| When a business decommissions laptops, servers or storage arrays, the question is never just “have we deleted the files?” It is whether the data can be recovered by anyone with the right tools. That is the problem NIST Special Publication 800-88 was written to solve, and it has become the reference point most reputable ITAD providers work to. NIST 800-88 sets out three levels of media sanitisation: Clear, Purge and Destroy. Clear covers standard overwriting techniques that protect against simple software-based recovery attempts, suitable for equipment that will stay within a controlled environment. Purge goes further, using techniques such as cryptographic erasure or firmware-level secure erase commands that defeat laboratory-grade recovery methods, and is the appropriate standard for assets leaving an organisation’s control. Destroy, as the name suggests, physically renders the media unusable, typically through shredding or disintegration, and is reserved for the most sensitive data or media that cannot be reliably sanitised any other way. What makes the standard useful in practice is that it does not treat all media the same. A traditional spinning hard drive, a solid-state drive and a mobile device all store and manage data differently, and NIST 800-88 provides guidance specific to each. SSDs, for example, use wear-levelling that can leave copies of data in blocks not addressed by a simple overwrite, which is why cryptographic erasure or the drive’s native secure erase command is generally recommended over old-style overwriting for flash media. For businesses, the practical value of NIST 800-88 is twofold. First, it gives you a defensible position if you are ever asked to prove that redundant IT equipment was handled responsibly — auditors, regulators and customers increasingly expect to see evidence that a recognised standard was followed, not just a verbal assurance. Second, it removes ambiguity from supplier conversations. When you ask an ITAD partner whether they sanitise to NIST 800-88 Purge standard and receive a certificate referencing it, you know exactly what was done and to what level of assurance. It is worth noting that NIST 800-88 is a US federal standard, but it has been adopted informally as best practice well beyond government contracting in the UK and Europe, often sitting alongside frameworks such as ISO 27001 and the requirements of UK GDPR. Many data erasure software platforms, including those used by professional ITAD providers, build NIST 800-88 compliance directly into their reporting, generating an audit trail for every device processed. If your organisation is reviewing its end-of-life IT policy, asking whether your current disposal partner sanitises to NIST 800-88 — and at which level — is one of the simplest questions that reveals how seriously they take data security. It should never be assumed; it should always be evidenced. |
