Certified Media Sanitization

Media sanitization services that meet NIST SP 800-88 Standard and support regulatory compliance standards. We help organizations determine when Clear, Purge, or Destroy methods need be used, how to perform sanitization techniques properly, and how to verify sanitization success with documented results that support audits, operational efficiency, governance, secure reuse, and sustainability goals.

Schedule a Consultation Back to Services

Our Standard Process

Professional and secure Media Sanitization Services that follow industry best standards & compliance.

1. Contact

Schedule a Pickup or Consultation

2. Assessment

Professional evaluation & scope

3. Service

Secure Processing & Disposition

4. Documentation

Certificates & Compliance Reporting

About our Media Sanitization Services

CAS provides certified media sanitization services to NIST 800-88 standard and can even offer guidance to organizations on implementing a Media Sanitization Program including classification and decision matrix workflows emphasized in the IEEE 2883 standard, as referenced in the recently published NIST SP 800-88 Rev.2 Standard. We focus on selecting the proper sanitization technique by risk classification, media type, and interface type that mitigates risk while enabling potential reuse oppurtunities (invernal vs external reuse scoping & risk analysis) that support extending the lifetime of your organization's technology infrastructure investments.

Sanitization Outcomes: Clear, Purge, or Destroy

  • Clear: logical techniques intended to protect against simple non-invasive recovery methods (often used for many endpoint scenarios).
  • Purge: stronger techniques intended to protect against more advanced recovery methods; includes modern device sanitize pathways where supported.
  • Destroy: NIST defined destroy guidance by storage type as identified, when required by your policy, risk assessment scope, device constraints, or when Clear & Purge is not successful or known to not be feasible.
  • We are transparent with our clients about the physical destruction techniques that meet NIST Destroy Standard or not for varying storage media type or device type.

Purge Workflows (Including Cryptographic Erase)

For compatible and qualifying devices & storage media, CAS offers NIST Purge workflows that can include device sanitize commands, sanitize block erase, sanitize overwrite, and Cryptographic Erase (CE) when encryption is properly implemented and key sanitization makes recovery infeasible. We also utilize TCG specifications and Vendor-Specific operations for Purge Sanitization compatibility and execution. CE can be an efficient pathway for modern storage when supported by device architecture and when your organization’s requirements allow it.

What types of Storage Media does CAS Handle?

  • Hard Drives: HDD, SSD, SED (self-encrypting drives), & other storage media (ATA/SCSI/NVMe) found compute endpoints
  • Other Magnetic Media: Floppy Disk, Flexible & Rigid Magnetic Disc, and Tape Media
  • Hard Copy: Paper, microforms, printer & facsimile ribbons, drums and platens
  • Optical Media: CD, DVD, Blu-ray, and other read-only access / read-write access Media
  • USB Removable Media: Flash Drives, Memory Sticks, Thumb Drives, & any other SSD device that uses SCSI command host interface
  • Memory Cards: SD cards, MMC, Compact Flash, MicroDrive etc
  • Embedded flash on boards and storage devices: Motherboards and Peripheral Cards (Network adapters or any other adapter containing nonvolatile flash memory)
  • RAM and ROM based storage devices: Such as DRAM, EAPROM, EEPROM
  • Storage Devices with Embedded Storage: Networking Devices, Office Equipment, and Devices with built in storage
  • Servers & rack equipment: Containing compute and networking internal storage components
  • Mobile Devices: smartphones, tablets and cell phones

Network Equipment and Embedded Storage Handling

  • For many network endpoints, Purge is not typically feasible due to architecture and storage constraints.
  • We commonly scope those assets for NIST Clear (when appropriate) or route to Destroy based on organizational requirements.
  • We document the selected method and final outcome so security and governance teams have an unambiguous record.

Verification, Exception Reporting, and Documentation

  • Outcome records for Clear/Purge/Destroy decisions by media type and device class
  • Exception reporting when media cannot be sanitized as scoped (with escalation to alternate method)
  • Certificates of Media Sanitization and final disposition documentation for applicable equipment and storage devices
  • Chain-of-custody handling practices designed to reduce breach-risk and support vendor oversight

Staying Ahead of Storage Technology and Long-Horizon Risk

  • We stay current with storage capabilities across HDD/SSD/NVMe and select techniques consistent with device behavior.
  • When considering cryptographic erase, if your data classification assumes sensitivity that must remain protected beyond 10 years from the present, we reccomend many organizations choose Destroy (or a different purge sanitization method) as a forward-looking risk posture as computing capabilities evolve.
  • We scope sanitization method selection by device class so mixed loads get consistent outcomes, and select sanitization technique by command interface and/or device compatibility.

