Ocoee Government Electronics Recycling

Published September 26, 2025, NIST SP 800-88 Rev. 2 is the federal standard for media sanitization, superseding Rev. 1 (December 2014) in its entirety. The fundamental Clear, Purge, and Destroy framework is unchanged.

What changed is how organizations must achieve and document those levels: Rev. 1 provided detailed technique tables for specific media types; Rev. 2 removes those tables entirely and requires organizations to build formal sanitization programs that reference IEEE 2883-2022 or NSA specifications for technique selection. Rev. 2 also adds a validation requirement, confirming sanitization outcomes per device, and addresses cloud and virtualized environments that Rev. 1 did not cover.

"Withdrawn" is NIST's formal designation for a publication that has been superseded and is no longer the controlling guidance. As of September 26, 2025, Rev. 1 is archived at NIST with a notice marking it withdrawn and superseded by Rev. 2. Federal agencies whose security authorization packages, System Security Plans, or ITAD vendor contracts still cite Rev. 1 as the governing media sanitization standard are referencing a document NIST no longer recognizes as current.

This creates gaps in CMMC 2.0 media protection documentation and may generate IG findings during FISMA annual authorization reviews even when the physical sanitization performed was technically adequate.

Rev. 2 establishes a formal two-part evidence standard. Verification, confirming the sanitization method was applied, was the primary requirement under Rev. 1. Rev. 2 adds validation: confirming that the outcome rendered data unrecoverable by the chosen method. In practice, this means agencies must require their ITAD vendors to provide per-device documentation specifying the sanitization method, the validation outcome, the serial number tied to the intake manifest, the technician, and the facility.

Summary batch certificates do not satisfy this standard. STS provides FISMA-formatted certificates of destruction structured for this evidence requirement on every engagement.

FAR 23.103 remains in the Code of Federal Regulations as of June 2026. Executive Order 14275 (April 2025) directed removal of FAR provisions not required by statute and authorized OMB to issue class deviation guidance. The resulting OMB memo (May 2025) allows agencies to omit FAR 52.223-23 from new solicitations. Contracts already containing FAR 52.223-23 remain fully binding through their period of performance.

The practical result: agencies with active ITAD contracts solicited after May 2024 and before the class deviation still have R2v3 certification as a contract requirement, while new solicitations are subject to agency-specific deviation decisions.

NAID AAA and R2v3 certifications address compliance requirements independent of FAR Part 23. FISMA requires all federal agencies to implement NIST 800-88 under NIST SP 800-53 MP-6 regardless of FAR status. CMMC 2.0 Level 2 (MP.L2-3.8.3) mandates it for defense contractors handling Controlled Unclassified Information. DFARS 252.204-7012 requires it for controlled technical information processing.

NAID AAA provides the third-party audit verification that these data security requirements have been met at the facility level. R2v3 verifies downstream materials handling independently. Neither certification is substituted by a procurement clause, and neither depends on FAR Part 23 remaining in force.

FISMA requires every federal agency operating information systems to implement NIST 800-88 under media protection control MP-6. CMMC 2.0 Level 2 and above requires defense contractors handling CUI to comply under MP.L2-3.8.3. DFARS 252.204-7012 contractors processing Controlled Technical Information must comply under NIST 800-171. State and local agencies receiving federal grants or operating under federal contracts are frequently subject to equivalent requirements through grant conditions.

Healthcare organizations managing ePHI requiring HIPAA-compliant hard drive destruction and financial services organizations under GLBA that also hold federal contracts operate under simultaneous requirements from both FISMA and their sector-specific regulations.

HIPAA Security Rule §164.310(d)(2)(i) requires regulated entities to implement written policies and procedures for the final disposition of ePHI and the hardware or electronic media on which it is stored. Though labeled "Addressable," this specification is not optional under HHS guidance. Organizations must implement it, document a reasonable alternative, or document why implementation is not appropriate. All disposal documentation must be retained for six years under 45 CFR §164.530(j)(2). NIST SP 800-88 Rev. 1 provides the HHS-referenced technical guidance for compliant media sanitization methods.

A point-in-time program schedules disposal events annually or semi-annually, leaving devices in storage between cycles with ePHI potentially accessible. A continuous program establishes recurring pickup schedules with serial-level documentation at every event, eliminating the zombie data accumulation window. The Business Associate Agreement is in place at vendor onboarding rather than renegotiated per event. Certificates of destruction are issued per device, per pickup, structured for six-year retention. Continuous programs satisfy the same HIPAA documentation requirements that point-in-time programs struggle to prove in OCR investigations.

Yes. Any ITAD vendor that receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate under HIPAA. Operating without a signed BAA is a potential HIPAA violation regardless of whether a subsequent breach occurs. The BAA must be in place before the vendor takes possession of any ePHI-bearing devices. Healthcare organizations should verify BAA execution capability during vendor selection, not after the first pickup is scheduled. STS executes BAAs as a standard step in program onboarding for all HIPAA-compliant hard drive destruction engagements.

