NIST SP 800-88 media sanitization for a machine shop
Published 2026-10-23, 17 min read
Clear
Defeats
Simple recovery through the device's own interface: the normal read commands, a file-recovery tool.
Typical techniques
Overwrite every user-addressable location, or a factory reset where the device offers nothing else.
- Device after
- Usable
- Paper
- Never
Purge
Defeats
Recovery even with state-of-the-art laboratory techniques.
Typical techniques
A drive's dedicated sanitize command, cryptographic erase, or degaussing for older magnetic media.
- Device after
- Potentially reusable
- Paper
- Never
Destroy
Defeats
Recovery even with state-of-the-art laboratory techniques, and nothing can be stored on it again.
Typical techniques
Disintegrate, incinerate, melt, pulverize or shred.
- Device after
- Unusable
- Paper
- Yes, the only method
Summarised from the Rev 2 glossary and Sec. 3.1. Which one you need depends on the data, whether the device will be reused, and whether it leaves your control.
Every laptop, drive, phone, copier and CNC control that held your customers' drawings will one day be sold, returned, repaired or thrown out. NIST SP 800-88 is how you decide what to do to it first. This guide walks through the current revision, the decision flow, the devices in a machine shop, the requirement in NIST SP 800-171 and the FAR, and the record an assessor will ask for, with a certificate you can print.
Which NIST SP 800-88 revision is current
NIST SP 800-88, Guidelines for Media Sanitization, is NIST's guide to getting data off a device before it is reused or thrown out. The current edition is Revision 2, published September 2025. NIST marks Revision 1 (December 2014) withdrawn on September 26, 2025, superseded in its entirety by Rev 2. In July 2026 NIST added a short FAQ for Rev 2 that answers the questions shops ask most.
Rev 2 is a different kind of document. Rev 1 told you what to do to each kind of device. Rev 2 tells you how to run a sanitization program, and leaves device techniques to industry standards. Here is what moved:
| Topic | Rev 1 (2014, withdrawn) | Rev 2 (September 2025) |
|---|---|---|
| Media-by-media technique tables | Long tables per device type: phones, routers, copiers, drives | Removed. Rev 2 points to IEEE 2883 and NSA manuals for techniques (FAQ Q2) |
| Overwrite passes | Clear on a drive: at least one write pass with a fixed value | Multi-pass overwriting is unnecessary; clear is typically one pass (FAQ Q6) |
| Degaussing | A purge technique for magnetic media | A purge technique for legacy magnetic media, never for flash, and not a destroy technique even when the drive dies (FAQ Q8, Sec. 3.1.2) |
| Where the flow starts | Security categorization first | "Reuse media?" first; not reused means destroy (Appendix D) |
| Checking the result | Verify equipment, people and results (Sec. 4.7) | Verification (did it complete) plus validation (is the residual risk accepted) (Sec. 4.5) |
| What counts as media | Hard copy and electronic media | Hard copy and "information storage media", which includes cloud and object storage (FAQ Q3) |
Clear, purge and destroy in practice
Rev 2 names three methods and leaves the exact technique to the device. The method is the goal; the technique is how a given laptop, stick or copier gets there. Most mistakes come from using a technique that cannot reach the goal.
Clear
Clear overwrites everything a user can address, usually in one pass. It works well on a spinning hard drive. On flash (SSDs, USB sticks, SD cards) it falls short: wear levelling and spare cells mean the drive keeps copies the normal write commands never touch, and NIST calls a full overwrite of such a device infeasible. A factory reset counts as clear only on a device that offers nothing better, such as a basic phone or a piece of office equipment.
Purge, and cryptographic erase
Purge has to beat a laboratory, and Rev 2 says to use it instead of clear whenever you can. On a modern drive that means the drive's own sanitize command or cryptographic erase (CE): destroy the key and the encrypted data is noise. CE is fast, and on a self-encrypting drive it is often the best option, but only when three things are true:
- 01The drive encrypted everything from the start: no CUI was ever written to it in plain text before the keys were set.
- 02The encryption is at least 128-bit strength (AES is NIST's example). Federal agencies must also use a FIPS 140-validated module.
- 03Every copy of the key is wiped: the drive's own, plus any backup, escrow or recovery key held in a console or a drawer.
