitize or ATA Secure Erase) that clear the whole device
- Cryptographic erase, which destroys the encryption key so the stored data is unreadable
- Destruction when the drive is faulty, unresponsive or does not support a trusted erase method
Learn more about our flash-aware process on the SSD wiping page.
Verification and the Media Sanitization Programme
A defensible approach does not stop at the wipe. Under the Revision 2 mindset, an organisation should be able to show:
- Which data and media are in scope, and how sensitive the data is
- Which sanitization method applies to each media type and risk level
- Who is responsible, and how chain of custody is maintained
- How each result is verified and recorded
- Where the equipment goes afterwards: reuse, resale or recycling
Whole-media sanitization is generally preferred over selective deletion, because partial methods are far harder to verify.
How We Apply These Principles
Our erasure follows NIST 800-88 principles: we use a method suited to each device, verify the result and record it per serial number. Drives that cannot be wiped go to certified destruction.
Method matched to media
Overwrite for hard drives; flash-aware erase for SSDs.
Verified results
Each device is checked and the outcome recorded.
Certificate per job
A data erasure certificate with serial-level detail.
To discuss the level of sanitization your data requires, request a free quote or see our on-site data wiping service.
Frequently Asked Questions
Quick answers on this topic. Still unsure? Send us the details and we will take a look.
Ask Us a QuestionWhat is NIST 800-88?
What is the latest version of NIST 800-88?
Is NIST 800-88 a legal requirement in the UK?
What is the difference between Clear and Purge?
Do I need multiple overwrite passes?
Can SSDs be wiped to NIST standards?
Related Guides & Services
What Is Data Wiping?
How secure erasure works and why deleting files is not enough.
Read more ComplianceGDPR and Data Erasure
What UK GDPR expects when you retire IT equipment.
Read more ServiceData Erasure Certificate
The audit-ready proof issued for every job.
Read more ServiceData Destruction
Certified shredding for drives that cannot be wiped.
Read moreNeed Erasure Aligned to NIST 800-88?
Tell us your equipment and sensitivity level. We will recommend the right method and quote within 24 hours.
Prefer to talk?
Reach our UK team the way that suits you best.