NIST SP 800-88 Rev. 2: What Changed for Data Destruction, and What It Means in Australia

Last updated: 6 November 2026. Reviewed against NIST SP 800-88 Rev. 2 and the NIST FAQ of 16 July 2026.

NIST SP 800-88 Rev. 2 is the current US guideline for media sanitisation. NIST published it on 26 September 2025 and withdrew Rev. 1, which dated from December 2014. The main changes are that Rev. 2 drops the per-media technique tables in favour of IEEE 2883, asks organisations to run a documented sanitisation program, no longer treats degaussing as a destroy method, cautions against shredding drives that held sensitive data, and separates verification from validation.

For more than a decade, “wiped to NIST 800-88” has been the shorthand Australian organisations use for how their retired drives are handled. In July 2026 NIST added a set of FAQs clarifying how Revision 2 of SP 800-88, Guidelines for Media Sanitization, should be read. Any disposal policy, tender specification or provider contract that still cites Rev. 1 is pointing to a withdrawn document.

The video below walks through the main changes in Rev. 2 in about nine minutes.

What is different about Rev. 2?

Rev. 1 was best known for its tables of techniques for each media type. Rev. 2 removes them. Cryptographic erase is the one exception. For everything else, NIST now points organisations to IEEE 2883 (the IEEE Standard for Sanitizing Storage), to NSA specifications, or to a standard their own policy approves.

What Rev. 2 asks for instead is a program. NIST’s FAQ says a sanitisation policy should set out:

• how the organisation’s data classifications map to sanitisation methods
• documentation and evidence requirements, including certificates of sanitisation
• roles, responsibilities and mandatory training
• tool configuration, calibration, testing and maintenance
• verification and validation protocols

Rev. 2 also replaces “electronic media” with “information storage media”, a term that covers cloud, container and object storage as well as physical drives.

Are clear, purge and destroy still the three methods?

Yes. The three methods remain, with some sharper definitions.

• Clear uses standard read and write commands to overwrite user-addressable space, typically in a single pass, or a factory reset where rewriting isn’t supported. The FAQ states plainly that multi-pass overwriting is unnecessary for modern storage and can shorten the life of flash media.
• Purge makes recovery infeasible even with state-of-the-art laboratory techniques, while leaving the device potentially reusable. Techniques include overwrite, block erase and cryptographic erase, carried out through the device’s dedicated sanitise commands. Rev. 2 says purge should be used in place of clear whenever possible.
• Destroy makes recovery infeasible using laboratory techniques and leaves the device unable to store data again.

Flash storage behaves very differently from spinning disks, which is why wear levelling and over-provisioning matter so much here. Our guide to SSD data destruction explains the difference.

What are the four biggest changes?

1. Shredding is not automatically the safest option

This is the change most likely to surprise people. Rev. 2 notes that as data density and the hardness of drive materials increase, some destructive techniques become less effective. It states that “pulverize and shred techniques for ISM should be avoided for anything but the lowest security categories of data.” The FAQ adds that for SSDs and similar media holding medium- or high-security data, incineration techniques such as melting are the expected route.

Rev. 2 also warns that bending, cutting or drilling a hole through a drive may only partly damage it, leaving portions readable with laboratory tools.

The practical takeaway is not to stop shredding. It is to know what each drive held, to sanitise working drives logically where possible, and to match any physical destruction to the sensitivity of the data.

2. Degaussing is not a destroy method

Rev. 2 says that “at the time of this writing, degaussing is not considered an approved destroy sanitization technique.” Degaussing is now described only as a purge technique for legacy magnetic media. Even there, it depends on matching the degausser’s strength to the drive. Many existing degaussers lack the force needed for newer high-coercivity drives, and degaussing can leave a drive inoperable without actually sanitising the data.

It also does nothing to flash storage. Rev. 2 gives the example of an SSD degausser run that “can complete successfully, but no sensitive data is sanitized.”

3. Cryptographic erase comes with conditions

Cryptographic erase sanitises a self-encrypting drive by destroying its encryption keys, and it is very fast. In cloud environments, where you never touch the physical hardware, it is often the only practical purge option. The FAQ lists conditions that must hold for it to count:

• no sensitive data was written to the media in plaintext before the encryption keys were established
• the encryption algorithm has a security strength of at least 128 bits (for example, AES)
• the target keys are permanently sanitised through zeroisation

If any of these can’t be confirmed, cryptographic erase alone is not enough. Our article on cryptographic erasure covers how the keys are handled in practice.

4. Verification and validation are now separate steps

Rev. 2 splits “sanitisation assurance” into two parts. Verification checks that the technique ran and finished without errors. Validation is a decision by the organisation: someone reviews the verification results against the sensitivity of the data and formally accepts the outcome, including any residual risk.

