NIST SP 800-88 Rev. 2 Media Sanitization Guide

Data sanitization plans, procedures, training and certificates that still cite “NIST 800-88 Rev. 1” should be brought up to date against Revision 2.

What changed in Rev. 2

• Program firstThe focus moves away from hands-on, media-by-media instructions and toward running an organization-wide media sanitization program for equipment that is reused, resold or disposed of.
• No more technique tablesApart from cryptographic erase, Rev. 2 no longer lists device-specific sanitization techniques. It points instead to IEEE 2883, NSA specifications or an organizationally approved standard.
• A new term“Information storage media” (ISM) replaces “electronic media” and covers modern and logical storage such as cloud, container and object storage.
• Verification and validation are separate stepsVerification checks that a sanitization run finished without errors; validation is the organization’s decision, based on how sensitive the data is, that the result is acceptable.
• Clear, purge and destroy remain the three methodsRev. 2 makes clear that multi-pass overwriting is unnecessary: for clear, a single overwrite pass, or a manufacturer reset where rewriting isn’t supported, is the norm.
• Cryptographic eraseGets its own guidance, including which keys can be used, key zeroization in line with ISO/IEC 19790, and when externally managed keys may be acceptable. NIST’s FAQ lists preconditions such as no sensitive data stored in plaintext before encryption began and at least 128-bit security strength.
• DegaussingTreated as a purge technique for legacy magnetic media, not as a destroy method.
• Better alignmentWith cybersecurity standards such as NIST SP 800-53 and ISO/IEC 27040.

What this means for R2v3 and ITAD facilities

If your R2 data sanitization plan, work instructions, training records or certificates of sanitization reference Rev. 1, review them against Rev. 2, update the references, and confirm with your certification body how the change will be handled at your next audit. Check that your sanitization tools and methods are backed by a current standard (for example IEEE 2883) or NSA guidance, and that your records show both verification and validation.

Official sources

• NIST SP 800-88 Rev. 2 (free download from NIST)
• NIST FAQ for SP 800-88r2 (PDF)
• NSA Evaluated Products Lists for media destruction devices

IEEE 2883 Data Sanitization Training

Rev. 2 points to IEEE 2883 for device-specific sanitization techniques. Test your knowledge of IEEE 2883 Clear, Purge and Destruct with this 20-question assessment. Each answer comes with a standard reference explanation, and a training certificate downloads instantly as a PDF when you score 80% or more. This is educational awareness training — it does not grant any IEEE or other certification.

How Paradygm can help

We help R2v3 and ITAD facilities update their data sanitization plans, procedures, training and records for NIST SP 800-88 Rev. 2. Call 1-855-702-9001 or request a quote.

Summary written by Paradygm Consulting from NIST’s published announcement and FAQ. It is not a substitute for the NIST publication.

Related

• IEEE 2883 data sanitization training (quiz + certificate, on this page)
• NIST 800-88 training (video + quiz)
• R2v3 consulting
• R2 Recycling Standard