Data Sanitization

How we sanitize

We sanitize to NIST SP 800-88 Revision 2, choosing the method per device rather than applying one setting to everything. Clear, purge or destroy is a decision based on the media, the sensitivity of the data, and whether the equipment is leaving your control. Revision 2 is explicit that purge should be used instead of clear where possible, and equipment leaving your organization is exactly that case.

Verification and validation are two separate steps here, because Revision 2 treats them separately. Verification inspects the outcome of the technique: tool completion status, errors, anomalies, drive health. Validation is a person deciding whether that outcome is acceptable for the sensitivity of the data, and rejecting it where it is not.

A failed result is never overwritten with a later success. It stays in the record, with the remediation logged after it. A sanitization history with no failures in it has usually been edited rather than earned.

If your policy sets a different standard, or your contract names a method, tell us at scoping and we work to that instead. Collection and custody covers how the devices reach us.

What to require in a sanitization record

This section is useful whether or not you work with us, which is why it is here.

The record is the part most providers treat as an afterthought and the part your auditor will ask for. A good one identifies the device, not the batch. A batch-level statement that a quantity of devices was treated isn't evidence about any one device, and the device somebody asks about later is always a specific one. Insist on per-device.

Who this is for

The person who has to answer for the data after the equipment is gone. Usually that's IT, sometimes it's compliance, and on a school or agency project it's frequently someone who inherited the question.

If your obligation is contractual rather than regulatory, that works the same way here: tell us the clause at scoping and we work to it.

What we handle

Phones, tablets and laptops. That's the whole list, and it's deliberate.

That list is deliberate rather than a limitation we're embarrassed about — a narrow scope is how the counting stays accurate. Loose drives, servers and networking equipment need a provider whose scope covers them, and we'll tell you that at scoping rather than at your loading dock.

How custody works

This is the part we actually perform, so it is the part we can describe precisely.

At your site. We count what is being collected against the list you supply, and record discrepancies at that moment rather than reconciling them afterwards from memory. A device that turns up and is not on your list is written down as exactly that.

At handover. Containers are sealed, seal numbers recorded, and you get a signed manifest before the vehicle leaves.

At intake. Seals are checked against the manifest before anything is opened. Every unit is booked in against its own asset tag and chassis serial number, and where those disagree or either is missing, the device goes to an exception queue rather than being processed under the nearest matching record.

We inventory the media, not just the machine. One laptop can hold an internal drive, a second drive in a caddy, a removable card, and a USB stick that travelled in the same tote. All of it is recorded, because a certificate that covers the laptop and misses the caddy is the kind of gap that surfaces two years later.

Nothing moves before you have written acceptance and transport instructions from us.

What you get back

The certificate of sanitization, per media item. Not per batch. It carries the fields Section 4.6 of the standard asks for: manufacturer, model, serial, property number, media type and source, method, technique, tool and version, verification method, and the named individuals who verified and validated it, with the date.

The collection manifest and intake reconciliation, which answer the custody question and tie every certificate back to the device that left your building.

The closeout file, reconciling your original retirement list against final disposition of every item, exceptions included. Finance gets assets, routes and recovery. Security gets method, technique and validation per media item. Anything unresolved comes back with a named owner, not as a line called miscellaneous.

A batch-level statement that a quantity of devices was treated is not evidence about any one device, and the device somebody asks about later is always a specific one.

Service area and scheduling

Colorado Springs facility, collecting nationwide, by arrangement — the full service area and scheduling detail sits on the collection page.

What we can evidence, and what we can't

We hold no certifications today. Not R2, not e-Stewards, not NAID. Our facility operates to R2v3 requirements and our certification audit is pending. When a certificate is issued it goes on the standards page with a number you can look up, and not before.

Two things you can check right now, because they're true of everyone:

NIST certifies nobody. It publishes guidance and runs no vendor certification program. "NIST 800-88 certified" describes something that does not exist.

NIST says should, not shall. Section 4.6 of the current revision says a certificate of sanitization "should be completed for each ISM that has been sanitized, per the organization's policies." A provider telling you NIST requires it is overstating the document.

What happens if a device fails verification

This is the case that separates a real procedure from a description of one, so here is ours.

A rejection at validation means repeating with a different technique, or escalating the method — a drive that will not take a purge reliably is a candidate for destruction rather than a candidate for another attempt at the same thing. The failed attempt stays in the record with the remediation logged after it.

Where a device cannot be sanitized to the required outcome by any available method, it does not quietly become a recycling line item. It is reported to you as an exception with the serial number and the reason, and you decide, because the risk is yours to carry and the decision should be too.

Ask any other provider the same question, and treat a vague answer as the answer.

The standard behind this changed in 2025, and most pages haven't caught up

NIST SP 800-88 Revision 1 was withdrawn on September 26, 2025. If you're specifying a method, judging a provider's answer, or updating a policy that cites the old revision, the detail is worth twenty minutes:

What changed in NIST SP 800-88 Revision 2 covers the three method definitions and what each one actually defends against, the three things the revision changed, and whether a factory reset is ever enough.