When a business retires a laptop, server, copier, or hard drive, the physical device is only half the problem. The data living on that device — customer records, employee files, financial information, intellectual property — is a liability until it is verifiably destroyed. The accepted standard for doing that destruction correctly is NIST Special Publication 800-88 Revision 1: Guidelines for Media Sanitization, published by the U.S. National Institute of Standards and Technology.

Whether you're a hospital subject to HIPAA, a financial firm under GLBA, a public company under SOX, or a California business under SB 1386 / CCPA, NIST 800-88 is the framework auditors and regulators expect you to follow. Here's what it actually says, and what it means for your IT asset disposition (ITAD) program.

What Is NIST 800-88?

NIST 800-88 Rev. 1 is a federal guideline that defines how to sanitize electronic storage media so that recovery of the original data is "infeasible" using state-of-the-art laboratory techniques. It applies to everything from spinning hard drives and SSDs to USB sticks, smartphones, copier hard drives, and magnetic tape. While it is technically a federal standard, it has become the de facto reference for private-sector ITAD, data destruction certifications (NAID AAA), and cybersecurity frameworks like NIST CSF and ISO 27001.

The Three Sanitization Categories

NIST defines three categories of media sanitization. The right one depends on the sensitivity of the data and whether the device will leave your organization's control.

Clear — Uses logical techniques (a factory reset, a standard overwrite) to remove data from user-addressable storage. Protects against casual recovery with standard tools. Appropriate when the device stays inside your organization.
Purge — Uses stronger logical or physical techniques (cryptographic erase, ATA Secure Erase, block erase, or degaussing for magnetic media) to make recovery infeasible even with laboratory tools. Required when devices leave your organization (resale, donation, ITAD vendor) and contain moderate to sensitive data.
Destroy — Physical destruction: shredding, disintegration, pulverization, incineration, or melting. The drive cannot be reused. Required for the most sensitive data (PHI, classified information, anything you cannot afford to leak).

SSDs Are Not Hard Drives

One of the most common ITAD mistakes is treating solid-state drives (SSDs) the same as spinning hard disk drives (HDDs). They behave very differently:

HDDs can be sanitized by overwriting the entire drive with a single pass of zeros or random data. Degaussing also works because data is stored magnetically.
SSDs store data in flash cells and use wear-leveling, which means a software overwrite does not reliably reach every cell. NIST recommends cryptographic erase (deleting the on-drive encryption key), ATA/NVMe Secure Erase, or physical destruction. Degaussing does nothing to an SSD.

For mixed fleets, the only universally safe method is physical destruction — which is why most certified ITAD vendors default to shredding drives that held regulated data.

What Auditors Want to See

NIST 800-88 isn't just about the technique — it's about documentation. A defensible data sanitization program produces:

An asset inventory with make, model, serial number, and original location for every device.
A chain-of-custody record from pickup through final disposition.
A Certificate of Destruction or sanitization for each device, listing the method used (Clear, Purge, or Destroy) and the technician who performed it.
A verification step — for software-based sanitization, a sampling read-back; for physical destruction, witnessing or video evidence on request.
A final disposition report showing what was remarketed, what was recycled, and what was destroyed.

How NIST 800-88 Maps to U.S. Regulations

HIPAA / HITECH — The HHS guidance on disposal of PHI explicitly references NIST 800-88 as an acceptable method for rendering electronic PHI unreadable, indecipherable, and unrecoverable.
Gramm-Leach-Bliley Act (GLBA) Safeguards Rule — Requires financial institutions to properly dispose of customer information. NIST 800-88 is the recognized technical standard.
FACTA Disposal Rule — Requires businesses to take reasonable measures to dispose of consumer report information. Compliant ITAD with documented sanitization satisfies this.
Sarbanes-Oxley (SOX) — Section 802 requires retention and secure destruction of financial records. Auditors expect a documented data destruction policy aligned with NIST.
California SB 1386 / CCPA / CPRA — Requires reasonable security for personal information, including at the end of a device's life. A NIST 800-88 sanitization program is the defensible baseline.

How a Certified ITAD Vendor Helps

Building a NIST-aligned data destruction program in-house is possible but expensive: you need wiping software, validated equipment, trained technicians, and an audit trail. A certified ITAD partner provides this as a service. When evaluating a vendor, look for:

NAID AAA Certification for data destruction (electronic and physical).
CalRecycle-authorized for downstream recycling.
State-level e-waste collector approval — in California, CalRecycle CEWD approval; this is not a data-security certification.
Written NIST 800-88 alignment in their data destruction policy.
A Certificate of Destruction issued for every device, not every batch.
Insurance coverage for data breach liability during transit and processing.

Our Approach

At Urban Electronic Recycling, every business engagement starts with an asset inventory and a clear sanitization decision per device class. We perform NIST 800-88 Purge on drives that will be remarketed and Destroy (on-site or in-facility shredding) for drives holding regulated data. Each device is tracked by serial number, and we issue an itemized Certificate of Destruction plus a final disposition report for your compliance file. We're a CalRecycle-approved collector (CEWD #128102) and our downstream partners are CalRecycle-authorized. Collector approval is separate from data destruction documentation; Certificates of Destruction record the work performed, not a guarantee of legal compliance.

Learn more about our business ITAD and bulk recycling program, or read our companion guide on business data destruction in the Inland Empire.

Bottom Line

NIST 800-88 isn't optional best practice anymore — it's the standard regulators, auditors, and insurance carriers expect. Whether you handle data destruction in-house or through an ITAD partner, your program needs documented methods (Clear / Purge / Destroy), per-device certificates, and an unbroken chain of custody. Done right, retiring old IT becomes a routine compliance checkbox instead of a breach waiting to happen.

Ready to formalize your data destruction program? Schedule a business pickup or request a custom ITAD quote for your organization.

Sources: NIST Special Publication 800-88 Rev. 1 — Guidelines for Media Sanitization; U.S. Department of Health and Human Services — Guidance on Disposal of Protected Health Information; FTC Safeguards Rule (GLBA); FTC Disposal Rule (FACTA); Sarbanes-Oxley Act Section 802; California Civil Code §1798.81.5; NAID AAA Certification Program; CalRecycle Covered Electronic Waste Recycling Program.

NIST 800-88 Explained: The Business Guide to Certified Data Sanitization