<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=1732033&amp;fmt=gif">
Skip to content
Contact us
All posts

Retiring Mobile Devices Under NIST SP 800-88 Rev. 2: A Checklist

  ISEC7 Editorial Team  ·  6 minute read

NIST published Revision 2 of SP 800-88, its guidelines for media sanitisation, on 26 September 2025. It replaces Rev. 1 from 2014 and no longer prescribes a technique for each type of device, mobile devices included. Instead it describes an organisation-wide programme: a defined method, a checked result and a certificate of sanitization for every device (NIST SP 800-88r2).

Replacing a fleet of company phones therefore starts with your own policy, followed by evidence that matches it. The checklist below covers both.

What changed in NIST SP 800-88 Rev. 2

Rev. 1 listed techniques per media type in tables, mobile devices included. Rev. 2 removed those appendices and points to IEEE 2883, NSA specifications or a standard the organisation approves itself. Cryptographic erase is the one technique the guideline still covers in its own text (Appendix D; NIST FAQ, 16 July 2026).

Two further changes affect day-to-day work:

  • No more multi-pass overwriting. Clear does not need the pass counts of the old DoD 5220.22-M pattern. On flash storage with spare cells and wear levelling, overwriting through the normal interface cannot reach every area anyway (section 3.1.1).
  • Verification and validation. First you check that the operation completed without errors, then you decide whether the result is good enough for the data. Sampling storage contents is only needed if your policy requires it (4.5).

Clear, purge and destroy

Clear protects against recovery through the normal interface, by overwriting or, where that is not supported, by a reset to factory state (3.1.1). Purge makes recovery infeasible even with state-of-the-art laboratory techniques and leaves the device usable. Where purge is possible, NIST recommends it over clear (3.1.2). Destroy renders the media unusable; Rev. 2 advises against shredding and pulverising for anything but the lowest security categories (3.1.3).

Is a factory reset enough for mobile devices under NIST 800-88 Rev. 2?

For clear, yes. Rev. 2 accepts a manufacturer reset as clear when the device does not support overwriting and its interface no longer returns the original data. Whether it also counts as purge depends on encryption.

On an iPhone, erasing is key destruction. Apple states that erasing "obliterates all the keys in effaceable storage and renders all user data cryptographically inaccessible" (Apple Platform Deployment). On Android, every device launching with Android 10 or later must use file-based encryption. According to the Android documentation, the keys are securely deleted only where the hardware supports rollback resistance; otherwise a best-effort fallback applies. In a mixed Android fleet, that makes the vendor question in step 7 more than a formality.

What cryptographic erase depends on

Cryptographic erase does not remove the data. It removes the keys the data was encrypted with, and Rev. 2 bases that key sanitisation on ISO/IEC 19790 zeroisation. Several conditions apply:

  • No sensitive data was ever stored on the device unencrypted (3.2.2).
  • The encryption has a security strength of at least 128 bits (3.2.1).
  • No copy of the keys exists outside the device, for example in a backup or key escrow (3.2.2).

For data that must stay confidential for decades, Rev. 2 notes that cryptographic erase may not be acceptable: future weaknesses in the algorithms, or quantum computing, could make the keys recoverable (3.2.2).

Checklist: retiring mobile devices in seven steps

  1. Inventory first. The device is recorded with manufacturer, model and serial number before it changes hands. Rev. 2 ties the value of a certificate to the records around it: when the device enters the environment, when it leaves its last place of use, and when it reaches its destination (4.6). Whoever audits that inventory needs to see it, not change it. Google's zero-touch portal for Android now has a Viewer role for exactly that: a read-only view that our webcast on Android 17 (in German) singled out for compliance documentation. In ISEC7 SPHERE, asset management and the administrative steps for offboarding sit in one place.
  2. Decide the route. Reuse in-house, resale, donation or recycling: the decision flow in Rev. 2 starts with that question. An iPhone that stays in your fleet can go through Return to Service, which erases it and re-enrols it in device management automatically. Since iOS 27, that erase command can also enforce software updates on supervised devices (Apple, 14 September 2026). In our German-language webcast on iOS 27 on 14 July 2026, Oliver Schiemann and Magnus Wonschik showed what the device keeps through the wipe. Until now, that was Wi-Fi only. iOS 27 adds language and region from the ADE profile, and if automatic enrolment fails, the device tries again. Whether a device is fit for reuse at all can be checked beforehand, because iOS 27 reports the condition and authenticity of the baseband, camera, Face ID or Touch ID, NFC and UWB in real time. The recording is free after registration.
  3. Take the method from your policy. The method follows from the confidentiality of the data, not from the device type (4.3). Mapping security categories to clear, purge or destroy belongs in your sanitisation policy (4.1).
  4. Include backups and keys. Backed-up or escrowed copies of data, credentials and keys need their own sanitisation policy (3.2.2).
  5. Verify, then validate. Check that the wipe command completed without errors, then decide whether the result is sufficient (4.5). Apple describes the device sending an acknowledgement to the management service and then performing the wipe. On our reading, the acknowledgement on its own does not prove the wipe has finished.
  6. One certificate per device. At a minimum (4.6): manufacturer, model, serial number, an internal asset number if you use one, media type, media source, method (clear, purge, destroy), technique such as cryptographic erase, tool and version, verification method, and the name, title, date, location, contact details and signature of the person who verified it. Appendix C has an updated sample form.
  7. Ask how the wipe works. NIST recommends asking vendors how a device implements its sanitize commands and which areas those commands do not reach (Appendix B). The answer helps you decide whether a reset counts as clear or purge under your policy.