Healthcare organizations should require NAID AAA certification from i-SIGMA, which independently verifies data destruction processes through unannounced audits. R2v3 certification from SERI verifies downstream recycling compliance. Vendors should also demonstrate NIST SP 800-88 Rev. 1 process alignment for sanitization method selection, though NIST 800-88 is a standard, not a vendor certification. BAA execution capability is mandatory before any ePHI-bearing hardware changes hands. Organizations using the education IT disposal sector standard of NAID AAA plus BAA are applying the same framework healthcare organizations should require.

Zombie data refers to ePHI that persists on retired devices that have not yet been destroyed. Common sources include cached EHR application data, PHI in the Windows credential store, diagnostic images in application cache directories, and patient identifiers in user profiles. Zombie data is forensically recoverable even on devices not in active use. Point-in-time disposal programs structurally create zombie data accumulation windows between scheduled events. A device retirement that occurs in February at a hospital using a June disposal schedule leaves ePHI accessible for up to four months, representing an uncontrolled breach risk and a potential HIPAA documentation gap.

The HHS NPRM published December 27, 2024, proposed mandatory technology asset inventories updated at least annually, compliance audits every 12 months, and the removal of the Required/Addressable distinction that currently allows organizations to document alternatives to disposal procedures. As of June 2026, the NPRM remains proposed and not final. The current HIPAA Security Rule continues to govern compliance requirements. Organizations that adopt continuous ITAD programs now will be operationally positioned for eventual finalization without requiring structural program changes, while also satisfying current Security Rule documentation requirements under certificate of destruction standards that OCR already enforces.

K-12 ITAD (IT Asset Disposition) is the certified process of destroying student data and recycling school devices under FERPA, COPPA, and NIST SP 800-88 Rev. 2. In 2026, it matters for cybersecurity because vendor-related incidents now account for 32 percent of all K-12 breaches, per Clever’s Cybersecure 2026 Report. Improperly retired hardware containing student PII is an active vendor risk exposure. A factory reset leaves no documentation trail and does not eliminate data from over-provisioned storage regions in AI-enabled solid-state devices. Certified ITAD with serial-level documentation closes this gap and creates an auditable compliance record before hardware leaves district custody.

Per court documents filed in May 2025, the PowerSchool breach compromised approximately 62 million student and 9.5 million educator records through a single compromised credential at a vendor support portal. It demonstrated that vendor access to student data, even through support systems rather than core infrastructure, creates catastrophic exposure. For ITAD, the lesson is identical: any vendor that touches physical hardware containing student PII must be independently audited, not self-certified. NAID AAA certification from i-SIGMA provides the unannounced facility inspection standard that self-certification cannot replicate. Confirm your NAID AAA certified data destruction vendor’s active certification status before every engagement.

State AI privacy laws introduced in 2026, including California AB 1159 and Idaho SB 1227, extend student data protection obligations to device end-of-life. California’s proposed law would prohibit student data from being used to train AI models and requires documentation of data elimination from third-party operators through the full device lifecycle. Idaho’s enacted law mandates data privacy requirements for AI tools used in schools, including retirement handling.

Districts in these states need ITAD documentation that explicitly addresses AI interaction data categories, not just the FERPA-standard education records that existing certificates of destruction reference. Vermont HB 650 would further require EdTech vendors to annually certify privacy compliance, extending accountability to ITAD providers.

NAID AAA certification from i-SIGMA independently verifies that an ITAD vendor’s data destruction processes, personnel, and equipment meet audited security standards. Unlike vendor self-assessments, NAID AAA requires unannounced facility inspections, background-checked destruction technicians, and documented equipment compliance for each destruction method the vendor uses.

For K-12 districts managing FERPA liability, NAID AAA transforms the ITAD engagement from a vendor claim into a defensible, auditable compliance event. It is the same standard specified in federal procurement contracts and the minimum independent verification that post-PowerSchool vendor risk management requires for any vendor handling student PII, whether disposing standard endpoints or AI server-class hardware from K-12 classroom and media center configurations.

Under FERPA (20 U.S.C. §1232g) and its implementing regulations at 34 CFR Part 99, school districts are responsible for protecting student education records through the full device lifecycle, including destruction at end of life. The U.S. Department of Education’s Student Privacy Policy Office identifies hardware retirement as a covered student data protection obligation. In practice, this means per-device serialized certificates of destruction that can be cross-referenced against district asset manifests and presented to state privacy officers and school board auditors.

STS provides FERPA-formatted certificates of destruction structured for annual district compliance records and state review. Healthcare data accessed on district devices, including school nurse and counselor systems, may also trigger HIPAA obligations covered under healthcare IT disposal requirements, demanding the same dual-framework documentation standard.

Certified ITAD is the end-of-lifecycle control in a district’s layered cybersecurity strategy. Where network security addresses active threats and access controls limit unauthorized entry, ITAD eliminates the residual student data that remains on hardware after it leaves active service. In 2026, where vendor-related incidents account for 32 percent of all K-12 breaches, every unretired device with student PII is a potential disclosure event.

A district can have robust network security and still create FERPA exposure through improperly documented hardware retirement. For K-12 education IT disposal programs, NAID AAA certified destruction with serialized documentation is the closing control that completes the student data protection cycle from enrollment through device decommissioning.