NIST 800-88
NIST SP 800-88 Rev. 2 for R2v3 Facilities
What the Rev. 2 update means for your Appendix B data sanitization program.
In short: NIST replaced SP 800-88 Rev. 1 with Rev. 2 in September 2025. If your R2v3 data sanitization plan, work instructions, training records or certificates of sanitization still cite "Rev. 1", update the references and check your methods before your next audit.
Three things to check in your Appendix B program
- References. Plans, procedures, training and sanitization certificates should cite NIST SP 800-88 Rev. 2.
- Methods backed by a current specification. Rev. 2 no longer lists device-by-device techniques, so each logical or physical method you use should trace to a current standard or NSA guidance, and to your Appendix B(13) recovery checks.
- Verification and validation records. Keep evidence that each sanitization run completed (verification) and that your organization accepted the result for that data (validation).
The full guide
Our maintained guide covers every Rev. 2 change, cryptographic erase and degaussing: NIST SP 800-88 Rev. 2 guide on paradygm.co.
Official sources
- NIST SP 800-88 Rev. 2 (free download from NIST)
- NIST FAQ for SP 800-88r2
- NSA Evaluated Products Lists for media destruction devices
Get help
We help R2v3 and ITAD facilities update data sanitization plans, procedures and training for Rev. 2. Contact us or call 1-855-702-9001 (Monday to Friday, 8:00 AM–6:00 PM ET).
Last updated: 25 October 2026. Summary by Paradygm Consulting, not a substitute for the NIST publication. Official source: NIST SP 800-88 Rev. 2 (csrc.nist.gov).