Get a quote

News

NIST SP 800-88 Rev. 2: What Changed from Rev. 1

Published · Adam Malik

In September 2025, NIST published SP 800-88 Revision 2, Guidelines for Media Sanitization, which supersedes the December 2014 Revision 1. This post is original Paradygm commentary for R2v3 and ITAD readers—not the NIST text. Use it to see what actually changed; download the official PDF and FAQ for the authoritative requirements.

Official sources: Rev. 2 PDF · SP 800-88r2 FAQ (16 July 2026) · R2v3 Appendix B checklist on this site

At a glance: Rev. 1 vs Rev. 2

  • Focus — Rev. 1: media-specific wipe tables (Appendix A). Rev. 2: enterprise media sanitization program (policy, roles, training, documentation, reuse decisions)
  • Media term — Rev. 1: electronic (soft copy) media. Rev. 2: information storage media (ISM), including logical/virtual storage such as cloud
  • Where techniques live — Rev. 1: device tables in the SP. Rev. 2: IEEE 2883, NSA guidance, or an organizationally approved standard (except cryptographic erase, covered in the SP)
  • Clear method — Rev. 2 clarifies multi-pass overwrite is not required; counters obsolete DoD 5220.22-M multi-pass language
  • Degaussing — Rev. 2: physical Purge for applicable magnetic media; not an approved Destroy technique
  • Assurance — Rev. 2: sanitization assurance = verification (technique completed) + validation (organization accepts the outcome for that data)

From wipe tables to a sanitization program

The biggest shift is philosophical. Revision 1 put heavy weight on hands-on, media-specific techniques—large Appendix A tables that mapped Clear, Purge, and Destroy to device types. Revision 2 moves the center of gravity to building and running a media sanitization program: aligning classification with acceptable methods, defining roles and training, documenting evidence (including certificates of sanitization), and deciding disposition based on reuse and sensitivity.

NIST’s own FAQ states this plainly: Revision 1 focused on media-specific technique tables; Revision 2 emphasizes the program, sanitization assurance, modern logical storage, and the Clear / Purge / Destroy methods in detail. For practitioners, the takeaway is “update your program and citations,” not “memorize a new overwrite pattern.”

Information storage media (ISM) and logical storage

Revision 2 replaces the older phrase “electronic (soft copy) media” with information storage media (ISM). ISM covers physical devices (HDDs, SSDs, tape, and so on) and logical or virtual storage—cloud, containers, object storage, and other abstractions where the data owner may never touch the underlying hardware.

That change matters for purge decisions. When physical media is fully abstracted, overwrite and physical destruction are often impossible for the data owner. In those cases, cryptographic erase (CE) is frequently the only viable Purge technique—provided cloud agreements and key management make zeroization traceable.

Where techniques live now (IEEE 2883, NSA, org-approved standards)

Revision 2 removes the media-specific sanitization tables and related technique/tool appendices that made Revision 1 feel like a wipe cookbook. Except for cryptographic erase (which Revision 2 discusses in the main body), NIST points organizations to evolving industry standards such as IEEE 2883, to NSA guidance for highly sensitive government media, or to an organizationally approved standard.

If your R2v3 data sanitization plan still copies Revision 1 Appendix A rows into work instructions, treat that as a gap: each logical or physical method you use should now trace to a current specification, plus your own recovery checks under Appendix B.

Clear, Purge, and Destroy updates

Clear: single-pass is enough

The Clear / Purge / Destroy continuum remains, but Clear is clarified. Multi-pass overwrite is not required. Revision 2 counters obsolete DoD 5220.22-M language that mandated a certain number of overwrite passes and patterns. For modern storage—especially flash—legacy multi-pass practices add little confidentiality protection and can shorten media life. Clear uses logical techniques on user-addressable space (typically a single overwrite pass, or a manufacturer factory reset when rewriting is not supported).

Degaussing is Purge, not Destroy

Revision 2 treats degaussing as a physical Purge technique for applicable magnetic media. It is not for flash or SSD media, and it is not an approved Destroy technique—even when a high-coercivity degauss leaves a drive inoperable. Coercivity mismatch or hybrid media can disrupt usability without fully sanitizing target data. Match degausser strength to the media; do not label degaussing as “destruction” in certificates or customer language unless your approved standard says otherwise.

Cryptographic erase expanded

CE guidance is consolidated into the main body. High-level preconditions for CE as Purge include: no sensitive plaintext stored before keys were established; cryptographic strength appropriate to the data (FAQ guidance for federal use points to current FIPS 140-validated modules and at least 128-bit strength); and permanent sanitization (zeroization) of the target keys. Key types and externally managed keys are discussed more carefully than in Revision 1. For cloud or logical ISM, CE is often the only practical Purge path.

Verification vs validation

Revision 1 framed much of the quality discussion as “verification” (equipment, personnel, results, and sampling). Revision 2 introduces sanitization assurance as two linked steps:

  • Verification — the operational check that the sanitization technique completed successfully (status, errors, anomalies, equipment behavior)
  • Validation — the organizational decision that the outcome is accepted as effective for that data’s sensitivity and residual confidentiality risk

Full or representative content sampling after Clear or Purge is not required by Revision 2 unless your own policy says so. Certificates of sanitization remain important evidence; the sample form in the SP was updated. Keep both verification records and validation decisions in your Appendix B file set.

What R2v3 facilities should update next

Use our short NIST SP 800-88 Rev. 2 checklist for R2v3 facilities as the operational hub. In brief:

  • Cite NIST SP 800-88 Rev. 2 (not Rev. 1) in data sanitization plans, work instructions, training, and certificates of sanitization
  • Map each Clear / Purge / Destroy method you use to a current standard or NSA guidance—and to your Appendix B recovery checks—rather than to removed Rev. 1 device tables
  • Record verification (run completed) and validation (organization accepted the result for that data)
  • Review degaussing and CE language so certificates and customer statements match Revision 2 classifications

This is program maintenance for Appendix B data sanitization, not a new certification product or a guarantee of recovery impossibility beyond what NIST describes.

Official sources

Get help

We help R2v3 and ITAD facilities update data sanitization plans, procedures, and training for Rev. 2. Contact us or call 1-855-702-9001 (Monday to Friday, 8:00 AM–6:00 PM ET). Email: [email protected].

Commentary by Paradygm Consulting / R2 Consultants. Not a substitute for NIST SP 800-88r2. Official source: NIST (csrc.nist.gov).

← All news