NIST 800-88 vs DoD 5220.22-M vs ISO 27040: Certified Data Erasure Standards Explained

Certified data erasure standards are formal specifications published by national or international standards bodies that define exactly how to render stored data unrecoverable. The three standards IT teams cite most, NIST SP 800-88 Rev. 1, DoD 5220.22-M, and ISO/IEC 27040:2015, are not interchangeable. Each has a different scope, a different status, and a different audience. Choosing the wrong one to specify in a contract or audit response is a real compliance risk.

This post covers what each standard actually requires, where they differ, how they map to specific media types (including SSDs, where most content gets it badly wrong), and which one to cite in a procurement contract or security policy.

For the broader picture of how erasure fits into device security from provisioning to disposal, see the pillar guide on device security across the full IT asset lifecycle.

What Are Certified Data Erasure Standards?

Certified data erasure standards are formal, documented specifications that define the methods, verification steps, and evidence requirements for rendering data on storage media unrecoverable. They are published by recognised standards bodies for use in procurement contracts, compliance audits, and regulatory submissions. Without referencing a named standard, a claim of "secure erasure" has no auditable meaning.

The word "certified" matters here. It means a third party, whether a software tool, an ITAD vendor, or an internal process, has performed erasure to a documented method and produced verifiable evidence. That evidence is what auditors actually check. A vendor claiming "military-grade erasure" with no named standard, no certificate, and no verification process is not offering certified erasure. It is offering a marketing phrase.

Three standards dominate commercial and enterprise use: NIST SP 800-88, DoD 5220.22-M, and ISO/IEC 27040. IT teams also encounter secure data wipe standards in HIPAA disposal guidance (§164.310(d)(2)), in SOC 2 criteria (CC6.7), and in ISO 27001:2022 control A.5.11. All of those frameworks point back to the same underlying sanitization methods.

Understanding the data erasure standards comparison starts with understanding that these are not competing standards. They operate at different levels and for different purposes, and in practice, one of them (NIST 800-88) has become the reference that all others either cite or align to.

What Is NIST 800-88 and Why Is It the Current Authoritative Standard?

NIST SP 800-88 Rev. 1, published by the National Institute of Standards and Technology in December 2014, is the authoritative reference for media sanitization in both federal and commercial contexts. It defines three sanitization categories, Clear, Purge, and Destroy, and maps each to specific media types. No Rev. 2 exists as of early 2026. This is the standard auditors, procurement teams, and ITAD vendors mean when they say "we certify to NIST."

NIST 800-88 explained means understanding those three categories precisely. They are not levels on a scale. They are distinct methods appropriate for different situations.

The most operationally important detail in NIST 800-88 is its guidance on SSDs and flash-based storage. Overwrite methods designed for spinning hard drives do not work reliably on SSDs. Wear levelling and reserved blocks mean that a standard overwrite pass may never reach all the physical memory cells that held data. NIST 800-88 explicitly recommends Purge-level methods, crypto-erase or ATA Secure Erase, for flash-based media. Any vendor or policy that specifies "3-pass overwrite" for SSDs is applying a method that does not meet NIST's own guidance for that media type.

On the overwrite pass count question: NIST 800-88 confirms that a single overwrite pass is sufficient for modern HDDs. The 3-pass, 7-pass, and 35-pass Gutmann methods reflect concerns about older magnetic storage technology that do not apply to drives manufactured in the last two decades. Specifying 7-pass overwrite in a contract for modern hardware adds time and cost without adding security.

Is DoD 5220.22-M Still the DoD's Standard?

DoD 5220.22-M is not the current U.S. Department of Defense standard for classified media sanitization. The DoD superseded its own sanitization specifications for classified use in 2007, when NSA/CSS Policy Manual 9-12 became the operative guidance for classified systems. DoD 5220.22-M exists within the National Industrial Security Program Operating Manual (NISPOM), but its sanitization specifications are legacy language, not current operating doctrine.

This is the single most common misconception in the DoD 5220.22-M vs NIST debate. IT vendors cite DoD 5220.22-M because it sounds authoritative and because it persists in procurement templates written before 2007. It does not mean their process reflects current DoD practice.

What DoD 5220.22-M specified was a 3-pass overwrite: write zeros, write ones, write a random character, then verify. That method is technically valid for HDDs. It is not valid for SSDs for the same reasons NIST 800-88 explains. And it provides no guidance on crypto-erase, which is now the standard approach for flash storage.

In commercial procurement today, "DoD 5220.22-M" is best read as shorthand for "we perform a multi-pass overwrite with verification." It has residual commercial currency because procurement managers recognise the name. But if you are writing a security policy or a contract that will face a SOC 2 or ISO 27001 audit, specify NIST 800-88 by name. That is what auditors look for.

The follow-up cluster on chain of custody for offboarded devices covers what documentation needs to accompany erasure to satisfy audit requirements.

