Casselberry Hard Drive Shredding & Certified Data Destruction

Published September 26, 2025, NIST SP 800-88 Rev. 2 is the federal standard for media sanitization, superseding Rev. 1 (December 2014) in its entirety. The fundamental Clear, Purge, and Destroy framework is unchanged.

What changed is how organizations must achieve and document those levels: Rev. 1 provided detailed technique tables for specific media types; Rev. 2 removes those tables entirely and requires organizations to build formal sanitization programs that reference IEEE 2883-2022 or NSA specifications for technique selection. Rev. 2 also adds a validation requirement, confirming sanitization outcomes per device, and addresses cloud and virtualized environments that Rev. 1 did not cover.

"Withdrawn" is NIST's formal designation for a publication that has been superseded and is no longer the controlling guidance. As of September 26, 2025, Rev. 1 is archived at NIST with a notice marking it withdrawn and superseded by Rev. 2. Federal agencies whose security authorization packages, System Security Plans, or ITAD vendor contracts still cite Rev. 1 as the governing media sanitization standard are referencing a document NIST no longer recognizes as current.

This creates gaps in CMMC 2.0 media protection documentation and may generate IG findings during FISMA annual authorization reviews even when the physical sanitization performed was technically adequate.

Rev. 2 establishes a formal two-part evidence standard. Verification, confirming the sanitization method was applied, was the primary requirement under Rev. 1. Rev. 2 adds validation: confirming that the outcome rendered data unrecoverable by the chosen method. In practice, this means agencies must require their ITAD vendors to provide per-device documentation specifying the sanitization method, the validation outcome, the serial number tied to the intake manifest, the technician, and the facility.

Summary batch certificates do not satisfy this standard. STS provides FISMA-formatted certificates of destruction structured for this evidence requirement on every engagement.

FAR 23.103 remains in the Code of Federal Regulations as of June 2026. Executive Order 14275 (April 2025) directed removal of FAR provisions not required by statute and authorized OMB to issue class deviation guidance. The resulting OMB memo (May 2025) allows agencies to omit FAR 52.223-23 from new solicitations. Contracts already containing FAR 52.223-23 remain fully binding through their period of performance.

The practical result: agencies with active ITAD contracts solicited after May 2024 and before the class deviation still have R2v3 certification as a contract requirement, while new solicitations are subject to agency-specific deviation decisions.

NAID AAA and R2v3 certifications address compliance requirements independent of FAR Part 23. FISMA requires all federal agencies to implement NIST 800-88 under NIST SP 800-53 MP-6 regardless of FAR status. CMMC 2.0 Level 2 (MP.L2-3.8.3) mandates it for defense contractors handling Controlled Unclassified Information. DFARS 252.204-7012 requires it for controlled technical information processing.

NAID AAA provides the third-party audit verification that these data security requirements have been met at the facility level. R2v3 verifies downstream materials handling independently. Neither certification is substituted by a procurement clause, and neither depends on FAR Part 23 remaining in force.

FISMA requires every federal agency operating information systems to implement NIST 800-88 under media protection control MP-6. CMMC 2.0 Level 2 and above requires defense contractors handling CUI to comply under MP.L2-3.8.3. DFARS 252.204-7012 contractors processing Controlled Technical Information must comply under NIST 800-171. State and local agencies receiving federal grants or operating under federal contracts are frequently subject to equivalent requirements through grant conditions.

Healthcare organizations managing ePHI requiring HIPAA-compliant hard drive destruction and financial services organizations under GLBA that also hold federal contracts operate under simultaneous requirements from both FISMA and their sector-specific regulations.

HIPAA Security Rule §164.310(d)(2)(i) requires regulated entities to implement written policies and procedures for the final disposition of ePHI and the hardware or electronic media on which it is stored. Though labeled "Addressable," this specification is not optional under HHS guidance. Organizations must implement it, document a reasonable alternative, or document why implementation is not appropriate. All disposal documentation must be retained for six years under 45 CFR §164.530(j)(2). NIST SP 800-88 Rev. 1 provides the HHS-referenced technical guidance for compliant media sanitization methods.

A point-in-time program schedules disposal events annually or semi-annually, leaving devices in storage between cycles with ePHI potentially accessible. A continuous program establishes recurring pickup schedules with serial-level documentation at every event, eliminating the zombie data accumulation window. The Business Associate Agreement is in place at vendor onboarding rather than renegotiated per event. Certificates of destruction are issued per device, per pickup, structured for six-year retention. Continuous programs satisfy the same HIPAA documentation requirements that point-in-time programs struggle to prove in OCR investigations.

Yes. Any ITAD vendor that receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate under HIPAA. Operating without a signed BAA is a potential HIPAA violation regardless of whether a subsequent breach occurs. The BAA must be in place before the vendor takes possession of any ePHI-bearing devices. Healthcare organizations should verify BAA execution capability during vendor selection, not after the first pickup is scheduled. STS executes BAAs as a standard step in program onboarding for all HIPAA-compliant hard drive destruction engagements.

Healthcare organizations should require NAID AAA certification from i-SIGMA, which independently verifies data destruction processes through unannounced audits. R2v3 certification from SERI verifies downstream recycling compliance. Vendors should also demonstrate NIST SP 800-88 Rev. 1 process alignment for sanitization method selection, though NIST 800-88 is a standard, not a vendor certification. BAA execution capability is mandatory before any ePHI-bearing hardware changes hands. Organizations using the education IT disposal sector standard of NAID AAA plus BAA are applying the same framework healthcare organizations should require.

Zombie data refers to ePHI that persists on retired devices that have not yet been destroyed. Common sources include cached EHR application data, PHI in the Windows credential store, diagnostic images in application cache directories, and patient identifiers in user profiles. Zombie data is forensically recoverable even on devices not in active use. Point-in-time disposal programs structurally create zombie data accumulation windows between scheduled events. A device retirement that occurs in February at a hospital using a June disposal schedule leaves ePHI accessible for up to four months, representing an uncontrolled breach risk and a potential HIPAA documentation gap.

The HHS NPRM published December 27, 2024, proposed mandatory technology asset inventories updated at least annually, compliance audits every 12 months, and the removal of the Required/Addressable distinction that currently allows organizations to document alternatives to disposal procedures. As of June 2026, the NPRM remains proposed and not final. The current HIPAA Security Rule continues to govern compliance requirements. Organizations that adopt continuous ITAD programs now will be operationally positioned for eventual finalization without requiring structural program changes, while also satisfying current Security Rule documentation requirements under certificate of destruction standards that OCR already enforces.