What is Media Sanitization as per NIST?
According to NIST 800-88 Rev. 1, media sanitization is "a process that renders access to target data on the media infeasible for a given level of effort." It protects the confidentiality of sensitive information by preventing its unauthorized disclosure. If improperly sanitized media is released from organizational control for reuse, reassignment, donation, disposal, or maintenance, persisting residual data may stay on them and become accessible, resulting in data breaches, regulatory violations, financial losses, and reputation harm.
The Executive Summary of NIST 800-88 states that, “parties attempting to obtain sensitive information may seek to focus their efforts on alternative access means such as retrieving residual data on media that has left an organization without sufficient sanitization effort having been applied.”
NIST SP 800-88 provides organizations with guidance for establishing secure media sanitization processes across their enterprise. Following these guidelines also supports broader privacy and security compliance efforts by helping organizations meet the data disposal requirements of regulations such as GDPR, CCPA, HIPAA, and GLBA.
How to Select an Appropriate Media Sanitization Method?
NIST does not recommend a universal sanitization technique for every storage device. Instead, it provides a risk-based framework using which organizations can determine the most appropriate sanitization method based on the data security categorization, media reuse, and whether the media will leave organizational control.
The guidelines provide a “Sanitization and Disposition Decision Flow” chart (See Image 1) in Section 4: Information Sanitization and Disposition Decision Making, to help organizations choose the appropriate sanitization technique for storage media. Choosing the appropriate category is based on three criteria: level of data confidentiality, media reusability, and whether it will leave organizational control.
The higher the confidentiality of the data, the stronger the media sanitization method. The guidelines also emphasize validating the sanitization outcome and documenting it for audit and record-keeping purposes.
Image 1: Sanitization and Disposition Decision Flow
Source: NIST 800-88 Revision 1
What are the Media Sanitization Methods Under NIST?
The guidelines classify media sanitization into three different categories, viz. Clear, Purge, and Destroy, as mentioned in Section 5: Summary of Sanitization Methods. Each category provides a different level of protection against data recovery and should be selected based on the confidentiality of the information, the type of storage media, risk to information confidentiality, whether the media will remain under or leave the organization's control, and its final disposition.
NIST Clear
It is the minimum recommended level of media sanitization that protects data against simple, non-invasive recovery techniques. It sanitizes data by overwriting all the user-addressable storage space on the media with non-sensitive data. Clear is generally recommended when the storage media will continue to remain within the organization's control.
Learn more about NIST Clear.
NIST Purge
Purge provides a higher level of media sanitization by making data recovery infeasible, even using advanced laboratory techniques. Depending on the storage media, Purge can be performed using logical methods such as overwrite, block erase, or Cryptographic Erase, or physical techniques such as degaussing. Purge methods are recommended when storage media leaves an organization's control through resale, return, recycling, or disposal, while still allowing the media to be reused where applicable.
Learn more about NIST Purge.
Destroy
These methods render target data recovery infeasible using state-of-the-art laboratory techniques. Since these techniques physically destroy the media, there is no possibility of media reuse. Methods such as shredding, pulverization, incineration, melting, or disintegration are all categorized as Destroy sanitization methods. These are recommended when the storage medium cannot be sanitized using Clear or Purge, when it has reached end-of-life, or when internal policies or regulatory requirements mandate media destruction.
What Types of Storage Media Does NIST 800-88 Apply To?
NIST SP 800-88 provides guidance on sanitizing different types of storage media in Appendix A: Minimum Sanitization Recommendations. The guideline applies to a broad range of storage media, both physical, like paper and microforms, and digital, which include:
- Networking Devices like routers and switches
- Mobile Devices like iPhones, iPads, tablets, PDA’s, Android OS devices, etc.
- Office Equipment, like a printer and fax.
- Magnetic Media like floppies, magnetic disks, magnetic tapes, etc.
- Hard Disk Drives (HDDs), SATA, PATA, SCSI, SAS, Fibre Channel, etc.
- Peripherally Attached Storage (PAS), like USB, Firewire, etc.
- Optical Media such as CDs and DVDs
- Solid State Drives (SSDs), SATA, PATA, SSSDs, SAS, UAS, NVMe, etc.
- USB Removable Media such as pen drives, thumb drives, flash memory drives, etc.
- Memory Cards like SD, SDHC, MMC, etc.
- Embedded Flash Memory, like network adapters, peripheral cards.