What Is ISO/IEC 27040 and How Does It Compare to NIST and DoD Standards?

ISO/IEC 27040:2015, formally titled "Information technology, Security techniques, Storage security," covers storage security broadly: design, implementation, and management of storage systems. Data sanitization is addressed in Annex A. ISO 27040 data sanitization guidance explicitly cross-references NIST 800-88, making it the international framework that sits above the operational certified data erasure standards rather than replacing them.

ISO/IEC 27040 follows a similar logical structure to NIST's Clear, Purge, Destroy framework, but it situates sanitization within a broader storage security lifecycle. It is the standard most relevant to multinational organisations that need to demonstrate compliance across jurisdictions where NIST's federal framing may not directly apply. GDPR Article 5(1)(e) requires storage limitation and appropriate technical measures, and ISO/IEC 27040 provides the internationally recognised technical framework for what "appropriate" means for storage security.

Where DoD 5220.22-M is a legacy overwrite specification and NIST 800-88 is the operational method standard, ISO/IEC 27040 is the governance-level reference. An organisation can cite all three in a single security policy without contradiction: NIST 800-88 defines what the technician does, ISO/IEC 27040 defines the management framework around it, and DoD 5220.22-M describes the overwrite method applied to HDDs where counterparties expect that language.

One emerging alternative worth knowing about is IEEE 2883-2022, published in August 2022. IEEE 2883 focuses specifically on sanitization of storage devices and introduces more granular guidance for flash-based media than earlier certified data erasure standards. It is not yet as widely cited in commercial contracts as NIST 800-88, but it is emerging as a potential reference for organisations handling high volumes of SSD disposal and is worth tracking as the standard matures.

How Do the Three Certified Data Erasure Standards Compare Side by Side?

The three standards serve different primary purposes. NIST 800-88 is the operational reference. DoD 5220.22-M is a legacy specification with ongoing commercial recognition. ISO/IEC 27040 is the international framework for storage security that includes sanitization as one component. Treating them as equivalent in a contract or policy is an error.

The practical takeaway from this data erasure standards comparison: if you are specifying one standard in a procurement contract, specify NIST SP 800-88 Rev. 1. If you are operating under ISO 27001 or need international audit acceptance, reference ISO/IEC 27040 alongside NIST 800-88. DoD 5220.22-M can appear in contracts where counterparties expect to see it, but qualify it as an overwrite method, not as current DoD doctrine.

Secure data wipe standards exist within this hierarchy. A vendor that certifies to NIST 800-88 Purge level for SSDs and Clear or Purge level for HDDs, with a verification step and an issued certificate, satisfies the technical requirements that SOC 2 CC6.7, ISO 27001 A.5.11, and HIPAA §164.310(d)(2) each reference for media disposal.

Which Standard Should You Specify in Procurement Contracts?

Specify NIST SP 800-88 Rev. 1, with the sanitization category (Clear, Purge, or Destroy) defined by media type and data sensitivity. Require a certificate of destruction that names the standard, the category applied, the serial number of each device, and the date of sanitization. That documentation is what SOC 2, ISO 27001, and GDPR audits require when reviewing certified data erasure standards compliance.

In practice, the contract language that works looks like this: "All storage media must be sanitized to NIST SP 800-88 Rev. 1 Purge level prior to transfer or disposal. Flash-based media must be sanitized via crypto-erase or ATA Secure Erase. A certificate of destruction must be issued for each device, identifying the device serial number, sanitization method applied, and date of completion."

For organisations subject to HIPAA §164.310(d)(2), the requirement is to maintain a record of the disposal of hardware and the sanitization method used. NIST 800-88 is the technical standard HIPAA references for what "proper" disposal means for electronic media. SOC 2 CC6.7 requires that logical access controls include protection of information assets during disposal, and auditors treat a NIST 800-88 certificate as the standard evidence item. ISO 27001:2022 control A.5.11 requires documented procedures for secure disposal of equipment, with NIST 800-88 and ISO/IEC 27040 as the recognised technical references.

When you are drafting contract language, it is worth noting where each certified data erasure standard fits by audience. NIST 800-88 belongs in the technical specification clause. ISO/IEC 27040 belongs in the governance and compliance clause for multinational contracts. DoD 5220.22-M belongs in the overwrite method description where counterparties expect it, labelled as a method rather than a current regulatory requirement.

Platforms like Rayda that certify erasure to NIST SP 800-88 and issue an auditable certificate of destruction for every retrieved device produce the exact evidence artefact that SOC 2, ISO 27001, and GDPR audits require. The chain of custody documentation matters as much as the erasure itself, which the follow-up cluster on chain of custody for offboarded devices covers in detail.

What Are the Most Common Misconceptions About Certified Erasure?

The most damaging misconceptions about certified data erasure standards are ones that lead organisations to specify methods that do not actually protect them. Three stand out.

