DoD 5220.22-M vs. IEEE 2883-2022: which one should actually be on your certificate?

DoD 5220.22-M and IEEE 2883-2022 are the two names that come up most in sanitization conversations, but they were built almost 30 years apart, for storage technology that barely resembles each other. DoD is a legacy multi-pass overwrite method designed for spinning magnetic disks. IEEE 2883-2022 is newer, media-aware, and built for the SSD-and-NVMe world most of us actually work in now.

Here's how they compare, where each one still makes sense, and — more usefully — what different auditors actually expect to see when they show up.

What is DoD 5220.22-M?

DoD 5220.22-M comes from the U.S. Department of Defense's National Industrial Security Program Operating Manual (NISPOM). It dates back to 1995 and has been revised a few times since, and honestly, its name still carries more weight in procurement conversations than its technical relevance justifies.

The original 3-pass method

1. First pass — overwrite everything with binary zeros (0x00)
2. Second pass — overwrite everything with binary ones (0xFF)
3. Third pass — overwrite with a random pattern, then verify

The ECE variant, or the 7-pass version

In 2001 the DoD extended this into a 7-pass "ECE" process: passes 1–3 run the standard 3-pass wipe, pass 4 overwrites with a specific random pattern, and passes 5–7 repeat the 3-pass wipe again. It's thorough. It's also slow enough to wear out modern drives for no real security gain, which is why you mostly see it now in legacy military contracts and not much else.

What is IEEE 2883-2022?

IEEE 2883-2022, published in 2022, was built specifically to close the gaps DoD leaves open. It treats different storage types differently instead of applying one overwrite pattern everywhere.

• Media-specific methods for HDD, SSD, NVMe, and flash
• Clear, Purge, Destruct — three levels, escalating in thoroughness
• One pass is enough — it acknowledges what research has shown for a while: a single overwrite pass is adequate on modern high-density drives
• Verification is built in, not bolted on afterward
• Room to grow — structured so it can absorb new storage technology without a rewrite

Side by side

The differences that actually matter

3 passes vs. 1 — and why fewer is fine now

DoD's multi-pass requirement made sense on drives from the '90s. It doesn't anymore. NIST's own research backs this: on modern high-density media, one properly executed, verified overwrite is enough to make data unrecoverable. IEEE 2883-2022 builds on that — faster erasure, same security outcome. More passes at this point mostly just burns time and shortens drive life.

Media coverage is where DoD really shows its age

DoD 5220.22-M was written when HDDs were basically the only game in town. It has nothing meaningful to say about:

• SSDs, which erase at the block and page level with wear leveling that a sequential overwrite doesn't reliably reach
• NVMe drives, which run on a completely different interface and architecture
• Flash media — USB sticks, SD cards, embedded storage — that behaves differently again

IEEE 2883-2022 has dedicated guidance for each, which is really the whole point of the standard.

Both standards eventually point back to NIST

The DoD's own NISPOM documentation now tells organizations to follow NIST SP 800-88 for sanitization decisions. So functionally, DoD and IEEE both end up mapping onto the same three NIST categories:

• Clear — logical overwriting, for lower-sensitivity data
• Purge — including cryptographic erasure, for higher-sensitivity data
• Destroy — physical destruction, for the highest security tier

So which standard should you actually pick?

NIST Purge is the modern default for anything holding sensitive data — it uses media-specific firmware commands that reach the full logical storage space, including areas like HPA, DCO, and remapped sectors that a plain software overwrite tends to miss entirely.

• DoD 5220.22-M — fine, if it's genuinely legacy HDD media
• NIST Purge / IEEE 2883 — the right call for NVMe and SSD, essentially non-negotiable at this point
• ADISA-tested methods — worth it when you need independently validated forensic recovery resistance

What your auditor is actually going to ask for

US federal and defense: DoD 5220.22-M started here, but even the NISPOM update now points to NIST SP 800-88 and IEEE 2883. Some older sub-contracts still spell out DoD 3-pass explicitly on paper — worth checking the fine print rather than assuming.

Healthcare (HIPAA): HIPAA itself doesn't name a technical standard, but auditors expect NIST 800-88 alignment in practice. Hospitals run heavily on SSDs and NVMe now, and DoD-style wiping can leave hidden sectors untouched on that hardware — so IEEE 2883 has become the de facto answer here, even without HIPAA saying so directly.

Financial services (PCI DSS): these auditors want cryptographic proof, full stop. IEEE 2883's cryptographic erase procedures are built to produce exactly that kind of tamper-evident trail.

ITAD: the shift toward IEEE 2883 here is happening fast, and certification bodies like ADISA have already folded it into their testing matrices. If a vendor is still offering DoD-only wipes for SSDs, that's a sign they haven't caught up.

Where D-Secure comes in

We support DoD 5220.22-M and IEEE 2883-2022 side by side, along with 24+ other international standards, so the method matches whatever the contract or auditor actually asks for:

• DoD 5220.22-M — full 3-pass and 7-pass support for the cases that still genuinely need it
• IEEE 2883-2022 — Clear, Purge, and Destruct across every media type
• NIST SP 800-88 alignment — documented, audit-ready mapping to Clear, Purge, and Destroy
• Tamper-evident certificates — generated for every erasure, ready for regulatory review
• Global standards coverage — GDPR, HIPAA, PCI DSS, SOX, and more
• Every media type — HDDs, SSDs, NVMe, servers, mobile devices

Bottom line