Every ITAD vendor will tell you they follow NIST 800-88. It appears on their websites, certificates of destruction, sales decks. It has become table stakes — the minimum credibility signal to be taken seriously by an IT security team or procurement officer.

The problem is that NIST 800-88 compliance is not binary. It exists on a spectrum — from genuinely rigorous implementation to a marketing claim applied to a process that has never been formally audited or stress-mapped against the standard’s actual requirements.

Most enterprise buyers cannot tell the difference.

NIST 800-88 defines three tiers: Clear, Purge, and Destroy. Each maps to different risk levels, media types, and verification requirements. Purging a modern NVMe SSD is not the same as purging a spinning drive. What many vendors don’t acknowledge is that correct application demands documented methodology for every device class, verified tooling that reaches every storage address, and chain-of-custody controls from device pickup to certificate issuance.

Compliance breaks down at scale and at the edges. The flagship facility may be fully compliant — but what happens when volume spikes and processing capacity is stretched? What happens when device types fall outside standard tooling coverage and no escalation path exists? These are not edge cases. They are the norm for any enterprise running large-scale IT refresh cycles.

The hard question is not whether your vendor cites NIST 800-88. It’s whether they can demonstrate — for any given asset — the specific method applied, the tool used, the verification logged, and the person accountable. That level of documentation either doesn’t exist or isn’t accessible. That gap is where your data risk lives.

A vendor serious about NIST 800-88 has a documented taxonomy of every media type it processes and a defined method for each. Not a generic reference to the standard — a written policy specifying: for this device class, this method is applied; for this media type, this verification step is logged; for this failure condition, this escalation path is followed. If a vendor cannot produce that document, the compliance claim is aspirational.

Sanitization software must reach every addressable storage location — including Host Protected Areas, Device Configuration Overlays, and remapped sectors that standard formatting leaves untouched. For modern SSDs and NVMe devices, this is technically non-trivial. Vendors should be able to name the tools applied, their version, and explain how edge cases are handled. “Industry-standard software” is not an answer.

A certificate of destruction should be device-level, method-specific, tool-verified, and tied to a named custodian. Anything less is documentation theater. Vendors who can’t meet that standard will call it excessive. Vendors who can will have it ready.

DRM Worldwide builds its sanitization process to withstand exactly this level of scrutiny — because for the organizations we serve, data security is not a line item. It is a liability. And liabilities require proof, not promises.