If you have reviewed an IT asset disposition (ITAD) contract in the last decade, you have probably seen the phrase "wiped to DoD 5220.22-M." It sounds rigorous, and it is still common in purchase orders and security questionnaires. But in 2026 it is the wrong thing to ask for on its own. The standard that actually governs modern media sanitization is NIST Special Publication 800-88, Guidelines for Media Sanitization, and it was substantially revised in 2025.

This article explains the difference, what changed in the new revision, how it applies to SSDs, and what to write into your vendor agreements.

Where "DoD 5220.22-M" came from

DoD 5220.22-M is the National Industrial Security Program Operating Manual (NISPOM), a Department of Defense manual for contractors handling classified information. Older editions included a clearing and sanitization matrix, and the multi-pass overwrite pattern that the industry nicknamed the "DoD wipe" traces back to that era.

Two facts matter today:

• According to NIST SP 800-88 Rev. 2, DoD removed overwriting specifications from the NISPOM in 2006.
• The NISPOM itself is now a federal rule, 32 CFR Part 117, which took effect on February 24, 2021 and replaced the DoD 5220.22-M manual.

In other words, the "DoD 3-pass" pattern is not a current DoD requirement. It survives mainly as a software menu option and as contract boilerplate.

What NIST SP 800-88 Rev. 2 changed

NIST published SP 800-88 Revision 2 in September 2025, superseding Revision 1 from December 2014. The most important changes for buyers of ITAD services are:

• A program, not a cookbook. The focus shifted from hands-on technique tables to establishing an enterprise media sanitization program as part of media reuse and disposal.
• Technique details moved to IEEE 2883. Except for cryptographic erase, technology-specific techniques are out of scope. Rev. 2 points readers to the latest version of IEEE 2883 (or NSA/CSS specifications, or an organizationally approved standard). The old media-specific appendices were removed.
• Purge is preferred. Rev. 2 states that, when possible, the purge method should be used instead of clear.
• Multi-pass overwrite is not needed. The change log says the clear method was clarified so that multi-pass overwrite is not required, explicitly countering the obsolete DoD 5220.22-M pass-and-pattern language.
• Degaussing is narrowed. Degaussing is not an approved destroy technique, even when it leaves a drive inoperable, and it should never be used on flash media such as SSDs.
• Documentation stays central. A certificate of sanitization should be completed for each piece of media, recording details such as manufacturer, model, serial number, method, technique, tool and version, verification method, and the person responsible.

Clear, Purge, Destroy in plain terms

One nuance worth knowing: Rev. 2 notes that bending, cutting or drilling a hole may only partly damage a device, and that pulverizing and shredding of storage media should be avoided for anything but the lowest security categories as data density increases. "Destroyed" means recovery is infeasible, not just that the drive no longer spins up.

Why overwrite patterns fail on SSDs

Solid-state drives use wear leveling, spare cells and overprovisioning. The operating system cannot address every physical location where data has been written, so overwriting the visible capacity, once or seven times, can leave user data behind. Rev. 2 says this directly: for media such as SSDs with overprovisioning, multi-pass overwrite practices provide very little confidentiality protection.

The correct approach for flash media is a purge technique that uses the drive's own standardized sanitize commands (block erase, cryptographic erase, or sanitize overwrite, as appropriate for the device and as described in IEEE 2883), followed by verification. When a drive does not support those commands, has failed, or does not pass verification, physical destruction is the fallback.

What to put in your contract

Replace "DoD 5220.22-M wipe" with language that describes outcomes and evidence:

1. Standard: "All storage media shall be sanitized in accordance with NIST SP 800-88 Rev. 2, using the purge method where the media supports it. Techniques shall follow the current version of IEEE 2883 or an equivalent standard approved by the Client."
2. Fallback: "Media that cannot be purged or that fails verification shall be physically destroyed so that data recovery is infeasible."
3. Tooling: "The vendor shall identify the sanitization software and version used."
4. Evidence: "The vendor shall provide a certificate for each device, listing manufacturer, model, serial number, method (clear, purge or destroy), technique, tool and version, verification result, date, and responsible technician."
5. Custody: "Assets shall be tracked by serial number from pickup to final disposition, with a documented chain of custody."
6. Exceptions: "The vendor shall report any device whose serial number does not match the client inventory or that could not be processed."

If a legacy policy, customer contract or auditor still requires DoD 5220.22-M, you can satisfy both: specify NIST SP 800-88 as the governing standard and allow DoD-pattern overwrite only as an additional, optional pass on magnetic hard drives. Never accept it as the only control for SSDs.

Questions to ask any ITAD vendor

• Which erasure software do you use, and does it issue firmware-level sanitize commands on SSDs and NVMe drives?
• What happens to a drive that fails erasure?
• Do certificates list each serial number, or only a total count?
• Can I access reports myself, or do I have to request them?

How AVM handles it

At Asset Value Management Services (AVM), drives are erased with WipeOS certified erasure following NIST SP 800-88, with DoD 5220.22-M available when a client's policy calls for it. Any drive that cannot be erased is physically destroyed. Every device is audited at the serial level, tracked through chain of custody, and documented with a certificate of destruction per serial number, available in a private client portal.

If you are updating a policy or preparing an RFP and want to see what compliant documentation looks like in practice, you are welcome to request a quote. Our Houston team at 4647 Pine Timbers St. can walk you through the process; call 713-869-0200 or use the quote form.