This page is set in the style of nist.gov. NIST is a federal agency. It writes the standard and does not certify or endorse vendors, including Coretek 360.
Every drive Coretek 360 retires is cleared, purged, or destroyed to NIST Special Publication 800-88 Rev. 2 and leaves with a certificate of sanitization tied to its serial number. Here is what the standard asks for and how we meet it.
U.S. Department of Commerce
Founded by Congress in 1901 and headquartered in Gaithersburg, Maryland, NIST is the national measurement institute of the United States. Its mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology. Its Information Technology Laboratory publishes the Special Publication 800 series, the security guidelines federal agencies follow and much of industry adopts.
NIST keeps the measurements the country runs on: the second, the kilogram, the volt, and the reference materials that let a lab in one state agree with a lab in another. The same work extends into technology. The atomic clock, the smart grid, electronic health records, and the computer chip all depend on NIST measurements and standards.
In cybersecurity, NIST writes the guidance rather than enforcing it. The Cybersecurity Framework, the FIPS standards that govern federal cryptography, and the SP 800 series all come from its Information Technology Laboratory. Federal agencies are required to follow them under FISMA. Private organizations adopt them because auditors, insurers, and regulators recognize them.
Special Publication 800-88, Guidelines for Media Sanitization, is the one that governs what happens to a drive when it leaves service. Revision 2, published in September 2025, replaces the 2014 revision and is the version Coretek 360 works to.
SP 800-88 defines media sanitization as a process that renders access to target data infeasible for a given level of effort. It names three methods, from the lightest to the final one, and asks the data owner to pick by the sensitivity of the data and whether the media will be reused.
Section 3.1.1
Logical techniques that sanitize every user addressable location against simple, non invasive recovery, using the same interface a user has.
In practice that is a verified single pass overwrite or a factory reset. Revision 2 states plainly that multiple overwrite passes are not needed, which retires the old DoD 5220.22-M pattern. The media stays usable.
At Coretek 360: Used for low sensitivity media that will be reused.
Section 3.1.2
Physical or logical techniques that make recovery infeasible even with state of the art laboratory techniques, while leaving the media in a potentially reusable state.
Logical purge uses the drive's own sanitize commands, as IEEE 2883 lists them: overwrite, block erase, and cryptographic erase. NIST says to prefer purge over clear whenever the media supports it.
At Coretek 360: Our default for every drive that will be resold through our sales channels.
Section 3.1.3
Techniques that make recovery infeasible with laboratory techniques and leave the media unable to store data again: disintegrate, incinerate, melt, pulverize, or shred.
The option when a drive has failed, cannot be addressed by its interface, or when the data owner requires it. Revision 2 is clear that degaussing on its own is not a destroy technique.
At Coretek 360: Shredding, for failed drives and for clients who require it.
Section 4.6 says a certificate of sanitization should be completed for each piece of media, and lists what it must record at a minimum. Appendix C prints the sample form. The left column is the standard’s list. The right column is what is on every certificate Coretek 360 issues.
Manufacturer, model, serial number
Read from the drive by Averase and recorded per serial number.
Property number, if assigned
Your asset tag, when it is on the device, kept with the serial.
Media type and source
Drive type and the machine it came out of, on the same record.
Sanitization method
Clear, purge, or destroy, named on the certificate.
Sanitization technique
Overwrite, block erase, cryptographic erase, or shred.
Tool used, including version
Averase and its version, written into the certificate.
Verification method
The post wipe check Averase ran and its result.
Who performed it, when, and where
Technician, date, and the Concord facility, signed.
The guideline describes a media sanitization program, not a single wipe. Ours follows its order, from the first question it asks to the record it ends on, for every drive that comes through the Concord facility.
The standard begins with the sensitivity of what the media held, not the media itself. You tell us the data category, or the regulation you answer to, and the method follows from it.
Revision 2's sanitization flow opens on one question: will the media be reused? Drives with life left in them are purged and resold through our sales channels. Failed drives are destroyed.
Averase runs the purge technique the drive supports, drive by drive, and records what ran. Drives that cannot be purged are shredded in house.
Revision 2 introduces sanitization assurance: verification of each operation's outcome, then validation that accepts or rejects it. Averase checks every wipe and flags any error on the record.
A certificate of sanitization per drive, with the fields Section 4.6 lists, and a serialized report that traces custody from your dock to final disposition.
