Skip to main content

SP 800-88 Rev. 2Final2025

Guidelines for Media Sanitization

At a glanceHow to make data on laptops, Chromebooks, drives and copiers unrecoverable before reuse, resale or disposal. Revision 2 (2025) replaced Revision 1 and focuses on running a sanitization program with clear roles and verification. Important for districts that refresh 1:1 devices or use e-waste recyclers.

Reading level
Practitioner
Length
48 pages · about 30 min for the key parts
Best for
Technology directors, IT staff and service partners, Business officials
CSF 2.0
Protect, Identify
Read it on NIST DOI 10.6028/NIST.SP.800-88r2 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Key concepts

The guide summarizes the clear, purge and destroy methods, including cryptographic erase, and asks organizations to choose a method based on data sensitivity, verify results and keep records. Detailed per-device instructions moved to referenced standards such as IEEE 2883. A sample certificate of sanitization is included.

How it is organized

  • Background
  • Summary of sanitization methods: clear, purge, destroy, cryptographic erase
  • Media sanitization program: roles, sensitivity-based decisions, verification, documentation
  • Appendices: device characteristics, sample certificate of sanitization

What a school district should take from it

  • Contracts that cite 'SP 800-88 Rev. 1' are out of date; update them to Rev. 2.
  • Require a certificate of sanitization from recyclers and resellers, listing each device.
  • Copiers, phones and network gear store data too.

How to use it in your district

  1. Write a one-page sanitization procedure covering laptops, Chromebooks, servers, copiers and phones.
  2. Update recycler and lease-return contracts to require SP 800-88 Rev. 2 methods and per-device certificates.
  3. Record disposed devices in your inventory with the certificate as evidence.
  4. Spot-check a sample of wiped devices before they leave district custody.

Common misconceptions

Deleting files or a factory reset is enough.
Depending on the device and data, you may need purge or destroy methods, and you should verify the result.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • PR.DSData Security
  • ID.AMAsset Management

Tools in the program portal

Related publications

Citation and source

SP 800-88 Rev. 2, Guidelines for Media Sanitization. National Institute of Standards and Technology. 2025. https://doi.org/10.6028/NIST.SP.800-88r2.

Replaces: SP 800-88 Rev. 1 (2014, withdrawn 2025-09-26).

Topics: Data protection and backups, Devices and malware. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.