Media Sanitization
Standards Matrix.
A technical guide for ITAD managers and CISOs working across NIST SP 800-88, IEEE 2883-2022, and the legacy DoD 5220.22-M overwrite method.
Technical Standards Scorecard
How each standard approaches the three levels of media sanitization: Clear, Purge, and Destroy (IEEE 2883-2022 calls the physical level "Destruct"). For SSD and NVMe media, Purge through the drive's own sanitize commands is the level most organizations now aim for.
The three documents are different kinds of text. NIST SP 800-88 is a US federal guideline for building a sanitization program. IEEE 2883-2022 is an industry standard that defines how sanitization is performed on specific storage interfaces. DoD 5220.22-M is a 1990s-era manual whose overwrite method is still requested by name, even though it was never written for flash storage.
| Sanitization Level | NIST SP 800-88 Rev. 2 | IEEE 2883-2022 | Legacy DoD 5220.22 |
|---|---|---|---|
CLEAR Base Level Overwrite | Logical techniques, typically overwriting all user-addressable storage locations. Protects against simple, non-invasive recovery. | Logical sanitization of user-addressable storage using standard read and write commands. Does not reach spare or over-provisioned areas. | Commonly cited as a three-pass overwrite (zeros, ones, random) with verification. Written for magnetic disks; not suited to SSD/NVMe. |
PURGE Enterprise Benchmark | Physical or logical techniques, such as the drive's sanitize or cryptographic erase commands, that make recovery infeasible with state-of-the-art laboratory techniques. | Device sanitize commands defined per interface (ATA, SCSI, NVMe): block erase, cryptographic erase, or sanitize overwrite, including spare areas. | Not defined. The method predates SSD architectures and their controller-level commands. |
DESTROY Physical End-of-Life | Physical techniques such as shredding, disintegration, pulverizing, melting or incineration. Appropriate for damaged media or media that cannot be purged. | "Destruct": physical methods that leave the media unusable and the data unrecoverable. | Physical destruction, such as degaussing magnetic media or shredding, under the security program's rules. |
How NIST SP 800-88 Rev. 2 and IEEE 2883-2022 Fit Together
NIST SP 800-88 Rev. 1 (2014) was the main US reference for a decade. Rev. 2, published in 2025, is now current, and it leans on industry standards such as IEEE 2883-2022 for media-specific technique.
The two documents are complementary rather than competing. NIST SP 800-88 Rev. 2 tells an organization what a sanitization program should contain: who is responsible, how to choose between Clear, Purge and Destroy based on data sensitivity and what happens to the media next, how to verify, and what to record. IEEE 2883-2022 answers the narrower technical question of which commands achieve Clear or Purge on a given type of storage.
Modern solid-state storage is the reason this split matters. SSDs keep over-provisioned blocks and use a flash translation layer that maps logical addresses to physical cells. A host-level overwrite only reaches the logical addresses, so some physical cells that once held data may never be rewritten. That is why both documents treat controller-level sanitize and cryptographic erase commands as the route to Purge on flash media.
If your policies still cite Rev. 1, they are not wrong about the Clear, Purge and Destroy categories, which carry over. What changes is the emphasis on program governance and the reliance on IEEE 2883-2022 for technique. Updating policy references to Rev. 2 and checking that your tool records which command each drive accepted is a sensible first step. Our NIST SP 800-88 Rev. 2 summary and IEEE 2883-2022 guide go into more detail.
- Record drive model and serial number
- Use the drive's own sanitize command where supported
- Verify the result after erasure
- Keep a timestamped, digitally signed report
Regulatory
Context
Laws rarely name an erasure standard, but several expect safe disposal. The HIPAA Security Rule (45 CFR §164.310(d)(2)) requires policies for the final disposal of electronic protected health information and for removing it from media before reuse. GDPR Article 17 gives individuals a right to erasure, and Article 32 requires appropriate security measures. California's CCPA includes a consumer right to request deletion.
A signed erasure report helps you document how those obligations were met at the hardware level. D-Secure reports carry a certificate on page 1 and a summary from page 2, signed with SHA-256 and 2048-bit keys.
Verify a ReportThe "Delete" Myth
Deleting a file or running a quick format removes the file system's pointers to the data, not the data itself, so the contents can often be recovered with ordinary recovery tools until they are overwritten.
A full format is better but still not sanitization. Microsoft documents that a full format in Windows Vista and later writes zeros across the volume, yet it works only on the partition, cannot reach SSD spare blocks or hidden areas such as HPA and DCO, and leaves no verifiable record. That is why NIST SP 800-88 asks for Clear or Purge with verification instead.
Where DoD 5220.22-M Still Fits
The DoD 5220.22-M three-pass overwrite still appears in contracts and older policies. On a healthy magnetic hard drive, an overwrite with verification remains a reasonable Clear method. On SSD and NVMe media it adds write wear without reaching over-provisioned cells, so a Purge command is the better choice.
If a customer contract names DoD 5220.22-M, it is worth asking whether NIST SP 800-88 Purge is acceptable instead, and recording the method used either way. D-Secure Drive Eraser supports NIST SP 800-88 Clear and Purge, including RAID erasure and handling of HPA/DCO; Destroy remains a physical process. See the Drive Eraser page and our verification methods guide.
Keep
Reading
Explore more technical studies from the D-Secure Research Lab.