"Military-grade" is not a standard. No standards body, not NIST, not ISO, not NSA, defines "military-grade erasure." It is marketing language. When a vendor uses it without citing a named standard and a specific sanitization category, there is no auditable basis for the claim. If an auditor asks "what standard did you use?", the answer "military-grade" fails the question. Require the vendor to name NIST 800-88 or another recognised standard, state the category applied, and provide a certificate.

Overwrite does not work reliably on SSDs. This is the single most consequential technical error in commercial erasure practice. SSDs use wear levelling to distribute writes across memory cells, and they maintain reserved blocks that overwrite commands do not reach. A 3-pass or 7-pass overwrite of an SSD does not touch every cell that held data. NIST 800-88 explicitly states this and recommends Purge-level methods (crypto-erase or ATA Secure Erase) for flash-based media. Any policy that specifies overwrite passes for SSD sanitization, regardless of how many passes, is not meeting the NIST standard for that media type.

DoD 5220.22-M does not mean "current DoD practice." As covered above, the DoD stopped using its own sanitization specifications for classified systems in 2007. Specifying DoD 5220.22-M in a contract is fine as a description of an overwrite method. Representing it as "compliant with current DoD standards" for classified data is inaccurate.

A fourth misconception: erasure alone is not a compliance event. The chain of custody before erasure matters as much as the erasure itself. A device that sat in an ex-employee's home for three months before being returned, with no documented handling, cannot produce a clean compliance record even if the erasure is certified. The follow-up cluster on secure disposal versus resale covers how that distinction affects both risk and residual asset value.

FAQ

What is the difference between NIST 800-88 Clear, Purge, and Destroy?

Clear uses logical overwrite techniques to protect against non-laboratory data recovery. It is appropriate for media being reused within the same organisation. Purge applies stronger techniques, including crypto-erase and ATA Secure Erase, that resist even laboratory-grade recovery attempts. It is required for media leaving organisational control. Destroy means physical destruction, rendering the media completely unusable. The three categories map to data sensitivity and the media's next destination.

Is DoD 5220.22-M still a valid standard for data erasure?

DoD 5220.22-M is valid as an overwrite method specification for HDDs, but it is not current DoD doctrine for classified systems, which has followed NSA/CSS Policy Manual 9-12 since 2007. It also provides no guidance for SSDs. In commercial contracts, it is widely recognised and technically adequate for HDD overwrite, but NIST SP 800-88 Rev. 1 is the more current and complete reference. Specify NIST 800-88 in any new contract or security policy.

Can you use overwrite to securely wipe an SSD?

No. Standard overwrite methods do not reliably sanitize SSDs. Wear levelling and reserved blocks mean overwrite commands do not reach all memory cells that contained data. NIST SP 800-88 Rev. 1 explicitly recommends Purge-level methods for flash-based media: crypto-erase (if the drive supports AES encryption) or ATA Secure Erase. Physical destruction is the alternative when neither method is available or verifiable.

What evidence does an auditor require for certified data erasure?

A SOC 2, ISO 27001, or GDPR audit requires a certificate of destruction that identifies each device by serial number, states the sanitization method and standard applied (for example, NIST SP 800-88 Rev. 1 Purge, crypto-erase), records the date of sanitization, and identifies who performed it. A log entry or a vendor's verbal assurance does not satisfy the evidence requirement. The certificate must be retained and producible on request.

What does ISO/IEC 27040 say about data sanitization?

ISO/IEC 27040:2015 covers storage security broadly. Its sanitization guidance appears in Annex A and explicitly cross-references NIST SP 800-88. It defines sanitization within a storage security lifecycle framework and is the international reference most relevant to GDPR-aligned disposal documentation. Organisations operating across multiple jurisdictions often cite ISO/IEC 27040 alongside NIST 800-88 to satisfy both U.S. and international audit expectations.

How many overwrite passes are required for HDD sanitization?

NIST SP 800-88 Rev. 1 confirms that a single overwrite pass is sufficient for modern HDDs. The 3-pass, 7-pass, and 35-pass Gutmann methods address concerns about older magnetic storage technology that do not apply to drives manufactured in the past two decades. Requiring additional passes in a contract adds time and cost with no measurable security benefit for current hardware.

What does "certified data erasure" mean in practice?

Certified data erasure means that a named sanitization method, referenced to a recognised standard such as NIST SP 800-88, was applied to a specific device, verified to confirm no recoverable data remains, and documented with an issued certificate that records the device serial number, method used, and date. It is distinct from "secure erase" as a marketing claim, which carries no auditable basis without that documentation chain.

If your team manages device disposal across multiple countries and needs erasure documentation that satisfies SOC 2, ISO 27001, or GDPR audits, Rayda handles certified erasure, physical retrieval, chain of custody documentation, and certificate issuance across 170+ countries. Book a demo to see how it works for your environment.