NIST Media Sanitization Guidance Raises Equipment-Compatibility Checks for Federal Buyers

The revised NIST Special Publication 800-88 Revision 2 underscores an important procurement and data-security distinction: making a storage device inoperable does not necessarily mean its information has been successfully sanitized. As magnetic recording technology advances, some existing degaussers may not provide sufficient magnetic force to remove data from newer, higher-coercivity media. A drive can therefore be damaged so it cannot operate normally while information remains on the device. This creates a risk for federal agencies, defense contractors, and information technology asset disposition (ITAD) providers managing retired storage equipment.

The guidance is relevant to equipment selection, disposition procedures, and contract requirements. NIST identifies properly matched degaussing as a purge sanitization technique for magnetic media, but does not classify degaussing as an approved destroy technique. Buyers and asset managers should consequently avoid treating a device’s failure to operate as proof that it has been sanitized or destroyed to the required standard. Where applicable requirements call for destruction, physical destruction may be necessary; devices intended for resale or redeployment may instead require an appropriate wiping process.

Media Duplication Systems, a Delaware supplier of data sanitization equipment that has supplied degaussing, drive-erasure, and destruction equipment since 1992, issued purchasing guidance in response to the revised standard. It advises government and defense organizations to assess three separate considerations: technical compatibility with the storage media, applicable National Security Agency/Central Security Service (NSA/CSS) evaluation status, and federal procurement eligibility. These are separate checks: satisfying one does not establish that a product meets the others. For covered purchases, buyers should also verify Trade Agreements Act (TAA) eligibility, as applicable.

The procurement implication is that a single equipment solution may not serve every asset or disposition outcome in a mixed inventory. NIST points organizations to IEEE 2883 and relevant NSA/CSS requirements for additional technical guidance. The NSA/CSS Evaluated Products List identifies magnetic degaussers that have met requirements for specified storage media; evaluated status should be checked against the particular media and use case rather than treated as a blanket approval for every device. Michelle Boyce, vice president of marketing at Media Duplication Systems, described the operational mix: “Government and ITAD customers can be dealing with several different outcomes in the same project. They may need a degausser for magnetic media, a shredder for drives that have to be destroyed and a wiping system for assets they plan to resell or redeploy.” For acquisition teams, this points to clearer requirements, compatibility verification, and documented disposition paths before equipment is selected or services are bought.

• NIST SP 800-88 Rev. 2 distinguishes a drive being rendered inoperable from the data being successfully sanitized.
• Newer, higher-coercivity magnetic media may exceed the capabilities of some existing degaussers.
• Properly matched degaussing is a purge technique for magnetic media; NIST does not classify it as an approved destroy technique.
• Buyers should confirm that sanitization equipment is compatible with the specific storage media in their inventories.
• Check the NSA/CSS Evaluated Products List for applicable degausser evaluation status and specified media; do not assume the status covers all devices.
• For covered purchases, verify TAA eligibility separately from technical suitability and NSA/CSS evaluation status.
• NIST points organizations to IEEE 2883 and relevant NSA/CSS requirements for additional technical guidance.
• Mixed disposition projects may need degaussing for magnetic media, shredding where physical destruction is required, and wiping for resale or redeployment.
• Procurement documents and contractor procedures should define distinct sanitization and destruction outcomes and require evidence appropriate to each.