SellUsediPhoneFast · Safe · Simple
NIST Special Publication 800-88, Guidelines for Media Sanitization, is the U.S. reference for erasing data from storage, and its Revision 2, published in September 2025, keeps 3 sanitization methods, Clear, Purge and Destroy, and recognizes cryptographic erase as an approved Purge method when its prerequisites are met. iPhones encrypt their storage by default and Erase All Content and Settings deletes the encryption keys, which is cryptographic erase. Rev. 2 also asks organizations to run a sanitization program with documented verification, validation and certificates of sanitization. Companies retiring iPhones use these terms in their records. iPhone IT Asset Disposition (ITAD): A Guide for Companies covers the wider process.
- Standard: NIST SP 800-88 Rev. 2, September 2025, superseding Rev. 1 of December 2014.
- Methods: Clear, Purge and Destroy.
- iPhone method: cryptographic erase through Erase All Content and Settings.
- Records: certificates of sanitization, with verification and validation.
What does NIST 800-88 require?
NIST SP 800-88 Rev. 2 requires organizations to choose a sanitization method that matches the sensitivity of the data and to document the result. Its main elements are:
| Element | What it means |
|---|---|
| Clear | Logical techniques that protect against simple, non-invasive data recovery |
| Purge | Techniques that make recovery infeasible even with advanced laboratory methods; cryptographic erase is one |
| Destroy | Physical destruction that makes recovery infeasible and the media unusable |
| Sanitization program | Policy, roles, training, tool configuration and evidence requirements |
| Verification | Inspecting the immediate outcome of a sanitization technique |
| Validation | An organizational review that accepts any remaining risk |
Rev. 2 shifted its focus from media-specific technique tables to program governance and assurance, and it refers to industry standards, such as IEEE 2883, for technique-level details, according to NIST's Rev. 2 FAQ.
How does it apply to iPhones?
NIST SP 800-88 applies to iPhones through cryptographic erase, which Rev. 2 treats as a Purge method when 4 prerequisites are met, according to NIST's FAQ:
- No sensitive data was stored in plaintext before the encryption keys were set up.
- The encryption uses an algorithm of at least 128-bit strength.
- The random number generation matches or exceeds the key length.
- The target keys are zeroized, meaning destroyed.
Federal agencies also require FIPS-validated cryptography. iPhones encrypt data from first setup using keys protected by hardware, and erasing deletes those keys, which Apple describes in its Platform Security Guide. Organizations decide whether their devices meet their own policy, including any FIPS requirement. Does a Factory Reset Delete Everything on an iPhone? explains the erase.
What is a certificate of erasure?
A certificate of erasure, called a certificate of sanitization in NIST's terms, is a record that a specific device was sanitized. It usually lists 8 fields:
| Field | Example |
|---|---|
| Device type and model | iPhone 15 Pro |
| Serial number and IMEI | The device's identifiers |
| Method | Purge, by cryptographic erase |
| Tool or process | Erase All Content and Settings, or the vendor's tool |
| Date and time | When the sanitization ran |
| Verification result | Pass or fail |
| Performed by | The technician or system |
| Validated by | The person accepting the result for the organization |
Rev. 2 states that a sanitization policy should include documentation and evidence requirements, such as certificates of sanitization.
What changed from Rev. 1 to Rev. 2?
NIST's FAQ for Rev. 2 describes 5 main changes:
- A shift from media-specific techniques to program governance and assurance.
- The term "information storage media" replaces "electronic media", covering physical and virtual storage such as cloud.
- Sanitization assurance through separate verification and validation phases.
- A decision flow diagram for choosing a method.
- A clarified position that degaussing is no longer a true Destroy method.
Rev. 1, published in December 2014, included detailed tables of techniques by media type, which many vendors still cite. Organizations updating policies should refer to Rev. 2.
Is a factory reset NIST compliant?
