What NIST SP 800-88 Rev. 2 asks a certificate to record
NIST Special Publication 800-88 Revision 2 (September 2025) turned media sanitization into a documented program, and section 4.6 describes the record that closes each event: a certificate of sanitization completed for each piece of sanitized media. It lists the media’s manufacturer, model, and serial number, an organizationally assigned media or property number where you use one, the media type and its source, an optional pre-sanitization confidentiality category, the sanitization method (clear, purge, or destroy) and technique, the tool used including its version, the verification method, and, for the people performing verification and validation, their name, position or title, date, location, contact information, and signature. This checker grades a certificate against those fifteen core fields and treats the property number and confidentiality category as optional, as the standard does.
The fields are not paperwork for its own sake. The serial number is what lets a certificate be sampled against your inventory, which is how a CMMC assessor tests disposition evidence. The technique and tool are what make a method claim checkable: as the Rev. 2 field guide puts it, “Purge” on a flash drive by an unnamed tool is not a verifiable claim. And the verification method is what separates a record of an action from a record of a result, because Rev. 2 treats verifying the operation and validating the outcome as two different steps. When the technique is cryptographic erase, Rev. 2 notes the record may need more: section 3.2.5 lists traceability details such as how keys were generated, which areas of the media were addressed, and how the keys themselves were sanitized.
Per-device certificates, shipment certificates, and counts
A certificate that says “one pallet, 240 drives, destroyed” can’t be reconciled: there is no way to prove that any particular retired serial is among the 240. A shipment certificate backed by a serial-by-serial report works, because every device is still individually accounted for. That is why a count-only certificate can never grade above a D here, however complete the rest of it is. The audit-readiness extras (a unique certificate number, a tie to your manifest or chain-of-custody log, the provider’s certification numbers, and where the material went next) are not in section 4.6, but buyers and auditors ask for them, so they are scored separately and never pull the main grade down.
Use the result to ask your provider for a corrected template before the next pickup, or to specify the fields up front: the Certificate of Sanitization & Destruction Spec in the Vault turns this checklist into contract language, and the Vendor Due Diligence Scorecard covers the rest of what to verify about the provider issuing it.