What NIST 800-88 is, and why it matters in India
NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization, is the reference document for destroying data on storage media. It is not Indian law, and no Indian regulator cites it directly. It matters here for three practical reasons:
- It is the international shorthand. Customer security questionnaires, ISO 27001 certification bodies, bank vendor due-diligence forms and government tender documents all reference "NIST 800-88 sanitisation" far more often than they reference any other standard.
- It is the framework behind the NSA list. The NSA's Evaluated Products List for degaussers exists to verify that equipment achieves the purge or destroy level NIST describes.
- It gives you a vocabulary. When your policy says "clear", "purge" or "destroy", everyone in the room knows which level of assurance is meant.
The three levels
| Attribute | Clear | Purge | Destroy |
|---|---|---|---|
| What it means | Overwrite every addressable location with a known pattern | Make recovery not reasonably possible, including in a laboratory | Render the media physically unrecoverable, including by physical means |
| Assures against | Casual and moderately sophisticated recovery | Laboratory and forensic recovery techniques | Any recovery technique, including physical reconstruction |
| Applicable when | Media is in your physical control and will not leave it, and the adversary is not technically advanced | Media is leaving your control — return, redeploy, resale, recycling, decommissioning | Media contained classified data, or the media cannot be purged (flash, optical) |
| Qualifying methods | Single overwrite, multiple overwrite patterns | Degaussing, cryptographic erase with key destruction | Shredding, crushing, melting, incineration, disintegration |
| Proton equipment | — | T-1, T-1.2, T-1.5, T-4, T-5, 1100 wand (magnetic media) | PDS-30, PDS-75, PDS-100, PDS-88 |
| Audit evidence | Software log only | Per-cycle field verification on T-1.2, T-1.5, T-4, T-5 | Destruction register entry |
The one-line version. Clear is a security control. Purge is a disposal control. Destroy is the only answer for flash. Most Indian media-leak incidents are the result of treating retired hardware as a clear problem when it was a purge problem.
Purge by degaussing: the requirements
For a degausser to constitute a valid purge, the publication sets out practical requirements. In summary, and in the terms our machines are specified against:
- Field strength must exceed the drive's coercive force. Modern high-coercivity platters need 1 Tesla or more. The Proton range runs from 1 Tesla (T-1) to 2 Tesla (T-5), with the T-4 producing a bi-directional ±20,000 Gauss pulse.
- The pulse must be applied for long enough. Cycle times on the range are under 5 seconds (T-1.5) to under one minute (T-4).
- There must be a mechanism to confirm the pulse occurred at the required strength. A cycle counter alone is not sufficient evidence of strength. This is why the T-4's internal Gaussmeter and the T-1.5's pre-cycle software interlock matter for compliance, not just convenience.
- The process must be documented and repeatable. An asset register, a destruction register, a trained operator and a controlled location.
- The method must be appropriate to the media. Degaussing magnetic media that has already been through a destructive process is unnecessary; degaussing flash is meaningless.
Destroy: where purging is not possible
| Media | Can it be purged magnetically? | NIST-appropriate method | Proton equipment in India |
|---|---|---|---|
| Magnetic hard disk drive | Yes | Purge (degauss), optionally then destroy | T-1 to T-5, 1100 wand + PDS-30/75/100 |
| Server / enterprise drive | Yes | Purge (degauss) | T-1.5, T-4, T-5 + PDS-100 |
| Damaged / non-spinning HDD | Yes | Purge (degauss) | T-1.5, T-4, T-5 |
| LTO / DLT / DAT tape | Yes | Purge (degauss) | T-1 to T-5 |
| Floppy / magnetic card | Yes | Purge (degauss) | T-1, T-1.2, T-1.5 |
| SSD / M.2 / NVMe | <b>No</b> | Destroy (shred / crush); crypto-erase possible with key destruction | PDS-88, PDS-30 with SSD kit, PDS-SSD destroyer |
| USB / pen drive / SD card | <b>No</b> | Destroy (shred) | PDS-88 |
| Smartphone / tablet | <b>No</b> | Destroy (shred); remove battery first | PDS-88 |
| SIM / credit card | <b>No</b> | Destroy (shred) | PDS-88 |
| CD / DVD / optical | <b>No</b> | Destroy (shred) | PDS-88 |
Verification: the part organisations get wrong
Two machines can produce the same pulse and give completely different audit outcomes depending on verification.
- Proton T-4 — internal gaussmeter and LCD report field strength on every cycle. This is the strongest verification in the range and removes the need for a separate instrument and a re-certification programme.
- Proton T-1.5 — internal software interlock checks capacitor voltage, switch state and other parameters before the "Go" indicator appears. If any parameter would compromise the degauss, no cycle is approved, so a weak pulse cannot be logged as a success.
- Proton T-1.2 — LCD touchscreen displays the field strength of every cycle.
- Proton T-5 — digital cycle counter and LCD status display, giving a running count of completed sanitisation cycles.
- Proton T-1 — LCD shows cycle progress and a success notification with the Gauss and Tesla rating once complete.
Do not skip the verification step. An unverified degausser that has drifted out of specification will still happily report success. That is the mechanism by which a compliant-looking process becomes a non-compliant one. Budget for periodic field verification — it is exactly what the AMC covers.
Mapping NIST levels to Indian obligations
| Your obligation | What it usually maps to | Proton answer |
|---|---|---|
| DPDP Act 2023 erasure / deletion | Purge for magnetic media, destroy for flash | T-1.5 or T-5 + PDS-88 + PDS-100 |
| IT Act 2000, s.70A reasonable safeguards | Documented secure disposal as part of security practice | Any machine plus a written policy and register |
| RBI data disposal expectations (BFSI) | Purge + audit trail for customer data media | T-4 or T-5 (verification evidence) + destruction register |
| ISO/IEC 27001 Annex A 7.14 secure disposal | Documented, risk-based disposal process | T-1.5 + PDS-75/100 + PDS-88 |
| Government / PSU / defence tender | NSA/CSS evaluated equipment | T-4 or T-5, PDS-75 or PDS-100 |
| HIPAA / GLBA / PCI DSS / PIPEDA | Destruction of ePHI, customer and cardholder data | PDS-88 for the media; degausser for back-up media |
A NIST 800-88-aligned procedure you can adopt
- Classify each medium by data type and media type before disposal.
- Choose the NIST level: clear, purge or destroy, and write the reason into the policy.
- Select the method per media type — degauss magnetic, shred flash.
- Verify the machine is in specification (periodic field verification record).
- Execute and record — one row per asset, with cycle verification captured.
- Physically destroy the sanitised media where the policy requires it.
- Obtain and retain recycler documentation for the scrap.
- Retain the register for at least the longest data retention period applicable to the data destroyed.
- Review the process at least annually, and after any audit finding.