Standards preparation checklist
Media Sanitization and Equipment Retirement
Prepare a risk-based sanitization program and the records needed to explain decisions about reuse, transfer and disposal.
Baseline: NIST SP 800-88 Rev. 2, with July 2026 FAQ. Prepared November 1, 2026.
Has the owner authorized disposition and checked retention needs?
Confirm what may be erased or destroyed and whether the business or counsel requires material to be retained. Sanitization is irreversible in its intended result. This preservation decision is a GDF preparation step, not a claim that NIST defines every legal hold duty.
Evidence to gather
Authorized disposition scope, information owner and any preservation/retention instructions.
If something is missing
Resolve conflicting or missing instructions before sending equipment for sanitization.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.3.1, lifecycle decision context; PDF page 29. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Is sanitization governed by an established policy?
Connect data sensitivity, acceptable methods, responsibilities, documentation and supplier assurance. A disposal receipt alone does not show that a suitable sanitization process was selected.
Evidence to gather
Policy, approved methods, responsible owners and documentation requirements.
If something is missing
Identify the missing decisions in the program before evaluating individual disposal jobs.
Topic reference: NIST SP 800-88 Rev. 2; Sections 4.1 and 4.7; PDF page 27. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Have all storage components been identified?
A device may contain more than its obvious drive. Include removable cards, embedded storage and other components that may hold target data. A vendor statement of volatility can help identify less visible storage.
Evidence to gather
Device/storage inventory, serial identifiers and vendor storage/volatility information.
If something is missing
Confirm the relevant storage with the vendor or a qualified examiner before selecting a technique.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.3.1 and Appendix B; PDF page 30. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
What data sensitivity and release conditions govern the decision?
Record the sensitivity of the information, whether media will be reused and whether it stays under organizational control. Those conditions influence the selected method and the assurance needed.
Evidence to gather
Data classification, intended destination, reuse decision and control/transfer conditions.
If something is missing
Have the information and asset owners approve the decision basis.
Topic reference: NIST SP 800-88 Rev. 2; Sections 4.3.2-4.3.6; PDF page 30. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Is the selected method suitable for the media and purpose?
Clear, purge and destroy describe different sanitization approaches. Choose an approved technique for the actual storage and risk. Formatting a volume, deleting files or making a device inoperable does not by itself establish that the selected method achieved its objective.
Evidence to gather
Selected method/technique, media specification and technical decision rationale.
If something is missing
Use approved media-specific procedures. Do not substitute a generic overwrite recipe for every device.
Topic reference: NIST SP 800-88 Rev. 2; Sections 3.1 and 4.4; PDF page 17. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can the supplier explain how the sanitization function works?
A product label or command name is not sufficient assurance. Obtain the relevant media capabilities, limitations and implementation evidence so the organization can make an informed selection.
Evidence to gather
Vendor documentation, supported interfaces, assurances and approved tool/procedure records.
If something is missing
Ask for unresolved technical details before accepting a sanitization capability for sensitive data.
Topic reference: NIST SP 800-88 Rev. 2; Sections 4.1 and 4.3.1; Appendix B; PDF page 27. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
If using cryptographic erase, were its prerequisites established?
Erasing a key only addresses the data protected by that key under suitable cryptographic and storage conditions. Identify whether sensitive plaintext existed outside the protected scope and whether the implementation supports the intended operation.
Evidence to gather
Encryption history, protected-data scope, key hierarchy and implementation assurance.
If something is missing
Have a qualified specialist review the prerequisites rather than treating encryption-enabled as proof of successful purge.
Topic reference: NIST SP 800-88 Rev. 2; Sections 3.2.1-3.2.4; PDF page 21. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Have all relevant key copies and recovery paths been considered?
Escrowed, backed-up or externally managed keys can affect whether data remains recoverable. Record the key relationships and how the relevant copies are handled without recording key values in the checklist.
Evidence to gather
Key lifecycle/escrow design, provider responsibilities and evidence of the authorized operation.
If something is missing
Resolve unknown key locations or recovery paths before relying on cryptographic erase.
Topic reference: NIST SP 800-88 Rev. 2; Sections 3.2.3 and 3.2.5; PDF page 24. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are partial or selective sanitization limits understood?
Data can exist outside the intended file, partition or logical boundary, including remapped or overprovisioned areas. A narrow operation needs a justified scope and assurance that relevant copies were addressed.
Evidence to gather
Target-data scope, storage layout, known copies and technical limitations.
If something is missing
Have the storage owner or specialist evaluate the boundary before accepting a partial operation.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.2; PDF page 28. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Do cloud and virtual storage arrangements provide adequate evidence?
The customer may not control the physical media. Identify the provider's deletion, retention, key-management and sanitization responsibilities and what can actually be verified for the selected service.
Evidence to gather
Service terms, retention/key controls, provider attestations and data-copy inventory.
If something is missing
Clarify provider capabilities and remaining copies. Do not claim local overwrite or physical destruction of media you do not control.
Topic reference: July 16, 2026 FAQ; Question 13; MEDIA88 section 4.2; PDF page 8. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Was the operation verified for completion and anomalies?
Verification inspects the outcome of the technique used. Capture completion information, errors and relevant media or equipment conditions. A tool reporting success is one input to assurance, not the final suitability decision.
Evidence to gather
Tool/equipment identity and version, completion status, errors and inspection results.
If something is missing
Review unexpected results before releasing the media or accepting the job.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.5.1; PDF page 33. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Was the outcome validated against the decision criteria?
Validation decides whether the result is sufficient for the target data and the organization's accepted risk. A correctly completed operation may still use the wrong method, scope or equipment for the media.
Evidence to gather
Verification record, data sensitivity, acceptance decision and unresolved concerns.
If something is missing
Reject or escalate an inadequate result and apply the approved follow-up procedure.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.5.2; PDF page 34. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Can each device be linked to an adequate sanitization record?
Retain identifying information, the selected method/technique, tool version, verification and validation details, people and dates. The document needs to explain what was done to the identified media, not merely say that a batch was collected.
Evidence to gather
Device-linked certificates/records, method details, responsible people and disposition.
If something is missing
Resolve unidentified media or incomplete records before considering the batch closed.
Topic reference: NIST SP 800-88 Rev. 2; Section 4.6 and Appendix C; PDF page 34. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date:
Are the people, tools and disposal handoffs controlled?
Define competence, tool approval and provider responsibilities. Protect the media until the required operation and acceptance are complete, including transfer to an outside facility.
Evidence to gather
Training/authorization, equipment records, service agreements and transfer records.
If something is missing
Review the handoff with the asset owner and supplier and assign missing controls.
Topic reference: NIST SP 800-88 Rev. 2; Sections 4.1, 4.3.4 and 4.7; PDF page 27. Practical adaptation.
Answer:
Owner, evidence reference and follow-up date: