Clear, purge and destroy are the three sanitization levels in NIST SP 800-88. Clear wipes a device through its normal interface so it can stay in use inside your organization. Purge makes recovery infeasible even in a lab, and the device can often be reused. Destroy ends the media’s life as storage. Which one you need depends on where the device is going next, what it held, and what proof you can produce afterward.
This guide explains each level, shows how to pick one for a given device, and covers the old DoD 5220.22-M question that keeps turning up in contracts.
TL;DR
- Clear protects against simple, non-invasive recovery. Use it when the media stays under your control and will be reused.
- Purge makes recovery infeasible with state-of-the-art lab techniques and can leave the device reusable. Use it when media may leave your control.
- Destroy leaves the media unusable for storage. Use it when the media can’t be reliably sanitized or the assurance can’t be demonstrated any other way.
- NIST’s 2025 revision says multi-pass overwriting is unnecessary for modern storage, so a “DoD wipe” is not a safe default for SSDs.
- Whatever you choose, keep an asset-level record: serial number, method, result, who did it, and where the device went.
Table of Contents
- What the three levels actually mean
- Clear, purge and destroy side by side
- How to choose: four questions
- HDDs, SSDs and encrypted drives
- NIST 800-88 vs DoD 5220.22-M
- What destroy really requires
- A defensible workflow
- Our perspective
- When regulations enter the picture
- Doing it with us
- Common mistakes to avoid
- FAQ
- Sources
What the three levels actually mean
NIST published Revision 2 of SP 800-88 on September 26, 2025. It defines the levels by outcome, not by tool:
- Clear uses logical techniques through the normal device interface to protect against simple, non-invasive recovery.
- Purge uses logical or physical techniques that make recovery infeasible using state-of-the-art laboratory techniques, while potentially preserving reuse.
- Destroy makes recovery infeasible and leaves the media unusable for storage.
The key point is that these are assurance outcomes. The same technique can qualify differently depending on the media and on how a particular product implements it. An overwrite that counts as clear on one drive may not reach every storage location on another.
They also aren’t synonyms for everyday words. Deleting a file usually just removes a pointer. Erasure describes making data inaccessible or unrecoverable. Disposal is the end-of-life step. Sanitization is the broader process, and NIST defines it as rendering access to target data infeasible for a given level of effort. Ordinary deletion doesn’t establish that.
Clear, purge and destroy side by side
| Clear | Purge | Destroy | |
|---|---|---|---|
| Protects against | Simple, non-invasive recovery | Recovery with state-of-the-art lab techniques | Any practical recovery from the media |
| Typical techniques | Logical overwrite or reset of user-addressable storage | Vendor sanitize commands, cryptographic erase, degaussing (magnetic media), or physical methods | Shredding, disintegration, pulverizing, incineration |
| Device reusable? | Yes | Often yes | No |
| Fits when | Media stays inside your organization | Media may leave your control | Media won’t be reused, can’t be sanitized, or assurance can’t be shown |
| Resale value | Preserved | Often preserved | Gone |
The techniques listed are examples. Whether a given method qualifies for a given device is the question to answer, not the method’s name.
How to choose: four questions
NIST frames the selection around information sensitivity, media characteristics, future disposition and trust in the sanitization implementation. It is not simply a matter of whether the device is an HDD or an SSD. In practice, work through four questions per device.
1. Where is this device going next?
This is the question that settles most cases.
- Redeployed to another employee on the same network: clear is usually enough when the recovery threat is low.
- Resold, donated, returned from a lease or handed to a recycler: the media is leaving your control. A device in this situation generally needs purge or destroy, not merely clear, unless you’ve validated that your clear method meets the required assurance for that device.
- Never to be reused: destroy is a natural fit.
2. What did it hold?
Higher sensitivity pushes you toward stronger methods. Regulated records, credentials, customer data and anything covered by a contract clause deserve a harder look. Some regimes name their own expectations. The IRS, for example, describes four categories of media sanitization: disposal, clearing, purging and destroying, with requirements that depend on the information involved.