A factory reset on an iPhone uses cryptographic erase, the Purge method NIST SP 800-88 recognizes when its prerequisites are met. "Compliance" depends on the organization's own program: its policy, its verification of each erase and its documentation. A single erase without records meets the technical step but not the program requirements. Companies document each erase with the device identifiers and date.
When is physical destruction needed?
Physical destruction, NIST's Destroy method, is used when a device cannot be erased, such as a phone that does not power on, or when an organization's policy requires it for the most sensitive data. Destroying a working iPhone removes its resale value. For most company iPhones, cryptographic erase followed by resale protects data and recovers value. Non-working phones can go to a certified recycler that destroys or recovers materials under documented processes.
How do companies verify iPhone erasure?
Companies verify iPhone erasure in 3 ways: confirming the device shows the Hello screen after the erase, confirming through MDM that the erase command completed, or using a vendor's diagnostic tool that reports the erase result for each serial number. NIST's Rev. 2 calls this verification. A manager then reviews the batch results and accepts them, which is validation.
What should I ask an ITAD vendor about erasure?
Ask an ITAD or buyback vendor 5 questions about erasure:
- Which method do you use for iPhones?
- Do you erase every device again on arrival?
- Do you provide a per-device report or certificate?
- Which fields does the certificate include?
- How do you handle devices that cannot be erased?
Get the answers in writing before shipping a batch. How Businesses Sell Old Company iPhones in Bulk covers vendor selection.
Does NIST 800-88 apply to individuals?
NIST SP 800-88 is written for organizations, especially federal agencies and their contractors, but its methods apply to anyone. An individual selling a personal iPhone uses the same cryptographic erase by signing out of the Apple Account and choosing Erase All Content and Settings. No certificate is needed for a personal sale.
How do Activation Lock and MDM relate to erasure?
Activation Lock and MDM are separate from erasure. An erased phone can still be Activation Locked to an Apple Account or enrolled in company management through Apple Business Manager. A complete retirement covers all 3: erase, release from management and clear Activation Lock. How to Release iPhones From Apple Business Manager covers the release.
How do Clear, Purge and Destroy compare for iPhones?
Clear, Purge and Destroy produce different results for iPhones. The table compares them.
| Method | iPhone example | Device reusable? | Typical use |
|---|---|---|---|
| Clear | Deleting files and apps through the user interface | Yes | Not sufficient for resale on its own |
| Purge | Cryptographic erase through Erase All Content and Settings or MDM | Yes | Resale, redeployment and donation |
| Destroy | Shredding or disintegration by a certified recycler | No | Non-working devices or the highest-sensitivity data |
Purge by cryptographic erase is the method that both protects data and keeps the phone's resale value.
How do I perform cryptographic erase on an iPhone?
Perform cryptographic erase on an iPhone in 4 steps: back up any data that must be kept, sign out of the Apple Account so Activation Lock is removed, open Settings > General > Transfer or Reset iPhone > Erase All Content and Settings and confirm. Managed devices can receive the same erase as a remote MDM command. How to Factory Reset an iPhone Before Selling It covers the steps.
Does MDM status affect a sanitization record?
MDM status affects the record, because a managed device can be erased remotely, and the MDM log can serve as verification evidence. A device still enrolled after the erase must also be released before resale. How to Check an iPhone for an MDM Profile explains how to confirm.
How do companies sell erased iPhones in volume?
Companies sell erased iPhones in volume by sending an asset list with model, storage, IMEI and condition, receiving one offer for the batch, shipping on an agreed plan and receiving a report per device. Sell iPhones in Bulk handles batches of 5 or more phones.
Is overwriting needed on an iPhone?
Overwriting every storage block is not needed on an iPhone, because cryptographic erase makes the encrypted data unreadable by destroying the keys. Overwriting tools designed for hard drives do not apply to iPhone flash storage.
What should a sanitization policy for phones include?
