Data destruction standards in plain words

NIST SP 800-88 and CCCS ITSP.40.006 explained without the jargon, and the questions to ask before drives leave your building.

Talk with a Managing Partner Now

Guide for IT and security staff. 5 minute read.

Most data destruction policies name a standard. Two come up most often in Canada. Here is what each one is, what it asks for, and what to check before your drives leave the building.

NIST SP 800-88

This is the United States guideline for media sanitization, and it is the one most company policies name. Revision 2 was published in September 2025 and replaces Revision 1 from 2014. If your policy still says Revision 1, it is worth updating the reference.

The guideline describes three levels. Clear removes data so that ordinary tools cannot get it back. Purge removes it so that laboratory methods cannot get it back. Destroy makes the media itself unusable, for example by shredding. Which level you need depends on how sensitive the data is and whether the device will be reused.

CCCS ITSP.40.006

This is the Government of Canada's guidance on IT media sanitization, published by the Canadian Centre for Cyber Security. Federal departments follow it, and Canadian public tenders often name it.

It ties the method to the sensitivity of the information. For the more sensitive levels it sets out how small the pieces must be when media is physically destroyed, and those sizes are different for magnetic hard drives and for solid-state drives. It also notes that degaussing, which erases magnetic media, does not work on solid-state drives.

Wipe or shred?

	Wiping	Shredding
What happens	Data is overwritten or erased with certified software. The device survives.	The device is physically destroyed.
Good for	Equipment with resale or reuse value	Failed drives, high-sensitivity data, anything that must not be reused
Proof	An erasure record for each serial number	A certificate of destruction, with serial numbers when recorded
Watch for	Drives that fail the wipe must be shredded	Ask what size the pieces are if your policy sets one

Questions to ask before drives leave your building

Which standard and which level does our policy require for this data?

Will each drive's serial number be recorded, and will we get the list back?

Is the default wiping or shredding, and who decides?

What happens to a drive that fails the wipe?

If our policy sets a particle size, can the company confirm it in writing?

Where is the work done, and is that facility certified for data sanitization?

What document closes the job, and what does it state?

How EDI fits

Data sanitization, both wiping and physical destruction, is inside the scope of our Orillia facility's R2v3 certificate. Tell us the standard your policy names and we will confirm in writing how your media will be handled. See data destruction.

Based on NIST Special Publication 800-88 Revision 2 (September 2025) and CCCS ITSP.40.006 v2, IT Media Sanitization.

General information, not legal advice. Check the current text of the rules, or ask your own advisor, before you rely on it.