3. What kind of storage is it?
A spinning hard drive and a flash drive can look identical from the operating system and behave very differently inside. NIST warns that wear leveling, spare cells and remapped blocks mean an apparently successful overwrite on flash may not touch every location where data once lived. That is why the method must match the technology, as covered in the next section.
4. Can you prove it worked?
If the required assurance can’t be demonstrated, choose the stronger option. A damaged or non-rewriteable drive is a common example: software can’t address every storage area, so destruction is often the defensible answer.
HDDs, SSDs and encrypted drives
Hard drives. Overwriting through the normal interface is a classic clear technique. Purge options include vendor-supported sanitize commands and, for magnetic media, degaussing. Destruction means shredding or disintegration.
SSDs, NVMe and other flash. Overwriting is the weak spot. A vendor-supported sanitize command or a trustworthy cryptographic erase is the usual route to purge. Where neither is available or verifiable, physical destruction is the safer path. We cover the trade-offs in our guide to SSD purge versus shredding to particles.
Self-encrypting and encrypted storage. Cryptographic erase can be a rapid purge technique, but only when the encryption, key management and key-sanitization prerequisites are trustworthy and demonstrable. Revision 2 added focused guidance here, including acceptable key types and key zeroization. Engineers who need to show an auditor how this works can start with our cryptographic erase guide.
Cloud and virtual storage. You usually can’t touch the underlying physical media. Assurance then comes from contract terms and provider controls, so those terms need to be explicit about methods and evidence.
NIST 800-88 vs DoD 5220.22-M
DoD 5220.22-M is the older multi-pass overwrite approach many people still call a “DoD wipe.” It was built for magnetic drives. NIST’s 2025 FAQ for Revision 2 says multi-pass overwriting is unnecessary for modern storage and can reduce the lifespan of flash media.
The practical differences:
| NIST SP 800-88 | DoD 5220.22-M | |
|---|---|---|
| Approach | Outcome-based: clear, purge, destroy | A specific overwrite procedure |
| Covers SSDs and flash | Yes, with guidance on flash behavior | Not designed for them |
| Includes verification and records | Yes, as part of a program | Not the focus |
| Includes cryptographic erase | Yes, with prerequisites | No |
If a contract or policy still cites DoD 5220.22-M, don’t just run three passes and call it done. Ask which standard the requirement actually derives from, and whether your auditor will accept a NIST-based method with documented evidence. If you’re drafting policy, cite NIST 800-88 and describe your methods by media type. Our overview of NIST data destruction rules goes further.
What destroy really requires
Destroy is the strongest option for confidentiality, and it ends the asset’s reuse and resale value. It is also easy to do badly. SNIA’s media sanitization guidance notes that a tiny fragment can potentially retain recoverable information, so shredding or pulverizing has to be done to a method and particle size suited to the media. Drilling a hole or cracking the case doesn’t qualify.
Flash chips are small, so particle size matters more for SSDs and memory modules than it does for platters. If you’re weighing options for retired drives, see how to destroy hard drives safely.
Destroyed electronics still need a responsible downstream. The EPA recommends certified electronics recyclers that use the R2 or e-Stewards standards, which include data-security and downstream-management controls.
A defensible workflow
No method protects you if the process around it is loose. A workable sequence, drawn from NIST and EPA guidance:
- Identify and retain any records the device must preserve (legal holds, retention rules).
- Inventory every device and storage type, including the ones people forget: printers, copiers, phones, servers, removable media.
- Classify the data and the risk.
- Choose clear, purge or destroy using the four questions above.
- Perform the approved method.
- Verify each sanitization where feasible, or use documented representative sampling.
- Record the asset, method, result, operator or provider, and final disposition.
- Release the equipment to a reuse, resale or recycling channel, and keep the paperwork.
Two controls get overlooked. The first is chain of custody: media should stay protected from removal from service until sanitization or destruction, and the records themselves need protection. Washington state’s media sanitization and disposal standard is a useful public model. The second is the contract. For outsourced work, terms should cover custody, approved methods, downstream handlers, verification, and a certificate or asset-level report.