A sanitization policy for phones should include 7 elements, drawn from NIST Rev. 2's program approach:
| Element | Phone example |
|---|---|
| Scope | Company iPhones, iPads and other mobile devices |
| Method selection | Purge by cryptographic erase for working devices; Destroy for non-working |
| Roles | Who erases, who verifies and who validates |
| Training | Steps for staff who prepare devices |
| Tool configuration | MDM erase settings and any vendor tool |
| Verification | Hello screen check or MDM confirmation per device |
| Evidence | Certificates of sanitization kept with the asset record |
How long should erasure records be kept?
NIST SP 800-88 does not set a single retention period for erasure records; organizations set it based on legal, contractual and industry requirements. Many keep records for several years alongside asset and financial records. Healthcare, finance and government contractors often have specific retention rules that apply.
Do iPads and Macs use the same method?
iPads use the same cryptographic erase as iPhones. Macs with Apple silicon or the T2 Security Chip support Erase All Content and Settings on recent macOS versions, which also uses cryptographic erase. Older Intel Macs without the T2 chip need a different process, such as erasing the drive with Disk Utility, which may not meet the same Purge level for all drive types.
What about phones that cannot power on?
Phones that cannot power on cannot run cryptographic erase. Their data stays encrypted and protected by the passcode, but organizations with strict policies send them for documented destruction by a certified recycler.
Why does Rev. 2 say degaussing is not a Destroy method?
Rev. 2 states that degaussing, which uses a strong magnetic field to disrupt magnetic media, is no longer treated as a true Destroy method. Degaussing never applied to iPhones, because flash storage does not store data magnetically. For phones, the relevant methods are cryptographic erase and physical destruction.
Is NIST 800-88 mandatory?
NIST SP 800-88 is guidance, not a law, but federal agencies use it, and many contracts, auditors and industry frameworks reference it.
Does the IEEE 2883 standard replace NIST 800-88?
IEEE 2883 does not replace NIST SP 800-88. It covers technique-level details by storage type, while NIST Rev. 2 sets the program, method selection and assurance framework and points to IEEE 2883 for techniques.
Frequently asked questions about NIST 800-88 and phone erasure
What is NIST 800-88?
NIST SP 800-88, Guidelines for Media Sanitization, is U.S. guidance for removing data from storage so it cannot be recovered. Revision 2, published in September 2025, defines Clear, Purge and Destroy, recognizes cryptographic erase as a Purge method and asks organizations to document verification, validation and certificates of sanitization. Keep the related records with the batch file, so each device can be traced later.
Does an iPhone factory reset meet NIST 800-88?
An iPhone factory reset uses cryptographic erase, which NIST SP 800-88 Rev. 2 recognizes as a Purge method when its prerequisites are met, such as at least 128-bit encryption and destruction of the keys. Meeting an organization's full program also needs verification and records for each device. A bulk request with an inventory list usually receives a reply within 1 business day.
What is cryptographic erase?
Cryptographic erase sanitizes encrypted storage by destroying the encryption keys instead of overwriting every block. Without the keys, the remaining encrypted data is unreadable. iPhones encrypt storage by default, and Erase All Content and Settings deletes the keys, which makes the erase fast and complete. A report per device follows testing, and payment is made against the agreed offer.
What does a certificate of erasure include?
A certificate of erasure usually includes the device model, serial number and IMEI, the sanitization method and tool, the date and time, the verification result and the names of the person who performed and the person who validated it. NIST Rev. 2 lists such certificates as part of a sanitization policy.
What changed in NIST 800-88 Revision 2?
Revision 2 shifted the focus from media-specific technique tables to program governance and assurance, introduced the term information storage media, added verification and validation phases and a decision flow and clarified that degaussing is no longer a true Destroy method. It refers to standards such as IEEE 2883 for techniques.
Sources and references
- National Institute of Standards and Technology (NIST): SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025.
- NIST: SP 800-88 Rev. 2 FAQ.
- Apple Platform Security Guide: data protection and erasing the device.
- IEEE: IEEE 2883-2022, Standard for Sanitizing Storage.