Comparisons · 4 min read · Updated 6 November 2026
Data erasure standards compared: NIST 800-88, HMG IS5, DoD and more
Why there are so many standards
Quotes and certificates from IT disposal providers often list several standards, which can make it hard to compare them. Some are current, some are historical, and some cover physical destruction rather than software erasure. Knowing what each one means helps you set a sensible requirement in your own policy and check whether a provider is quoting something meaningful.
It also helps to separate two questions that often get mixed up. The first is what method was used on each drive, which is what NIST, IEEE and DIN 66399 describe. The second is whether the company doing the work runs a secure, audited process, from collection and transport to storage and reporting, which is what schemes such as the ADISA standard assess. A good provider should be able to answer both.
The main standards at a glance
| Standard | What it covers | Status |
|---|---|---|
| NIST SP 800-88 | Media sanitisation levels: clear, purge, destroy | Current US reference, widely used in the UK |
| IEEE 2883 | Technical sanitisation methods for modern storage | Current, referenced by the latest NIST revision |
| HMG IS5 | UK government overwrite methods | Withdrawn, still quoted by some providers |
| DoD 5220.22-M | Three-pass overwrite method | Outdated for modern drives |
| DIN 66399 | Particle size and security levels for shredding | Current, used for physical destruction |
| ADISA standard | Audited process for IT asset disposal companies | Current UK industry certification |
| ISO/IEC 27040 | Storage security including sanitisation | Current international standard |
NIST 800-88: clear, purge, destroy
NIST SP 800-88 groups methods into three levels. Clear uses standard read and write commands, such as overwriting, to protect against simple recovery tools. Purge uses methods that defeat laboratory recovery, such as firmware sanitise commands, cryptographic erase or degaussing of magnetic media. Destroy makes the media unusable and unrecoverable, for example by shredding or disintegration.
A revision published in 2025 moved much of the technique detail to IEEE 2883 and focused more on programme management and verification. Many providers still quote the earlier version, which is fine as long as the method suits the media.
HMG IS5 and DoD: the legacy names
HMG Infosec Standard 5 described baseline and enhanced overwrite methods for UK government use. It has been withdrawn and replaced by National Cyber Security Centre guidance on secure sanitisation, which takes a risk-based approach. DoD 5220.22-M described a three-pass overwrite. Both were written for older hard drives.
Seeing these names on a certificate is not a problem in itself, but they say nothing useful about SSDs, where overwriting is unreliable. Ask what method is used for flash storage.
DIN 66399 for shredding
DIN 66399 is a German standard used across Europe that sets security levels for physical destruction by media type, including H for hard drives and E for electronic media such as SSDs. Higher numbers mean smaller particles and higher security. Ask any shredding provider which level their machine achieves for each media type, as a shredder that meets a high level for hard drives may leave SSD chips intact.
Shredding certificates should also state the level achieved and list the serial numbers of the drives destroyed, so they can be matched to your records in the same way as erasure reports.
Reading an erasure certificate
Whatever standard is quoted, the certificate or report is what you will rely on later. A useful one includes enough detail to link each drive back to your records.
| Field | What to look for |
|---|---|
| Device and drive serial numbers | Both, so drives can be matched to the machine |
| Drive type | Hard drive, SATA SSD, NVMe or other |
| Method used | For example overwrite, crypto erase or shredding |
| Standard referenced | A current reference such as NIST SP 800-88 |
| Verification result | Passed or failed, not just completed |
| Date and location | When and where the work was done |
| Operator or system ID | Who or what carried it out |
If a certificate lists only a total number of devices, or a standard with no method or result, ask for the detailed per-device report behind it.
What to put in your own policy
- Name a current reference such as NIST SP 800-88 or NCSC guidance rather than a withdrawn one
- Set different methods for hard drives, SSDs, phones and other flash media
- Require verification of every erasure and a report per serial number
- Set a destruction level, such as a DIN 66399 class, for drives that fail erasure
- Ask for evidence of independent audit or certification of the provider's process
Frequently asked questions
Which erasure standard should a UK business ask for?
For most organisations, asking for erasure in line with NIST SP 800-88, using purge methods for SSDs and verified overwriting or purge for hard drives, with a certificate per device, is a sound baseline. Public sector and higher-risk organisations should also check current NCSC guidance and any sector-specific rules, such as those in health or financial services.
Is HMG IS5 still valid?
It has been withdrawn as a UK government standard, though you will still see it on certificates and quotes. It is not wrong to use the methods, but it is not a current requirement and it does not deal well with SSDs. A provider quoting only IS5 should be asked how it handles flash storage.
Does a standard on the certificate prove the data is gone?
Not by itself. What matters is that the correct method was used for that type of media, that the result was verified, and that the certificate lists the serial number, method, date and outcome. Independent audits of the provider's process, such as an industry certification, give extra confidence that what is on the certificate actually happened.
NIST 800-88 erasure standards ADISA DIN 66399
Related services
We cover 250 towns and cities, including Cambridge, Peterborough, Bristol, Bath, Birmingham, Coventry.