How Media Sanitization Services Differ From Data Destruction Services at CAS

  • Media Sanitization includes successfully sanitizing qualifying media (Clear or Purge), with documented outcomes so devices can be reused (internally or externally) when appropriate. Media not qualified or failing clear / purge sanitization is subject to Destroy sanitization which uses state of the art techniques to physically destroy the media.
  • Data Destruction Physical Destruction of devices with storage media or removed storage media designed for irreversible disposition when reuse is not simply not allowed or risk posture requires it.
  • At CAS our Media Sanitization Services are typically used when an organization desires documented outcomes that report all storage media types found throughout different device categories. We focus on using vendor techniques and compatible sanitization techniques by command interface that can offer additional verification workflows after the data destrcution / media sanitization process.
  • When Purge Sanitization is feasible & successful, CAS utilizes the most current sanitization techniques and commands by storage device type that will truly support stronger circularity outcomes resulting from extending device lifetime (inside or outside the organization), while maintaining defensible security handling.
  • CAS helps organizations utilize new technology and tools that enable secure lifetime extending of devices and equipment that can also result in improved sustainability metrics that support the circular economy. CAS will always prioritize your organization's data security policies and regulatory compliance above any sustainability or reuse initiatives. Our sustainability counting require attatched, verified sanitization documentation for sensitive data bearing equipment, as CAS only supports secure reuse outcomes.

Need reuse/circularity outcome reporting and landfill diversion metrics for sanitized assets? See Sustainability Tracking.

Frequently Asked Questions

What’s the difference between NIST 800-88 Clear, Purge, and Destroy?

Clear uses logical techniques intended to protect against basic recovery attempts. Purge uses stronger methods intended to protect against more advanced recovery techniques (often including device sanitize commands or cryptographic erase when supported). Destroy is physical destruction used when required by policy, risk posture, or when Clear/Purge is not feasible for the device or media type.

When is Purge feasible for SSD and NVMe devices?

Purge feasibility depends on the device family and supported commands/features. For many modern SSD/NVMe devices, Purge may be achievable using vendor-supported sanitize commands, approved block erase pathways, or cryptographic erase when encryption is correctly implemented and key sanitization meets your requirements.

What is cryptographic erase, and why do organizations use it?

Cryptographic erase (CE) is a sanitization approach that makes data unrecoverable by sanitizing the encryption key(s) protecting the data. When supported and properly implemented, CE can be an efficient Purge pathway that can help preserve qualifying media for reuse while maintaining a defensible security outcome.

When should we choose Destroy instead of cryptographic erase?

If your data classification assumes sensitivity that must remain protected for a long time horizon (often 10+ years), many organizations choose Destroy (or another conservative method) as a forward-looking posture as computing capabilities evolve. We can help scope method selection based on your risk model, retention expectations, and the device class.

Do you provide Certificates of Media Sanitization and exception reporting?

Yes. We provide documentation outputs aligned to your scope, which commonly include outcome records, exception reporting (when media cannot be sanitized as scoped), and final disposition documentation where applicable. This supports audit readiness, vendor oversight, and internal governance.

What media types do you sanitize?
  • HDD and SSD (ATA)
  • Enterprise storage (SCSI / SAS)
  • NVMe SSD
  • USB removable media and memory cards
  • Embedded flash on boards/modules and storage components
  • RAM and ROM-based storage (handled per device class and organizational requirements)
Can you Purge network equipment or embedded storage in endpoints?

For many network endpoints, Purge is not typically feasible due to architecture and storage constraints. In those cases we commonly scope assets for NIST Clear (when appropriate) or route to Destroy based on your requirements, and we document the outcome so it’s unambiguous for security and governance teams.

What happens if a drive fails sanitization?

If media cannot be sanitized as scoped (e.g., device faults, command restrictions, security state limitations, or failed verification), we document the exception and escalate to the next approved method (often Destroy) based on your scope and policy requirements.

How should we prepare media before pickup?

Stage media in a secure area, separate higher-sensitivity items if needed, and share any special access requirements or timing constraints. If you maintain internal asset tags or serial lists, those can be included to improve reconciliation and reporting.

Ready to schedule?

We’ll help you sanitize media with modern Purge options and documentation that holds up internally.

Schedule a Pickup Explore Services