DoD 5220.22-M and Current Media Sanitization
Table of Contents
DoD 5220.22-M is a historical National Industrial Security Program Operating Manual reference, not a current universal recipe for wiping media. The NISPOM manual was replaced by 32 CFR Part 117 . Do not apply a generic three-pass overwrite rule to every disk, SSD, or USB drive. Use the current NIST SP 800-88 Revision 2 , organizational policy, and any governing classified-media requirements.
Return to the Cybersecurity Career Playbook .
Choose by Media and Destination
First identify the device, its data classification, and whether it will be reused inside the organization, transferred outside, or destroyed. NIST describes Clear, Purge, and Destroy methods. The method must fit the storage technology and required protection level. A host overwrite may miss flash cells remapped by wear leveling. A vendor’s sanitize command or cryptographic erase needs device support and validation. Physical destruction also needs a method suited to the media and a controlled chain of custody.
| Media | Question before choosing a method |
|---|---|
| Magnetic hard disk | Will the full addressable area and hidden areas be covered by the selected method? |
| SSD or USB flash | Does the device support a trustworthy sanitize or cryptographic erase route? How will it be verified? |
| Optical media | Is approved physical destruction the safer route for this medium and classification? |
| Failed device | If commands cannot complete or be verified, should the device be destroyed under policy? |
Record the Decision
A useful sanitization record names the asset ID, media type, model, serial, data sensitivity, destination, selected method, operator, tool or device command, verification result, validation decision, date, and disposition. If verification fails, quarantine the media and select another approved method. A completed command alone is not a certificate that no data is recoverable.
For practice, use fictional media records and write a decision for one HDD, one SSD, and one failed USB drive. Explain why the same overwrite command does not fit all three. Do not experiment on a real device containing needed data.
Continue with the NIST media sanitization guide in this playbook .
Related Posts
