Insight
NIST Sanitization Guidance Has a New Final Revision
Revision 2's program changes and their practical implications for media disposal.
On September 26, 2025, NIST published Revision 2 of Special Publication 800-88, Guidelines for Media Sanitization. It replaces Revision 1 of 2014. The new version shifts emphasis from wiping a particular drive to running a sanitization program. For anyone who cites NIST to show that disposal was done right, the citation has changed.
What changed
| Topic | Revision 1 | Revision 2 |
|---|---|---|
| Focus | Hands-on media sanitization decisions | Greater emphasis on an enterprise sanitization program |
| Technique detail | Media-specific technique guidance | Refers to IEEE 2883, NSA specifications, or an organizationally approved standard, except for cryptographic erase |
| Cryptographic erase | Guidance distributed across the document | Consolidated guidance addressing key types, zeroization, and externally managed keys |
| Vendor methods | Existing sanitization discussion | Added emphasis on establishing trust in vendor clear/purge implementations |
| Alignment | Earlier publication's controls context | Updated alignment with cybersecurity and storage-security standards |
The categories survive. Organizations still choose to clear, purge, or destroy based on the sensitivity of the data and where the media is going. NIST describes a shift in focus, not the invention of program governance or vendor guidance.
Why lawyers should care
Revision 2 is guidance unless an applicable rule, qualifying framework, or contractual obligation makes its requirements relevant to the organization. Chapter 542 does not expressly list SP 800-88. A business relying on that statute should identify its qualifying framework and determine whether §542.004(c)'s update provision applies. The publication date alone does not establish a universal Texas compliance deadline.
Disposal duties themselves are not voluntary. Texas requires a business to destroy, or arrange to destroy, customer records containing sensitive personal information that it will not keep, by shredding, erasing, or otherwise making them unreadable (Bus. & Com. Code §521.052(b)). NIST's publication is frequently cited to show how an organization met such duties, which is why the revision matters to the record.
The SEC's Regulation S-P imposes a disposal rule on brokers and advisers. In September 2022 the SEC settled with Morgan Stanley Smith Barney for $35 million over servers and storage devices that left the firm's control without being wiped (SEC Release 2022-168). The settled order found willful violations of the Safeguards Rule and the Disposal Rule, 17 C.F.R. §248.30(a) and (b), and documented a vendor-oversight failure: the firm hired a moving company with no data-destruction capability to wipe devices, never vetted the subvendor it switched to, and paid for wiping services never performed (File No. 3-21112). The case supports diligence and oversight of disposition vendors; it does not impose a legal requirement to adopt this later NIST revision.
What a disposition program should update
Cite SP 800-88 Rev. 2 in the disposal policy, and name the technique standard used, usually IEEE 2883. Assign the program roles Rev. 2 describes, so someone owns sanitization decisions. Ask disposal vendors which standard their tools apply and how they verify results. Keep a record for each device: the sensitivity, the method, the verification, and who signed off. Review cryptographic erase use against the new section, especially where keys are managed outside the device.
Sources
- NIST announcement, Sept. 26, 2025
- NIST SP 800-88 Rev. 2, final
- SEC Release 2022-168 (Morgan Stanley settlement announcement)
- Tex. Bus. & Com. Code §542.004(b) through (c)