Returns and offboarding: where retirement starts

Retirement starts with the return. A phone left in a drawer after someone leaves never appears on a certificate, which is why Rev. 2 asks for records at three points. A large device swap, during a UEM migration for instance, retires a whole generation of phones at once. How to make sure no device goes missing along the way was one of the questions in our webcast on MDM and UEM migration (in German, 14 October 2025). UEM Migration Without Downtime covers how ISEC7 SPHERE handles such swaps.

With ISEC7 Endpoint Lifecycle Management, we handle the return of hardware when employees leave the company. The subsequent device erasure and remarketing runs in four steps: device assessment and analysis, data erasure with protocols, reuse or recycling, and buyback. We agree the erasure method with you, including physical destruction of the storage media on request.

Enrolment and deployment of Apple and Android devices in a UEM are the subject of our one-day courses Apple Enterprise Mobility Fundamentals and Android Enterprise Fundamentals. The recordings on iOS 27, Android 17 and MDM migration are listed with all other sessions on our webcasts page.

Frequently asked questions

What is NIST SP 800-88 Rev. 2?

It is NIST's Guidelines for Media Sanitization, published on 26 September 2025. It replaces Rev. 1 from 2014 and describes how an organisation builds a sanitisation programme: a method chosen by confidentiality, a check of the result and a certificate for each device. For specific techniques it points to IEEE 2883, NSA specifications or a standard the organisation approves itself.

Is a factory reset enough under NIST 800-88 Rev. 2 for company phones?

As clear, yes. Rev. 2 accepts a manufacturer reset as clear when the device cannot be overwritten and its interface no longer returns the original data. It counts as purge only if the reset destroys the keys of encrypted storage and the conditions for cryptographic erase are met, for example that no copy of those keys exists outside the device.

What goes into a certificate of sanitization under NIST SP 800-88 Rev. 2?

Section 4.6 lists at least manufacturer, model, serial number, an internal asset number where one exists, media type and source, the method (clear, purge or destroy), the technique, the tool and its version, and the verification method. It also records the name, title and contact details of the person who verified the result, with date, location and signature. Appendix C contains a sample form.

Does Rev. 2 still require multiple overwrite passes?

No. Rev. 2 states that clear does not need multiple passes, which retires the obsolete pattern from DoD 5220.22-M. On flash storage with spare cells and wear levelling, which is what phones use, overwriting through the normal interface cannot reach every area where data was held in the first place.

Sources

  • NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025, published 26 September 2025: csrc.nist.gov · PDF
  • NIST, "Guidelines for Media Sanitization: NIST Publishes SP 800-88r2", 26 September 2025: nist.gov
  • NIST, Frequently Asked Questions for SP 800-88r2, 16 July 2026: PDF
  • Apple, Platform Deployment, "Erase Apple devices" and "Use Return to Service for Apple devices": support.apple.com · support.apple.com
  • Apple, What's new for enterprise in iOS 27, 14 September 2026: support.apple.com
  • Android Open Source Project, File-based encryption: source.android.com

ISEC7 resources

  • ISEC7 webcast "Apple und iOS 27: was für Unternehmen wichtig ist" (in German), 14 July 2026, Oliver Schiemann and Magnus Wonschik: isec7.com
  • ISEC7 webcast "What's new in Android 17 for Enterprise?" (in German), 11 June 2026, Oliver Schiemann and Magnus Wonschik: isec7.com
  • ISEC7 webcast on MDM and UEM migration (in German), 14 October 2025: isec7.com
  • ISEC7 blog, "UEM Migration Without Downtime: Automate, Monitor, Comply with ISEC7 SPHERE": blog.isec7.com
  • ISEC7, Endpoint Lifecycle Management: isec7.com
  • ISEC7, IT asset disposal: isec7.com
  • ISEC7, ISEC7 SPHERE: isec7.com