Last technical review: September 16, 2026 by PC-Doctor Engineering

Clear, Purge, and Destroy are the three sanitization levels defined in NIST SP 800-88. Clear removes data from every user-addressable location and defeats simple recovery. Purge makes recovery infeasible even with laboratory techniques. Destroy does the same and leaves the media unusable afterward. Since Revision 2 of the NIST guideline, published in September 2025, NIST defines the levels and IEEE 2883-2022 defines the techniques that reach them.^[1][5]

That last sentence is where most explanations of these standards go wrong, because it was not true until recently. For eleven years the two documents overlapped, and it was reasonable to ask which one applied. It is no longer the right question. The two standards now occupy different layers, and a sanitization program needs both.

Three Levels, Defined by Outcome

NIST SP 800-88 Revision 2 keeps the three categories that Revision 1 introduced, with definitions that describe what an attacker can no longer do rather than what the operator did.^[1]

Clear “applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple, non-invasive data recovery.” The threat it defeats is someone with a keyboard and recovery software. The threat it does not address is anyone who can reach storage locations the host cannot see.

Purge “applies physical or logical techniques that make the recovery of target data infeasible using state-of-the-art laboratory techniques.” The threat model expands to an adversary with a lab: chip-off reads, controller bypass, signal analysis. A Purge has to account for every location on the media, not only the ones the operating system is allowed to address.

Destroy renders “target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the [media].” Same recovery threshold as Purge, with the drive gone at the end of it.

Those are outcome definitions. In practice, the level is usually a statement about mechanism. A Clear is almost always the host writing patterns to the drive or issuing block erases through the normal storage path. A Purge is almost always the drive’s own firmware erasing itself in response to a command such as ATA Sanitize, NVMe Sanitize, or a cryptographic erase that destroys the media encryption key. The reason firmware erasure reaches the Purge threshold and a host overwrite does not is the subject of a separate article; the short version is that a modern drive keeps data in places a host write cannot reach, and only the controller knows where they are.

Cryptographic erase deserves a note of its own, because it is the technique that makes a Purge take seconds on a multi-terabyte SSD. If the drive has encrypted everything it stored from the moment it was first written, destroying the key makes every block unreadable at once. Revision 2 expanded its treatment of cryptographic erase into a dedicated section, with guidance covering additional key types and referencing the zeroization requirements of ISO/IEC 19790.^[1][3] The precondition matters as much as the technique: a cryptographic erase is a Purge only if the data was encrypted throughout its life and the key is destroyed in a way that cannot be reversed.

What Changed in September 2025

NIST published SP 800-88 Revision 2 on September 26, 2025. Revision 1, dated December 2014, is superseded.^[2][3]

Three changes matter for anyone who erases drives for a living.

The first is scope. Revision 1 was a hands-on document; it carried an appendix of per-media techniques and told the reader which commands counted as a Clear or a Purge on which kind of drive. Revision 2 removes that. It states that “technology-specific sanitization techniques are out of scope for this document” and reframes the guideline around building an organizational sanitization program: how to classify media, how to decide what level a given category of information requires, how to verify, and how to document.^[1]

The second is where the technique detail went. Section 4.4 of Revision 2 directs organizations to sanitize in a manner that complies with IEEE 2883, or with “a standard that is identified as acceptable by organizational policy.”^[1] NIST did not stop caring about technique. It delegated the question to a body that maintains a technique standard full time.

The third is the certificate. Section 4.6 specifies what a certificate of sanitization should record: manufacturer, model, serial number, media type, the sanitization method and technique, the tool used and its version, the verification method, and the name, position, date, location, and signature of the person responsible.^[1] Revision 1 offered a sample form; Revision 2 makes the field list normative guidance.

How the Two Standards Fit Together Now

Read that way, the standards stop competing. A sanitization program uses NIST 800-88r2 to decide that a category of drives requires a Purge and to specify what the record must contain. It uses IEEE 2883-2022 to determine that, on this NVMe drive, a Purge means a successful Sanitize command with a particular action, and that a Format with secure-erase settings does not qualify.

IEEE 2883-2022 is also the more demanding of the two on modern media. It was written after enterprise drives gained features that 2014-era guidance never contemplated, and its qualifying requirements for both Clear and Purge reflect that. This gives us a rule that is easy to state and easy to get wrong: a level is defined by the standard that names it. A Purge under IEEE 2883 and a Purge under NIST Revision 1 are not the same claim, and neither is “stronger” than a Clear under the other in any general sense. An IEEE 2883 Clear can require things a Revision 1 Purge did not. Comparing levels across standards is not meaningful; comparing them within a standard is.

One Standard Per Certificate

That rule has a direct consequence for how a drive erase tool should behave, and for what its report should say.

A report should name one standard and the level reached under it. A certificate that claims “NIST 800-88 and IEEE 2883” is not twice as strong; it is ambiguous, because the two standards would have required different things of the same drive and the reader cannot tell which set was applied.