Degaussing is a purge technique for older magnetic media only. It does nothing to flash: in Rev 2's own example, degaussing an SSD "can complete successfully, but no sensitive data is sanitized."
Destroy
Destroy means disintegrate, incinerate, melt, pulverize or shred, so that no laboratory can read the pieces and the device can never store data again. It is the only method for paper, and the simplest for a device you will not reuse.
One more thing Rev 2 settles: the old seven-pass overwrite. Its FAQ says multi-pass overwriting is unnecessary, does very little on modern storage, and wears out flash. If a single pass is not enough for your data, the answer is purge or destroy, not more passes.
The decision flow: which method for which device
Rev 2 decides on the data, not the device. Its Fig. 1 asks whether the media will be reused, how sensitive the data is (low, moderate or high confidentiality), and whether the media is leaving your control. Validation and a record follow every branch. Try it with the device in front of you:
Answer the four questions. Pre-filled for a laptop being sold.
What holds the data?
Will it be reused?
Reused by you, or by anyone after you.
How sensitive is the data?
Agencies treat CUI as at least Moderate (32 CFR 2002.14(g)).
Will it leave your control?
Sold, donated, a lease return, a warranty swap, a recycler.
Method
Purge
- Reused: yes
- Moderate
- Leaves your control
- Purge
It leaves your control, so the data has to be beyond a laboratory's reach, while the device stays usable.
Technique: The drive's own sanitize command or cryptographic erase (check the three CE conditions above); degauss only older magnetic media.
- Then 1Verify the tool or machine finished without errors.
- Then 2Validate: approve, or reject and go again with a stronger method.
- Then 3Document it on a certificate of sanitization.
Two things stand out once you click through. First, low and moderate get the same answer at every step, so for most shops the only real question is whether anything you hold counts as high. Agencies must treat CUI as at least moderate under 32 CFR 2002.14(g), and the rule reaches contractors through their contracts. Our reading: treat every device that ever held CUI as moderate unless your prime or contracting officer says otherwise in writing.
Second, "leaving your control" is wider than selling. A copier going back at the end of its lease, a laptop swapped under warranty, a pallet of old towers collected by a recycler: all of them leave, and all of them need purge at the least.
Your shop's devices, one by one
NIST SP 800-171 is explicit that 3.8.3 covers more than laptops: its discussion names workstations, network components, scanners, copiers, printers, notebook computers, mobile devices, paper and microfilm. Rev 2 adds that one machine can hold several kinds of storage that each need their own technique. Here is where data sits in a typical shop, and what we would do with each. The advice is our reading of the NIST text; the method still comes from the flow above.
CNC controls, CMMs and shop-floor PCs
- Where the data hides
- Part programs, setup sheets and the drawings behind them: in the control's own memory, a hard drive or flash card inside the cabinet, the DNC or CAM PC that feeds it, and the USB sticks walked between them.
- What we would do
- Ask the control builder for a Statement of Volatility, the maker's list of every memory in the unit and how to erase it. Before the control goes out for repair (3.7.3) or the machine is sold, back up, purge or pull the storage, and record it.
- Watch for
- A used machine sold at auction with years of a customer's programs still in the control.
Laptops and desktops with SSDs
- Where the data hides
- The SSD, including spare space the computer never shows you, plus any second drive.
- What we would do
- Purge with the drive's sanitize command or cryptographic erase, if the CE conditions hold. Destroy if it will not be reused.
- Watch for
- "Reset this PC" and deleting files are clear at best, and an overwrite cannot reach every cell on flash.
Older PCs and spinning hard drives
- Where the data hides
- Every platter, including blocks the drive has remapped as bad.
- What we would do
- One overwrite pass is clear; the drive's sanitize command is purge. Degauss only with a degausser matched to the drive.
- Watch for
- Paying for seven passes. Rev 2 calls multi-pass overwriting unnecessary.
External drives, NAS and backups
- Where the data hides
- Every drive in the box, and every backup copy of the data and of the encryption keys.
- What we would do
- Sanitize each drive, not just the volume. Treat backups and escrowed keys as media of their own.
- Watch for
- Cryptographic erase does not reach a key someone backed up to a console or a drawer.
USB sticks, SD and CF cards
- Where the data hides
- Flash with wear levelling: old copies survive in cells you cannot address.
- What we would do
- Keep CUI sticks inside your boundary and destroy them at end of life rather than wiping and giving them away.
