Skip to content
Information SecurityUnited States

NIST SP 800-88 Rev 2

What is NIST SP 800-88 Rev 2?

NIST's September 2025 revision of the media sanitization guideline: the clear, purge and destroy methods and when each is appropriate, the conditions under which cryptographic erase counts as purge (validated cryptography of at least 128 bits, no prior plaintext, every copy of the target keys zeroized, escrowed and injected keys accounted for, implementation quality evidenced and the operation traceable), and the elements of a media sanitization programme from policy and scope through the decision framework, performance, verification, validation, certificates of sanitization and programme roles, plus the sanitize-command information to obtain from vendors. It comprises 30 controls organised across 4 domains, and applies in the United States.

Map this against the frameworks you already hold

The compliance knowledge graph holds cross-framework control mappings for hundreds of standards, including the ones you are likely to be certified against already.

Browse the framework graph →

Where NIST SP 800-88 Rev 2 overlaps with the standards you already hold

NIST SP 800-88 Rev 2 vs ISO 27001:2022View comparison →NIST SP 800-88 Rev 2 vs SOC 2View comparison →NIST SP 800-88 Rev 2 vs NIST CSF 2.0View comparison →NIST SP 800-88 Rev 2 vs GDPRView comparison →NIST SP 800-88 Rev 2 vs HIPAAView comparison →NIST SP 800-88 Rev 2 vs PCI DSS 4.0View comparison →

What NIST SP 800-88 Rev 2 means in your sector

NIST SP 800-88 Rev 2 for Healthcare→NIST SP 800-88 Rev 2 for Financial Services→NIST SP 800-88 Rev 2 for Technology→NIST SP 800-88 Rev 2 for Government→NIST SP 800-88 Rev 2 for Manufacturing→NIST SP 800-88 Rev 2 for Energy→NIST SP 800-88 Rev 2 for Retail→NIST SP 800-88 Rev 2 for Education→

What NIST SP 800-88 Rev 2 means for your job

NIST SP 800-88 Rev 2 for CISOs→NIST SP 800-88 Rev 2 for Compliance Officers→NIST SP 800-88 Rev 2 for Risk Managers→NIST SP 800-88 Rev 2 for IT Directors→NIST SP 800-88 Rev 2 for DPOs→NIST SP 800-88 Rev 2 for Auditors→

Questions people ask about NIST SP 800-88 Rev 2

What is NIST SP 800-88 Rev 2?
NIST's September 2025 revision of the media sanitization guideline: the clear, purge and destroy methods and when each is appropriate, the conditions under which cryptographic erase counts as purge (validated cryptography of at least 128 bits, no prior plaintext, every copy of the target keys zeroized, escrowed and injected keys accounted for, implementation quality evidenced and the operation traceable), and the elements of a media sanitization programme from policy and scope through the decision framework, performance, verification, validation, certificates of sanitization and programme roles, plus the sanitize-command information to obtain from vendors.
How many controls does NIST SP 800-88 Rev 2 have?
NIST SP 800-88 Rev 2 contains 30 controls organized across 4 domains.
Where does NIST SP 800-88 Rev 2 apply?
NIST SP 800-88 Rev 2 applies in United States. Organizations operating in or serving customers in this jurisdiction should check whether its requirements reach them.
Which version of NIST SP 800-88 Rev 2 is covered here?
This page covers Revision 2, September 2025 (supersedes Revision 1, December 2014).

Query NIST SP 800-88 Rev 2 programmatically

NIST SP 800-88 Rev 2, its 30 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.

NIST SP 800-88 Rev 2 API reference and MCP config →

How ready are you for NIST SP 800-88 Rev 2?

Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.

Get Your Readiness Report, from $49Explore Platform Free
Written and maintained by Gerard Blokdyk, The Art of Service.Last updated .