Rev. 2 then expects a certificate of sanitisation for each device. Its sample form records the manufacturer, model, serial number and media type; the method and technique; the tools used, including software version; the verification and validation results; and the device’s destination (internal reuse, external reuse, recycling facility or manufacturer). A single batch certificate for “120 laptops” does not match this model. Our guide to chain of custody documentation shows how per-device records fit into the wider audit trail.

How does Rev. 1 compare with Rev. 2?

Topic	Rev. 1 (2014, withdrawn)	Rev. 2 (2025)
Technique guidance	Tables of techniques for each media type	Points to IEEE 2883, NSA specifications or an approved organisational standard
Scope	“Electronic media”	“Information storage media”, including cloud, container and object storage
Overwriting	Single pass generally sufficient	Single pass; multi-pass described as unnecessary and harmful to flash media
Degaussing	A purge option for magnetic media	Purge only, for legacy magnetic media and only with a degausser strong enough for the drive. Expressly not an approved destroy technique
Shredding and pulverising	Accepted destroy methods	To be avoided for anything but the lowest security categories of data
Assurance	Verification	Verification plus a separate validation decision by the organisation
Records	Certificate of media disposition for each item	Certificate of sanitisation per device, now including validation results and destination

How does NIST 800-88 Rev. 2 fit Australian requirements?

NIST is a US publication. Australian organisations use it because clients, auditors and insurers widely recognise it. Three local frameworks sit alongside it.

The Privacy Act 1988. Australian Privacy Principle 11.2 requires organisations to take reasonable steps to destroy or de-identify personal information they no longer need. The OAIC notes that since 11 December 2024, APP 11.3 makes clear that “reasonable steps” include technical and organisational measures. A documented sanitisation program with per-device records is strong evidence of both. Our article on the Privacy Act and old IT equipment covers APP 11 in more depth.

The ASD Information Security Manual. The Australian Signals Directorate’s ISM Guidelines for media (September 2026) apply to government systems and to organisations that adopt them. Its controls are more prescriptive than Rev. 2 and differ in places. Flash media must be overwritten at least twice with a random pattern and then read back for verification (ISM-0359). Magnetic hard disks may be destroyed with a furnace or incinerator, hammer mill, disintegrator, grinder or sander, or degausser (ISM-1724). Destruction methods that produce particles must reduce them to no more than 9 mm (ISM-0368). Destruction equipment must be approved by the Security Construction and Equipment Committee or ASIO (ISM-1361). If your organisation is bound by the ISM, those controls are what your assessors will test against. Our article on government data destruction covers classification requirements.

AS 5377:2022. The Australian standard for managing electrical and electronic equipment for re-use or recycling covers collection, storage, transport, preparation for re-use and treatment. Its scope now includes data security and traceability.

Is your disposal process ready for Rev. 2? A checklist

Check	What good looks like
Policy references	Your disposal policy and contracts cite SP 800-88 Rev. 2, not Rev. 1, and name the technique standard underneath it (for example IEEE 2883).
Data classification	Each class of data maps to clear, purge or destroy, and someone owns that mapping.
SSDs and flash	Flash media is never degaussed. Working drives are purged with the device’s sanitise commands where possible.
Physical destruction	Destruction is matched to data sensitivity. Particle size is known and recorded.
Cryptographic erase	The three preconditions are confirmed before it is relied on.
Validation	A named person reviews verification results and formally accepts the outcome.
Records	Each device has a record linking serial number, method, tool and version, result and final destination.
Failures	There is a written process for devices that fail sanitisation.

Frequently asked questions

Is NIST SP 800-88 Rev. 1 still valid?

No. NIST withdrew Rev. 1 on 26 September 2025, the day Rev. 2 was published. Policies and contracts that cite Rev. 1 should be updated.

Does Rev. 2 ban shredding?

No. It says shred and pulverise techniques should be avoided for anything but the lowest security categories of data. Shredding still has a place, but it should be matched to what the drive held.

Can SSDs be degaussed?

No. Degaussing has no effect on flash storage. Rev. 2 notes that a degausser run on an SSD can complete successfully while sanitising no data.

Is a single overwrite pass enough?

For the clear method, yes. The NIST FAQ says multi-pass overwriting is unnecessary for modern storage and can shorten the life of flash media.

Does NIST SP 800-88 apply to Australian businesses?

It is not Australian law. Australian organisations use it because clients, auditors and insurers recognise it. Your legal obligations come from the Privacy Act and, for government systems, the ISM.

Listen to the podcast

Our podcast episode on Rev. 2 runs for about 27 minutes and goes through each change in more depth.

There is also a short summary of this article as a YouTube Short. More videos from our team are on YouTube, Instagram and TikTok.

Related reading

• Verification of Data Destruction: How to Confirm It Worked
• Self-Encrypting Drives: Data Destruction Considerations
• Server Decommissioning: A Step-by-Step Guide

Sources

1. NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025), and the SP 800-88r2 FAQ (16 July 2026).
2. Australian Signals Directorate, Information Security Manual: Guidelines for media (September 2026).
3. Office of the Australian Information Commissioner, De-identification and the Privacy Act.