- Watch for
- Shredding small flash is a low-category answer; ask your destruction provider which technique they use.
Printers, copiers and multifunction devices
- Where the data hides
- An internal drive or flash with every scan, copy and print job, plus address books and saved fax numbers.
- What we would do
- Before you sign a lease, ask the dealer which sanitize function the model has and write in that you keep the drive, or that it is purged, at return.
- Watch for
- Rev 1 warned most office equipment offers only clear. A lease return leaves your control and needs purge.
Phones and tablets
- Where the data hides
- Internal flash, a removable card, and accounts that sync it all back.
- What we would do
- Check the maker's documentation for whether its reset is a cryptographic erase. Take out the card and sanitize it on its own.
- Watch for
- On a basic phone that only offers a factory reset, Rev 2 counts that reset as clear, not purge.
Servers, firewalls and switches
- Where the data hides
- Server drives, plus configurations, logs and passwords that protect your systems.
- What we would do
- Sanitize server drives like any other. Reset network gear to factory state and wipe the configuration backups.
- Watch for
- A server's RAID set: each drive is media, even the failed one pulled last year.
Paper, drawings, travelers and print supplies
- Where the data hides
- Prints, routers and travelers, and the ribbons, drums and platens Rev 2 counts as hard copy.
- What we would do
- Destroy. Shred to a size your policy names, and keep CUI paper out of the open recycling bin.
- Watch for
- A drawing redacted with a marker. Redaction counts only when it is as effective as removing the words.
Cloud storage and email
- Where the data hides
- Drives you will never see, in someone else's data center.
- What we would do
- Purge by cryptographic erase. Read the service agreement for how keys are held and destroyed.
- Watch for
- Destroy does not apply to logical storage, so there is no certificate of destruction to ask for.
What the rules require: 3.8.3, FAR 52.204-21 and 3.7.3
Media sanitization is one of the few requirements that sits in both CMMC levels. A shop that holds only federal contract information meets it through the FAR basic safeguarding clause; a shop with CUI meets it through NIST SP 800-171 Rev 2, the revision DoD binds today. The CMMC program around them is changing, so this is what applies now:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.FAR 52.204-21(b)(1)(vii) (Nov 2021), CMMC Level 1 (MP.L1-b.1.vii)
Sanitize or destroy system media containing CUI before disposal or release for reuse.NIST SP 800-171 Rev 2, 3.8.3, CMMC Level 2 (MP.L2-3.8.3)
What the assessor checks (800-171A)
- [a]Media containing CUI is sanitized or destroyed before disposal.
- [b]Media containing CUI is sanitized before it is released for reuse.
Ensure equipment removed for off-site maintenance is sanitized of any CUI.NIST SP 800-171 Rev 2, 3.7.3, CMMC Level 2 (MA.L2-3.7.3)
What the assessor checks (800-171A)
- Equipment to be removed from your spaces for off-site maintenance is sanitized of any CUI.
None of the three names NIST SP 800-88 in the requirement itself. NIST's discussion under 3.8.3 and 3.7.3 points to it: "[SP 800-88] provides guidance on media sanitization." Our reading: a method you can trace to Rev 2's flow, with a record, is the straightest answer to "how do you know it was sanitized?"
| Requirement | Level | If not met | POA&M |
|---|---|---|---|
| MP.L1-b.1.vii | Level 1 | Level 1 is met or not met as a whole | No POA&M at Level 1 |
| MP.L2-3.8.3 | Level 2 | 5 points of 110 | Never: only 1-point items may |
| MA.L2-3.7.3 | Level 2 | 1 point of 110 | May go on a POA&M |
So 3.8.3 has to be met on the day you score; it cannot wait on a plan of action. Run your own numbers in the SPRS score calculator, and see how item vii sits among the other fourteen in CMMC Level 1 requirements.
When destroying CUI, including in electronic form, agencies must do so in a manner that makes it unreadable, indecipherable, and irrecoverable.32 CFR 2002.14(f)(2), the CUI rule
Where no law names a method, the same paragraph sends agencies to the destruction guidance in NIST SP 800-53 and SP 800-88, or to a method approved for classified information. The CUI rule binds agencies; it reaches a contractor through its contract.