Our perspective
We see the same mistake often: a company treats sanitization as a single button, then discovers during an audit that nobody can show what happened to a specific serial number. NIST’s latest revision points the same way. It treats sanitization as an enterprise program built on governance, verification and documented controls, not a one-click wipe, as NIST’s announcement puts it.
Our view is simple. If a drive is leaving your control and you can’t demonstrate that a purge worked, destroy it and keep the certificate. If a drive is staying in house, clear it and verify it. The method matters less than whether you can prove it.
We also think “we hired a disposal company” is not a plan. In a 2007 enforcement action, the FTC announced a $50,000 penalty against a company over discarded consumer credit report information. The lesson stands: the organization remains responsible for reasonable measures and for vetting the contractor.
— Keith
When regulations enter the picture
For U.S. businesses that handle consumer-report information, the FTC Disposal Rule requires reasonable measures to protect it from unauthorized access or use during disposal. The FTC’s examples include destroying or erasing electronic files or media so the information can’t be read or reconstructed, and doing due diligence on a destruction contractor. When evaluating a contractor, the FTC mentions reviewing an independent audit, references, certification and information-security policies.
Other sectors have their own expectations. Agencies handling criminal justice information can use our CJIS media sanitization walkthrough mapped to NIST. For a program-level view, see our guide to building a NIST 800-88 program that leaves proof. Check your own regulator’s current text before you set policy, since requirements change.
Doing it with us
If you’d rather not run this in house, we offer on-site data destruction, including for 50 or more hard drives, and hard drive destruction with receipts and certificates for your compliance files. Our facility is EPA-certified for processing and we hold California Department of Toxic Substances Control registration. For equipment that still has value, we also run IT asset recovery with upfront payment. Get a free quote and tell us what you’re retiring.
A common split: purge and resell the newer laptops, destroy the old servers’ drives and anything damaged. That recovers value where it exists and removes risk where it doesn’t.
Common mistakes to avoid
- Relying on a factory reset. It isn’t automatically a defensible sanitization record. Clear has to address user-addressable storage and block recovery through the normal interface.
- Running a legacy multi-pass wipe on an SSD. It adds wear and may miss remapped blocks.
- Skipping verification. Without it, you have a claim, not a record.
- Mixing sanitized and unsanitized media in the same bin or pickup.
- Accepting a bulk certificate that lists a quantity instead of serial numbers.
- Forgetting the downstream. A drive that’s destroyed can still become an environmental or liability problem if the scrap goes to an uncertified handler. Our responsible computer recycling guide covers the checks.
FAQ
Is purge stronger than clear?
Yes. Clear defends against simple, non-invasive recovery, while purge defends against state-of-the-art laboratory techniques. Both can leave the device usable, but purge is the level to choose when the media might leave your control.
Is a DoD 5220.22-M wipe still acceptable?
It was designed for magnetic drives, and NIST’s FAQ says multi-pass overwriting is unnecessary for modern storage and can shorten flash lifespan. For SSDs it is the wrong tool. Unless a contract specifically demands it, use a NIST 800-88 method matched to the media and keep verification records.
Can I just delete files and format the drive before recycling it?
No. Deletion and formatting don’t establish that recovery is infeasible. Business drives should be cleared, purged or destroyed according to where they’re going, with a record of each asset.
When is destroy the only reasonable choice?
When the media won’t be reused, can’t be reliably sanitized, or the required assurance can’t be demonstrated. A drive that is physically damaged or can’t be rewritten is the typical case, because software can’t reach every storage area.
Does cryptographic erase count as purge?
It can, but only if the encryption, key management and key sanitization are trustworthy and you can demonstrate them. If you can’t show that, fall back on another purge method or destruction.
Sources
- NIST SP 800-88 Rev. 2 publication page
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (PDF)
- NIST FAQ for SP 800-88r2
- NIST announcement of SP 800-88r2
- IRS media sanitization guidelines
- SNIA media sanitization
- EPA certified electronics recyclers
- FTC Disposal Rule
- FTC press release on a disposal penalty, 2007
- Washington Technology Solutions media sanitization and disposal standard