NIST 800-88 is the media sanitisation standard most UK auditors, insurers and regulators recognise, despite being an American publication. If a supplier tells you they "wipe to NIST standard", this is what they are referring to — and it is worth knowing what the words mean, because they are not interchangeable.
| Clear | Overwrites data using standard read/write commands. Protects against recovery using ordinary software tools. Does not necessarily reach every area of the media. |
|---|---|
| Purge | Applies techniques that make recovery infeasible even with laboratory equipment. On modern drives this typically uses firmware-level sanitise commands, and covers areas a simple overwrite cannot reach. |
| Destroy | Physical destruction — shredding, disintegration, incineration. The media cannot be reused afterwards, and neither can any value in it be recovered. |
The important distinction is between Clear and Purge. Clear is adequate for media staying inside your organisation. Purge is the appropriate level when media is leaving your control, which is exactly what disposal means.
Multi-pass overwriting — Gutmann, DoD 5220.22-M and similar — comes from an era of magnetic media where residual magnetism was a genuine theoretical concern. On modern drives it offers no meaningful benefit over a single properly verified pass, and takes many times longer.
More importantly, on an SSD it can be actively counterproductive. Flash storage uses wear levelling, which means the drive controller decides where data physically lands. Writing patterns through the normal interface gives no guarantee that every cell holding your old data has been touched. Firmware-level sanitise commands exist precisely because the naive approach does not work.
The test question: ask a prospective supplier how they handle SSDs differently from hard drives. If the answer is "the same way", they do not understand the media well enough to be trusted with it.
Degaussing exposes media to a strong magnetic field, scrambling the magnetic domains that store data on a traditional hard drive. Done properly it is extremely effective and irreversible — the drive is destroyed as a functioning device in the process.
It does nothing whatsoever to an SSD. Flash memory stores data as trapped electrical charge, not magnetically. Degaussing solid state media is not a weak measure; it is no measure at all.
This matters because "we degauss everything" still gets offered as a reassurance. In a modern estate, where most laptops have shipped with SSDs for a decade, that reassurance would leave the majority of your data completely intact.
Our standard is NIST 800-88 Rev 2 Purge, applied with PartedMagic on our standard service and Blancco on Premium. Blancco produces the tamper-evident, independently verifiable certificate that regulated clients generally need.
Where a drive cannot be verifiably sanitised — it has failed, the controller is dead, or the interface is too old to address reliably — it is not quietly passed through:
Either outcome is recorded against the device serial number in your destruction report.
A sanitisation process without verification is an assumption. The standard is explicit that sanitisation should be verified, and that verification should be documented.
In practice this is the difference between a supplier who can tell you that asset LS-4471 was purged, verified and certified on a particular date, and one who can tell you that roughly a tonne of equipment was collected that month. Only the first is evidence.
More detail on how this works in practice is on our secure data destruction page.
Call us and ask. We would rather give you a straight answer than a brochure — even if the answer is that you do not need us.
Call 01422 416821 →Why some collections are free, when they are not, and the charges that catch people out.
Read →What the law actually requires when business IT leaves your building, and how to check a supplier is licensed.
Read →Ten questions worth asking, including the free check most businesses never carry out.
Read →Step-by-step for Intune, Autopilot, Entra ID, Apple Business Manager and iCloud.
Read →