What an assessor expects to see
Nobody can look at a wiped drive and see that it was wiped. An assessor reads records and asks people. NIST SP 800-171A lists exactly what they may pick from for 3.8.3:
Examine
- System media protection policy
- Procedures addressing media sanitization and disposal
- Applicable standards and policies addressing media sanitization
- Security plan
- Media sanitization records
- System audit logs and records
- System design documentation
- System configuration settings and associated documentation
- Other relevant documents or records
Interview
- Personnel with media sanitization responsibilities
- Personnel with information security responsibilities
- System or network administrators
Test
- Organizational processes for media sanitization
- Mechanisms supporting or implementing media sanitization
"Media sanitization records" is the line to plan for, because it is built one device at a time. Rev 2 says a certificate of sanitization should be completed for each device sanitized, on paper or electronically, and lists what it should record at the least:
- Manufacturer
- Model
- Serial number
- Your property or asset number
- Media type
- Media source (user, computer)
- Confidentiality category (optional)
- Method: clear, purge or destroy
- Technique (overwrite, block erase, CE, degauss)
- Tool used, with its version
- Verification method
- Who verified and validated: name, title, date, location, contact, signature
Our reading of a complete evidence pack for 3.8.3 and item vii:
- 01A written sanitization policy that maps your data to clear, purge or destroy, and names who does what. Policy templates
- 02A short procedure per kind of device: the tool, the setting, how the person checks it finished.
- 03A media list that follows each device from the day it arrives to the day it leaves.
- 04One signed certificate per device sanitized, like the one below.
- 05For anything a destruction provider takes away, their certificate listing your serial numbers and their technique, stapled to your own record.
- 06A training record for whoever does the work. CUI training
A certificate of sanitization you can print
This sheet follows the sample certificate in Rev 2's Appendix C, field for field, plus one block of our own that names the requirement it answers. Print a stack, keep them where the work happens, and file each one against the device's line on your media list.
Certificate of sanitization, after NIST SP 800-88 Rev 2 Appendix C, cuideck.com
One sheet per device. Fill it by hand, sign it, and file it with your media list.
Person performing sanitization
Media information
Sanitization details
Method
- Clear
- Purge
- Destroy
Media destination
- Internal reuse
- External reuse
- Recycling facility
- Manufacturer
- Other (specify)
Requirement this covers, our addition
- FAR 52.204-21(b)(1)(vii)
- NIST SP 800-171 3.8.3
- NIST SP 800-171 3.7.3, off-site repair
Signature
I attest that the information provided on this statement is accurate to the best of my knowledge.
Concurrence
Questions shops ask about media sanitization
Is a factory reset enough?
It counts as clear only when the device offers nothing better and its own interface cannot bring the old data back. That is fine for a device that stays in your shop at low or moderate. A device leaving your control needs purge, so check whether the maker documents its reset as a cryptographic erase or a sanitize command.
Do we still need a DoD seven-pass wipe?
No. Rev 2's FAQ says multi-pass overwriting is unnecessary and the old seven-pass practice achieves very little on modern storage. One pass is clear; if that is not enough for the data, move to purge or destroy.
Can we drill a hole through old drives and call them destroyed?
Rev 2 says drilling, bending or cutting may only partly damage a drive and leave parts readable in a lab. Purge first and then drill if you like, or send the drive for destruction and get a certificate with its serial number.
Does Level 1 require NIST SP 800-88?
The FAR text asks you to sanitize or destroy media holding federal contract information before disposal or reuse; it names no method. Rev 2's flow is the easiest way to show your method was sound, and the Level 1 checklist carries item vii with the other fourteen. No POA&M is allowed at Level 1, so it has to be met.
Our CNC control is going back to the builder for repair. What do we do?
3.7.3 asks that equipment removed for off-site maintenance is sanitized of any CUI. Back up the programs, purge or pull the storage the builder's Statement of Volatility lists, fill a certificate, and restore the programs when the control comes home.
We degauss everything. Is that purge?
Only for older magnetic media, and only with a degausser strong enough for the drive. Degaussing does nothing to SSDs or USB sticks, and Rev 2 does not count it as destroy even when the drive stops working.
How do we sanitize CUI in the cloud?
You cannot reach the drives, so purge by cryptographic erase is often the only option. Rev 2's FAQ tells you to check the service agreement for how keys are managed and how their destruction can be traced. Our guide to FedRAMP Moderate equivalency covers the cloud side of DFARS 7012.