This also clarifies what a tool should do when it can sanitize to more than one standard, and the answer is not to pick a lighter procedure for a lighter standard. The erase itself should perform every procedure the most stringent standard requires, because that is the only way to be sure hidden areas of the drive were addressed. The classification comes afterward. Once the erase completes, the tool examines the drive to determine whether hidden data was removed or whether the drive’s characteristics prevented it, and only then assigns a level — under the standard the customer chose. A drive that completed everything is a Purge under that standard. A drive whose controller could not reach every location is a Clear under that standard, and the certificate says so. The tool does not reach for a Purge under a different standard, even if the drive would qualify, because the customer did not contract for that result and an auditor reading the certificate would not know how to evaluate it. PC-Doctor Factory Drive Erase, which has been tested by a third party against IEEE 2883-2022, works this way: one erase built to the IEEE 2883 requirements, a post-erase analysis, a classification against the customer’s standard, and a report that names exactly one. Service Center Drive Erase sanitizes to the NIST 800-88 Clear and Purge levels and issues a certificate of erasure for each drive.

The level on a certificate, in other words, is a verified outcome rather than a declared intention. That is the difference between a tool that reports what it tried and a tool that reports what it can prove.

A tool’s result is not the same thing as a tool’s certification, and the two are easy to confuse. Under Revision 2, there is no meaningful sense in which software is “certified to NIST 800-88r2,” because the document no longer specifies techniques to test against. What a third party can test is whether a tool’s commands and verification produce the IEEE 2883 result the tool claims. That is why “third-party tested to IEEE 2883-2022” is the technique-level claim worth asking a vendor for, and why “NIST 800-88 compliant” on its own tells you only that the vendor has read the guideline.

What the Standard Cannot Tell You

A standard tells you what level a drive reached. It does not tell you what level your contract requires, what your customer’s policy accepts, or whether a drive that only reached a Clear can enter a given resale channel. Those are business decisions, and Revision 2 is explicit that they belong to the organization’s sanitization policy rather than to the guideline.^[1]

Verification is the same kind of question. Revision 2 describes verification for non-destructive techniques as checking the completion status reported by the tool and identifying errors, anomalies, and the health of the media, and it states that “unless explicitly required by organizational policy, elaborate sampling” of the drive’s contents “is not necessary.”^[1] Certification programs for recyclers and asset-disposition providers sometimes require exactly that sampling. Both positions are correct for what they govern: NIST is describing the sufficiency of the technique, and the certification body is describing what its auditors will accept as evidence. An operation subject to both follows the stricter one.

The levels are the vocabulary. The contract, the policy, and the certification program decide which word has to appear on the certificate.

Frequently Asked Questions

Is NIST 800-88 Revision 1 still valid?

It is superseded. NIST published Revision 2 in September 2025 and lists Revision 1 as replaced.^[2] A sanitization performed to Revision 1’s technique tables did not become less effective on the day Revision 2 appeared, and Revision 2 permits an organization to adopt “a standard that is identified as acceptable by organizational policy” for technique detail. But a new policy should reference Revision 2 for the program and the certificate, and IEEE 2883 for technique.

Does IEEE 2883 replace NIST 800-88?

No. IEEE 2883-2022 specifies techniques; NIST 800-88r2 specifies the levels, the classification of information and media, verification, the certificate, and the program around them. Revision 2 points to IEEE 2883 for technique detail, which makes the two complementary rather than interchangeable.

Is a cryptographic erase a Purge?

It can be, when the drive encrypted all stored data from first use and the media encryption key is destroyed in a way that cannot be recovered. Revision 2 treats cryptographic erase in its own section and ties it to key-zeroization requirements.^[1] A cryptographic erase on a drive that was not encrypting throughout its life, or whose key handling cannot be verified, does not meet the threshold.

Can a software overwrite ever count as a Purge?

On a magnetic hard drive, an overwrite of all user-addressable locations has historically satisfied Clear, and some standards have accepted specific overwrite procedures at higher levels for magnetic media. On flash media it cannot reach a Purge, because wear-leveling and over-provisioning place data where a host write cannot follow. Purge on an SSD requires the drive’s firmware to perform the erasure.

Which standard should a certificate name?

The one the customer or policy required, and only that one. The certificate should state the standard, the level reached under it, the technique used, the tool and version, the verification performed, and the person responsible.^[1] A certificate that names two standards is ambiguous, not stronger.

References

1. National Institute of Standards and Technology. Guidelines for Media Sanitization, NIST Special Publication 800-88 Revision 2. September 2025. ↩
2. NIST Computer Security Resource Center. SP 800-88 Rev. 2, publication record and supersession of Rev. 1. ↩
3. National Institute of Standards and Technology. “Guidelines for Media Sanitization: NIST Publishes SP 800-88r2.” September 2025. ↩
4. National Institute of Standards and Technology. Guidelines for Media Sanitization, NIST Special Publication 800-88 Revision 1. December 2014. Superseded.
5. IEEE Standards Association. IEEE 2883-2022, IEEE Standard for Sanitizing Storage. 2022. ↩