NIST 800-88 Data Destruction Checklist

What NIST 800-88 actually is — in one paragraph

NIST Special Publication 800-88 Rev. 1, Guidelines for Media Sanitization, is the U.S. federal standard for making data on storage media unrecoverable. It is the de facto baseline cited in HIPAA guidance, PCI-DSS, GLBA examinations, and most enterprise procurement contracts. It splits sanitization into three categories — Clear, Purge, and Destroy — and tells you which one to use based on (a) the confidentiality of the data and (b) the type of media.

The 7-step checklist

1. Inventory every device.

   Device type · manufacturer · model · serial number · capacity · encryption status · current physical location. Anything not on the list never gets sanitized — and almost every breach starts with "we didn't know that drive was there."

2. Classify the data.

   Map each device to a confidentiality level: Low, Moderate, or High. Use your existing data classification policy if you have one; otherwise default to Moderate and step up for regulated workloads (PHI, PCI, ITAR, etc.).

3. Select the method.

   Apply the Clear / Purge / Destroy matrix above. Always verify the method is actually supported by the device — many SSDs falsely report secure-erase success.

4. Execute the sanitization.

   Use vendor-supported tools (manufacturer secure-erase utilities, ATA/NVMe Sanitize, hardware shredders). Capture tool logs and operator identity. Maintain chain of custody from removal to sanitization to disposal.

5. Verify a sample.

   At minimum 10% of devices, plus 100% of devices holding High-confidentiality data. For logical methods, attempt recovery with a forensic tool. For physical destruction, verify shred particle size with calipers and photograph the output.

6. Issue Certificates of Destruction.

   One certificate per device or per batch. Include: device serial number(s), sanitization method, NIST 800-88 category, operator name, witness name, date, location, and reference to the verification record. Sign and counter-sign.

7. Update the asset register and retain records.

   Mark assets as sanitized and disposed in the CMDB / asset tracking system. Retain certificates and logs for the longest of: your retention policy, your regulator's requirement, or seven years.

FAQ

What is NIST SP 800-88?

NIST SP 800-88 Rev. 1 is the U.S. federal media sanitization standard. It defines Clear, Purge, and Destroy categories and is referenced by HIPAA, PCI-DSS, GLBA, and most enterprise contracts.

Is overwriting enough for SSDs?

Generally no — wear leveling and over-provisioning leave data behind. Use cryptographic erase, vendor block-erase, or physical destruction.

Do I need a Certificate of Destruction?

If you're subject to any data-handling regulation or contract, yes. It's the document you'll produce in an audit.

Can I do this in-house?

Yes — 800-88 doesn't require a third party. Most organizations outsource because of training, documentation, and equipment costs.