Last technical review: September 29, 2026 by PC-Doctor Engineering

Most drive erase certificates are generated automatically, filed automatically, and never read by anyone until the day they matter.

That day is an audit, a customer dispute, or a data incident. And on that day the certificate is either evidence or it is a PDF with a green checkmark on it.

The difference is what's on the page.

The Minimum, According to NIST

NIST SP 800-88 Revision 2, Section 4.6, specifies what a certificate of sanitization should record.^[1] The list is short:

• manufacturer, model, and serial number of the device
• media type
• sanitization method and technique
• the tool used, with its version
• the verification method
• the name, position, date, location, and signature of the person responsible

That is the floor. A certificate missing any of these is not a certificate under the guideline that most policies cite.

What Auditors Actually Ask For

The NIST list describes a compliant record. It does not describe a useful one.

In practice, the questions an auditor or an enterprise customer asks go a step further:

• Asset ID. The company asset tag or tracking number, so the certificate ties to the customer's inventory system and not just to a serial number they may not have on file.
• Drive serial number and capacity. The device serial identifies the system; the drive serial identifies the media. Both. A system can have had its drive swapped.
• Start and end time. Not just a date. A timestamp pair proves the erase ran for a duration consistent with the method claimed.
• The result, stated as success or failure. Not implied by the presence of the certificate.
• The level reached, not just the standard. "NIST 800-88" on its own is a reference to a document. "NIST 800-88 Purge" is a claim about the drive.
• Verification type. Whether the drive was verified in full or by percentage sample, and what the sample was.

Put the two lists together and that is the field set a certificate needs. Neither list alone is enough.

The Two Fields Most Certificates Get Wrong

Naming the standard without the level

A drive can be sanitized under a standard and still only reach a Clear. The certificate has to say which. A certificate that names a standard and stays silent on the level is leaving the most important fact for the reader to guess. And a certificate that names two standards is worse: the two would have required different things of the same drive, and nobody reading it can tell which set applied.

One standard. One level. Stated on the page. What those levels mean, and why one standard per certificate is the rule, is covered in Clear, Purge, Destroy: How NIST 800-88 and IEEE 2883 Define Sanitization.

Naming the tool without the version

Sanitization software changes. A drive model that an older version could not fully sanitize may be handled by a newer one, and a firmware command the tool prefers today may not have been available two releases ago. "Erased with Drive Erase" is a brand name. "Erased with Drive Erase 17.2.1" is a testable claim.

The Field the Tool Can't Fill In

Every field above can be captured automatically except one: the operator.

The software knows the drive, the method, the times, the result, and the verification. It does not know who was standing at the bench. That has to come from configuration.

PC-Doctor Drive Erase reports capture the device, the drive, the method and level, the tool version, the verification method, the timestamps, and the result automatically, and they add the evidence behind the level: HPA and DCO state, remapped sectors before and after, drive health, and whether the erase was performed by firmware. Each report also carries a digital signature over its contents, which authenticates the report but does not identify the operator. The Technician ID, the Erasure Provider, and the Asset ID come from settings the customer fills in, and the report prints two signature lines at the bottom, one for the erasure operator and one for a supervisor. All of those are the customer's job, and so is the one Section 4.6 field no tool can know: the location, which belongs on the batch log the report is filed with.

That makes the Technician ID the field most likely to be blank in a real audit. Not because the tool failed, but because nobody entered it before the first drive ran. And an ID is only a name if your records can resolve it to one.

Set the technician, provider, and asset fields before the first drive. Not after.

Signature: Wet or Digital

Revision 2 asks for a signature. It does not specify a digital one.^[1] A printed certificate signed by hand satisfies the guideline. A report's own digital signature is a different thing: it proves the report was not altered after the tool wrote it, not that a particular person stood behind the result. A defensible certificate wants both.

Whether that scales is a separate question. An operation processing a few drives a week can sign each certificate. An operation processing five hundred drives a week cannot, and needs a signing process of its own: a batch attestation, a digital signature applied at the workflow level, or a chain-of-custody record that the certificate references. The certificate is one link in that chain. It is not the chain.

The Certificate Is Evidence, Not Proof

A certificate documents what the tool did and what it found. It cannot document that the operator followed policy, that the drive was the one logged at intake, or that nothing happened to it between erase and shipment. Those belong to chain of custody, and certification programs such as R2v3 and NAID AAA audit them separately.

A complete certificate makes the sanitization defensible. It does not make the operation defensible on its own.

Certificate of Erasure or Certificate of Destruction

The two are not interchangeable, and a surprising number of operations file the wrong one.

A certificate of erasure documents a Clear or Purge: the data is gone and the drive is still a drive. It is the certificate a resale, redeployment, or return-to-lessor channel needs, because those channels require proof that the media was sanitized and left usable. A certificate of destruction documents a Destroy: shredding, disintegration, degaussing a magnetic drive to the point of inoperability. The media is gone with the data, and the certificate typically records the destruction method, the date, the witness, and the weight or count of material rather than a per-drive sanitization result.

Which one applies is a disposition decision, made before the drive is processed, not a label chosen afterward. A drive that was erased and then shredded gets both, in that order. A drive that was shredded without an erase gets a certificate of destruction only, and no amount of wording on that certificate turns it into evidence of sanitization. Auditors read the two for different things: the erasure certificate for the level and the verification, the destruction certificate for the chain of custody up to the shredder.

A Template

The checklist below is the union of the NIST 800-88r2 Section 4.6 list and the fields auditors ask for in practice. Use it to check a certificate — yours or a vendor's — against what an audit will require.

Download the Certificate of Erasure checklist

If your certificates are missing fields from this list, the fix is a settings change, not a new process. See how Service Center Drive Erase and Factory Drive Erase generate audit-ready certificates for every drive.

Frequently Asked Questions

What information must be on a certificate of data erasure?

At minimum, the fields NIST SP 800-88r2 Section 4.6 specifies: device manufacturer, model, and serial number; media type; sanitization method and technique; tool and version; verification method; and the responsible person's name, position, date, location, and signature.^[1] Auditors typically also expect asset ID, drive serial and capacity, start and end timestamps, an explicit result, and the sanitization level reached.

Does a certificate of erasure need to name NIST 800-88 or IEEE 2883?

It needs to name the standard the erase was performed and classified under, and the level reached under it: Clear or Purge. One standard per certificate. Naming both is ambiguous, not stronger.

Does the certificate need a digital signature?

No. NIST 800-88r2 asks for a signature and does not require a digital one. A hand signature on a printed certificate satisfies the guideline. High-volume operations usually need a signing process that scales beyond per-certificate signatures.

Is a certificate of erasure the same as a certificate of destruction?

No. A certificate of erasure documents a sanitization that leaves the media usable. A certificate of destruction documents physical destruction. Which one applies depends on the disposition of the drive.

Who is responsible for the operator name on the certificate?

The customer. The tool captures the drive, method, timing, result, and verification automatically. The operator's identity, the provider name, and the asset ID have to be configured before the erase runs, and the location has to be recorded alongside the report.

References

1. National Institute of Standards and Technology. Guidelines for Media Sanitization, NIST Special Publication 800-88 Revision 2. September 2025. ↩