- RAM and ROM-Based Storage Devices
For devices that are not covered by the document, NIST urges organizations to identify and use those processes that fulfill the requirements of Clear, Purge, and Destroy sanitization categories.
What are Recommended Sanitization Techniques as per Media Type?
Different storage media have distinct physical and logical features; organizations should choose a sanitization method that is appropriate for the type of storage media and the level of data confidentiality.
| Storage Media |
Recommended Sanitization Techniques |
| Hard Copy Storage |
Destroy: Shredding or Burning
|
| Networking Devices |
Clear: Manufacturer Reset
Destroy: Shred, Disintegrate, Pulverize, or Incinerate
|
| Mobile Devices |
Clear: Full Sanitize using Cryptographic Erase (iPhone), Factory Reset (Android OS)
Purge: Full Sanitize using Cryptographic Erase (iPhone), eMMC Secure Erase or Secure Trim command, Cryptographic Erase (Android OS)
Destroy
|
| Equipment |
Clear: Manufacturer Reset
Destroy
|
| Magnetic Media |
Clear: Overwrite with single or multiple passes, Rerecord (Reel & Cassette)
Purge: Degauss
Destroy: Incinerate
|
| HDDs |
Clear: Overwrite with single or multiple passes
Purge: Overwrite EXT command, Cryptographic Erase, SECURE ERASE UNIT command, SCSI SANITIZE command, Degaussing
Destroy
|
| PAS |
Clear: Overwrite with single or multiple passes
Purge: Rewrite, Block Erase, Cryptographic Erase (Refer to the manufacturer for Purge support)
Destroy
|
| Optical Media |
Destroy: Optical Disk Grinder, Incinerate, or Optical Disk Media Shredders
|
| SSDs |
Clear: Overwrite with single or multiple passes, SECURITY ERASE UNIT command
Purge: Block Erase, Cryptographic Erase, Secure Erase, SCSI SANITIZE command, User Data Erase command (NVMe)
Destroy
|
| USB Flash Drives |
Clear: Overwrite, Block Erase, Cryptographic Erase
Purge: Refer to the manufacturer for Purge support
Destroy
|
| Memory Cards |
Clear: Overwrite with at least two or more passes
Destroy
|
| Embedded Flash Memory |
Clear: Reset to factory settings (If supported)
Purge: Destroy flash memory independently of the board.
Destroy
|
| RAM and ROM-Based Storage Devices |
Clear/Purge: Remove Power, Chip Purge, or Overwrite
Destroy
|
Destroy: Shred, Disintegrate, Pulverize, or Incinerate
Organizations should always verify that the selected sanitization technique has been successfully applied or not and document the same before the storage media is reused, transferred, or disposed of.
What is Sanitization Verification?
Section 4.7.3: Verification of Sanitization Results is one of the fundamental recommendations of NIST SP 800-88. Organizations should verify that the selected sanitization method has been successfully applied or not by performing a full reading of all accessible areas or through representative sampling. NIST also recommends verifying a subset of media selected at random using an independent verification tool developed by a different vendor than the sanitization tool.
Once the sanitization process is completed, a ‘Certificate of Media Disposition’ or ‘Certificate of Destruction’ should be generated and kept for future reference.
What is a Certificate of Sanitization?
NIST 800-88 guidelines require maintaining a Certificate of Media Disposition that documents the entire sanitization activity. These are sometimes also referred to as a Certificate of Sanitization or Certificate of Destruction. This certificate could be a piece of paper or may be kept in electronic form, like a PDF. A certificate should typically include information such as:
- Storage media manufacturer,
- Model
- Serial number
- Storage media type
- Media Source
- Sanitization category (Clear, Purge, or Destroy)
- Sanitization method (Overwrite, Block Erase, Cryptographic Erase, Secure Erase)
- Software or tool used
- Verification Method
- Media Destination
- Date and time of sanitization
- Both Sanitization and Verification:
- Name
- Position
- Date
- Location
- Contact Information
- Signature
These records provide an auditable trail of the sanitization process and help organizations demonstrate compliance during internal and external audits. Read our article Significance of Data Destruction Certificate.
Conclusion
NIST SP 800-88 Rev.1 is still one of the most extensively used media sanitization rules for safely sanitizing data from electronic storage media. Organizations can protect sensitive information throughout the IT asset lifecycle by classifying information, selecting the appropriate media sanitization category, implementing media-specific sanitization techniques, verifying each sanitization process, and maintaining proper documentation.