The tool we stay compliant with
Averase is our own sanitization software. A machine boots the Averase image, fingerprints its own hardware, and lists its drives. Erasure then runs drive by drive using the purge techniques the drive supports, including NVMe sanitize and ATA secure erase, the dedicated sanitize commands SP 800-88 points to for a logical purge.
Every wipe is validated, and each drive receives a signed, tamper proof certificate tied to its own serial number, with the method, the technique, the tool version, and the verification result the standard asks for. Each machine keeps one record that updates as it is booted, tested, and wiped, so the inventory your report is built from is the same one the wipe wrote to.
What compliance reviewers ask about the guideline and how we apply it.
The National Institute of Standards and Technology is a federal agency within the U.S. Department of Commerce, founded in 1901 and headquartered in Gaithersburg, Maryland. It is the national measurement institute of the United States, and its Information Technology Laboratory publishes the Special Publication 800 series of security guidelines, including SP 800-88 on media sanitization.
Special Publication 800-88, Guidelines for Media Sanitization, is NIST's guidance on removing data from storage media before it is reused, recycled, or leaves an organization's control. Revision 2 was published in September 2025 and supersedes Revision 1 from 2014. It defines three sanitization methods, clear, purge, and destroy, and describes the program, the verification, and the records that go with them.
No. NIST writes the guideline and does not certify vendors, so there is no NIST 800-88 certificate for a company to hold. A provider that says it is NIST 800-88 compliant is saying its process follows the guideline. Ask to see the certificate of sanitization it issues per drive and the fields on it. Coretek 360's process is also independently audited under R2v3, whose scope covers logical data sanitization.
Clear uses logical techniques, such as a verified overwrite or a factory reset, to protect against simple recovery through the device's normal interface. Purge uses the drive's own sanitize commands, or physical techniques, to make recovery infeasible even in a laboratory while leaving the drive reusable. Destroy makes recovery infeasible and leaves the media unable to store data again, by shredding, pulverizing, disintegrating, incinerating, or melting it.
Purge is our default for any drive that will be reused, because the standard says to prefer it over clear whenever the drive supports it. Averase runs the sanitize command the drive supports, such as NVMe sanitize or ATA secure erase, and validates the result. Drives that fail, that cannot be addressed through their interface, or that a client requires destroyed are shredded in house. Shredding is not yet within our R2v3 scope, and we are working to add it.
No. Revision 2 states that a single overwrite pass meets the clear method and that multi pass patterns from the old DoD 5220.22-M language are not needed. On solid state drives, overwriting cannot reach spare cells at all, which is why the guideline directs you to the drive's own sanitize commands, the purge techniques we use.
Section 4.6 of the guideline lists the minimum: manufacturer, model, serial number, any property number, media type and source, the sanitization method and technique, the tool used and its version, the verification method, and who performed it, when, and where. Each certificate Coretek 360 issues carries those fields for one drive, signed, and the serialized report ties the certificates to custody and final disposition.
Federal agencies must follow it under FISMA. For everyone else it is voluntary, but it is the sanitization reference that auditors under HIPAA, GLBA, FERPA, PCI DSS, and CJIS expect to see. Working to it means your reviewer can check our records against a published standard rather than a vendor's own description.
Averase is our own data wiping and inventory software. A machine boots the Averase image, reports its hardware and drives, runs the purge technique each drive supports, validates the wipe, and writes a signed, tamper proof certificate tied to the drive's serial number. One record per machine follows it from first boot to final disposition, and that record is what your serialized report is built from.
Tell us which regulation you answer to and we will plan the sanitization method and the reporting around it. Your auditors receive a certificate of sanitization per drive and a serialized asset report covering custody, the method used, and disposition, so they can review line by line. For questions about an existing report, contact support with the serial numbers you are asking about.
Last reviewed on .
The certification that audits our sanitization process, the regulation it most often answers to, and the services that run to the standard.
Certificate C0177760-R26, issued by NSF. Logical data sanitization is within its scope.
What the Privacy and Security Rules ask of retired devices, and the records we provide.
Drives wiped to NIST 800-88 or shredded, with a certificate for each serial number.
Scheduled pickups, chain of custody, and a serialized report for every asset.
R2v3, RIOS, NIST 800-88, and HIPAA, and where to verify each one.
Tell us what you are retiring and which regulation you answer to, and we will walk your reviewer through the certificates and the serialized report.
