NIST 800-88 Data Destruction Explained

NIST 800-88 is the U.S. standard for media sanitization. It defines three methods — Clear (overwrite), Purge (cryptographic erase or degauss), and Destroy (physical shredding or disintegration) — and requires verification and documentation. When we buy your equipment, Data Center Buyers can securely wipe or physically destroy data-bearing devices and, on request, provide a certificate of destruction before equipment is resold.

Before selling or recycling any data-bearing device, you must ensure the data is irrecoverable. NIST Special Publication 800-88 is the recognized standard for doing this defensibly. This guide explains how it works.

The three NIST 800-88 methods

Clear uses software overwrites to remove data from user-addressable storage — appropriate for reuse within a trusted environment.

Purge applies stronger techniques such as cryptographic erase or degaussing, making recovery infeasible even with laboratory methods. Destroy renders the media physically unusable through shredding, disintegration, or melting.

Why documentation matters

Sanitization is only defensible if it's verified and documented. A certificate of destruction recording the device, method, date, and operator is your evidence of compliance for regulators, auditors, and customers.

As part of equipment buyback, Data Center Buyers can securely wipe or physically destroy the drives we handle and, on request, provide a per-device certificate of destruction.

Frequently asked questions

Is a software overwrite enough?

For many devices, a verified overwrite is sufficient; higher-sensitivity data may call for cryptographic erase, degaussing, or physical destruction. We recommend the appropriate method per device type.

Do you provide certificates of destruction?

Yes, on request. Data Center Buyers can issue a certificate of destruction per drive, documenting the method, date, and chain of custody.