The Standard Got an Update
THE CRUNCH · EP 30
TAP TO PAUSE
PAUSED — TAP TO RESUME
Related Short · 0:30 · CyberCrunch on YouTube
NIST 800-88: clear, purge, destroy
NIST defines three sanitization methods. Clear overwrites user data, Purge makes recovery infeasible even in a lab, and Destroy makes the media unusable. Then verify and document it.
Not every drive needs a shredder. But every drive needs the right method. NIST defines three. Clear. Purge. Destroy. Clear overwrites the user data. Purge makes recovery infeasible, even in a lab. Destroy makes the media unusable. Then verify and document it. CyberCrunch offers all three for all applicable media. Right method. Right proof.
If your media-sanitization policy cites NIST 800-88 Revision 1 as the current standard, it's citing a withdrawn document. NIST published Revision 2 in September 2025 and formally retired the 2014 edition.
The vocabulary survives: Clear, Purge, and Destroy are still the three sanitization methods, chosen by data sensitivity, media type, and whether the media leaves your control. What changed is everything around them. Rev. 2 is organized around running a sanitization program — a written policy, a decision flow, and records — rather than a menu of techniques. For technique details, it now defers to IEEE 2883 and NSA specifications. And cryptographic erase, the fastest-growing method, gets explicit conditions: strong encryption for the data's whole life on the media, verifiable key destruction, and a traceable operation.
The through-line is proof. Verification is elevated, and the standard now includes a sample certificate of sanitization: media, method, technique, verification result, per serial number. Same three methods — higher bar for showing your work.
The full explainer covers the three methods, the media-to-method map, everything Rev. 2 changed, and a checklist you can run this quarter.