NIST FAQ Clarifies Sanitization: Degaussing Is Not Physical Destruction, and Multiple Overwrites Are Not Necessarily Required

NIST's July 2026 FAQ for SP 800-88 Rev.2 further explains the selection of sanitization and destruction methods when enterprises retire HDDs, SSDs, tapes, cloud storage and other data-bearing media.

The central point is to assess whether data is infeasible to recover with reasonable techniques and resources, rather than relying only on whether a device still functions.

From a single destruction action to a complete sanitization program

Rev.2 places enterprise media-sanitization governance alongside individual treatment methods.

Program controls include:

• Sensitivity-based sanitization criteria
• Clear distinction between Clear, Purge and Destroy
• Defined responsibilities and training
• Equipment calibration, testing and maintenance
• Verification and review procedures
• Retained sanitization or destruction evidence

A certificate alone is insufficient to describe the program; review intake, transport, custody, treatment, verification and record completeness.

Multiple overwrite passes are not a universal requirement

The FAQ explains that familiar three- or seven-pass overwrite routines generally do not add material protection for modern storage.

For suitable overwritable media, a supported single overwrite can form part of Clear.

Repeated writes can also add flash wear. More passes should not be the sole measure of security.

What matters is:

1. A method appropriate to the media
2. Complete execution
3. Retained execution records
4. Verification of the outcome
5. A sensitivity-based decision on further Physical Destruction

Degaussing is not Physical Destruction

The FAQ distinguishes magnetic-media Degaussing as a physical Purge method rather than Destroy.

A suitable magnetic field treats magnetic data structures, principally on:

• Traditional magnetic HDDs
• Tape
• Other magnetic storage media

Degaussing does not apply to:

• SSD
• NAND Flash
• USB flash drives
• SD cards
• Hybrid devices containing flash storage

Even if a degaussed HDD no longer functions, confirm that the equipment field is sufficient for the media's magnetic specifications.

Request equipment specifications, maintenance records, procedures and execution evidence rather than checking only whether the HDD boots.

SSD and sensitive-data treatment requires additional assessment

SSDs use reserved areas, remapped blocks, controller-managed storage and high density. Host overwrite may not reach every physical location.

For sensitive information or devices leaving enterprise control, assess:

• Qualified Cryptographic Erase
• Supported manufacturer sanitization commands
• Physical Destruction
• Shredding followed by melting or another approved irreversible process

Shredding alone is not automatically suitable for every high-sensitivity scenario. Density, fragment size and downstream treatment affect residual risk.

Cryptographic Erase has prerequisites

Cryptographic Erase securely removes encryption keys so the original data cannot be decrypted.

It requires more than deleting an arbitrary key. Relevant prerequisites include:

• Strong encryption from the start
• No sensitive data previously stored in plaintext
• Adequate key strength and random generation
• Permanent, verifiable removal of relevant keys
• Traceable key-lifecycle records

Where those conditions cannot be demonstrated, effectiveness must not be assumed.

Verification and validation are different

Sanitization assurance includes two levels:

Verification: technical confirmation

Confirm successful completion and check errors, anomalies and incomplete operations.

Validation: risk acceptance

The organization decides whether the method, result and residual risk are acceptable given data sensitivity.

Complete ITAD records should support organizational review and acceptance, not merely show a tool's success message.

KYI perspective: four capabilities to assess

Enterprises evaluating ITAD and destruction providers should review:

1. Correct media identification

   Distinguish HDDs, SSDs, tapes, mobile devices, server modules and other data-bearing components.

2. Sensitivity-based method selection

   Choose Clear, Purge or Destroy according to sensitivity, condition and destination rather than applying one method universally.

3. Verification and traceable records

   Record serials, methods, times, operators, equipment and exceptions.

4. Complete Chain of Custody

   Maintain responsibilities and traceability from handoff, transport and custody to treatment and final evidence.

With SSDs, cloud environments and AI Servers, data is no longer confined to traditional HDDs. Retirement policy should encompass data governance, risk and auditable records rather than hardware disposal alone.

---

References

1. NIST, Guidelines for Media Sanitization, SP 800-88 Rev.2, September 2025

2. NIST, Frequently Asked Questions for NIST SP 800-88 Rev.2, July 16, 2026

This article summarizes public standards and does not establish a legal, certification or audit outcome. Enterprises should define media-sanitization and IT-retirement procedures against sensitivity, contracts and applicable law.