What NIST 800-88 actually means, in plain English

Every certificate we issue says the card or drive was erased to NIST 800-88. Most people nod at that and move on. This is what it means, and why it matters when the media in question is a memory card rather than an old hard drive.

Where it comes from

NIST is the National Institute of Standards and Technology, an agency of the US government. Its Special Publication 800-88, “Guidelines for Media Sanitization”, is the document that organisations around the world use to decide how thoroughly data has to be removed from a piece of storage before it leaves their control. It is not a law. It is the reference that laws, contracts and auditors point at when they say “erased properly”.

The current version is Revision 2, published in September 2025, which replaced the 2014 edition (NIST SP 800-88 Rev. 2). The new edition keeps the same three levels of sanitisation and hands the technical detail of how to achieve each one to an engineering standard, IEEE 2883, so the two are usually quoted together.

The three levels

The standard defines three methods. The names are ordinary words used in a precise way.

Clear. Overwrite the data using the device’s normal read and write commands, so that ordinary tools cannot get it back. Think of writing over every page of a notebook. It is enough for media that will stay inside your organisation, and for most drives it is a single pass; the old idea of seven or thirty-nine passes is explicitly retired.

Purge. Use a method that makes the data unrecoverable even in a laboratory with specialist equipment, while leaving the device usable afterwards. For a memory card that means telling the card’s own controller to erase itself, reaching the parts of the flash that ordinary writes cannot. This is the level for media that will be reused, sold or handed to someone else.

Destroy. Shred, disintegrate or otherwise physically wreck the device so that it can never store anything again. Certain, but final, and the reason a box of perfectly good cards ends up in a skip.

A quick format, or dragging files to the bin, is none of these. It removes the index, not the pages.

Why memory cards need Purge

A hard drive stores your data where it says it does. A memory card does not. Flash memory wears out with use, so the card’s controller spreads writes across the chip and keeps spare blocks in reserve. When you overwrite a file, the controller may write the new data somewhere else and leave the old copy in a block you cannot reach through the normal interface.

The standard says this directly: flash devices “that contain spare cells and perform wear levelling make it infeasible for a user to sanitize all previous data” by overwriting, because the device “cannot support directly addressing all areas in which sensitive data has been stored”. It goes on to warn that people who learned erasure on hard drives and kept doing the same thing on flash “can be exposing their data to increased risk of unintentional disclosure”.

That is why our line uses the card’s own erase commands for Purge, and why the certificate states which level was actually reached rather than which one was attempted. A card that will only accept an overwrite gets a Clear certificate that says so.

What a certificate has to say

The standard puts as much weight on the record as on the erasure. A useful certificate names the device, by serial, not by a label that could be swapped; states the method used and the level achieved; says how the result was verified; and records who did it and when. Ours also carries the measured health of the card, because if you are going to reuse it you want to know how much life it had left at the moment it was certified.

What it means in the UK

UK GDPR does not name NIST 800-88. It requires that personal data is not kept longer than necessary and is protected against unauthorised access, and it expects you to be able to show what you did. A memory card from a camera, a dashcam or a medical device holds personal data in almost every case. A certificate to a recognised standard is how you show an auditor, an insurer or the ICO that the data was gone before the card left your hands.

In one paragraph

NIST 800-88 is the rulebook for erasing storage properly. Clear overwrites, Purge uses the device’s own erase to reach everything, Destroy wrecks it. A format is none of them. Memory cards hide data from overwrites, so reuse needs Purge, and the certificate should say which level was reached, verified, on which serial. That is what we do, and it is what the line on our certificate means.

If you want to see one, a sample certificate is on the media services page, and the security page sets out how every job is handled.