NIST 800-88 Data Destruction Explained: What ITAD Buyers Actually Need to Know

If you handle used devices at any scale, data is your biggest hidden liability. A single laptop or phone that leaves your custody with recoverable data can turn a routine ITAD project into a breach notification. That is why NIST Special Publication 800-88 — the U.S. government’s guidelines for media sanitization — has become the baseline reference across the industry. Here is what it actually says, in plain terms.

The three levels: Clear, Purge, Destroy

NIST 800-88 defines three escalating methods of sanitization. The right one depends on the sensitivity of the data and whether the media will be reused.

• Clear — overwrites or resets user-addressable storage using standard read/write commands. It protects against simple recovery and keeps the device fully reusable. Appropriate for most low-to-moderate sensitivity data.
• Purge — uses more thorough techniques (cryptographic erase, block erase, or firmware-level secure erase) that defeat laboratory recovery attempts. The device remains reusable. This is the level most enterprise and regulated clients expect.
• Destroy — physically renders the media unusable through shredding, disintegration, or incineration. Nothing is recoverable, but the device is gone. Reserved for the highest-sensitivity assets or media that failed sanitization.

The goal of 800-88 is simple: make the data infeasible to recover using state-of-the-art techniques, at a cost and effort proportional to its sensitivity.

Why “we wipe everything” isn’t enough

A verbal assurance that devices are “wiped” means nothing in an audit. Modern storage — SSDs, eMMC, flash in phones — doesn’t behave like old spinning disks. Overwriting every logical block does not guarantee every physical cell is cleared, because wear-leveling and over-provisioning hide data from the operating system. That’s why 800-88 emphasizes media-appropriate methods, especially cryptographic erase and firmware secure-erase for solid-state media.

The part that actually protects you: verification and documentation

Sanitization you can’t prove is sanitization you can’t defend. The real value of an 800-88-aligned process is the paper trail:

• Verification — confirming each device was successfully sanitized, not just that a command was issued.
• Per-device certificates — tied to serial number or IMEI, recording the method used, date, and operator.
• Chain of custody — tracking the asset from intake through final disposition.

When an enterprise or government client asks “prove it,” that documentation is the difference between a clean audit and a problem.

What to ask your processing partner

1. Which 800-88 level do you apply by default, and can I request Purge or Destroy?
2. How do you sanitize solid-state media specifically?
3. Do I receive per-device certificates tied to serials or IMEIs?
4. How is sanitization verified, and what happens to devices that fail?
5. Is chain of custody documented end to end?

Data handling should never be an upsell or an afterthought. A serious partner treats 800-88-aligned sanitization and documentation as the default on every single unit — because for your clients, it is the whole point.