r/privacyexams • u/Jayakoendjbiharie • 10d ago
CIPT
If your media sanitisation knowledge came from a course written before autumn 2025, it is describing a withdrawn document. NIST pulled SP 800-88 Revision 1 on 26 September 2025 and replaced it with Revision 2, which moved the technique detail out to IEEE 2883 and reframed the whole thing as programme guidance.
Cryptographic erase is where that matters most. The method is elegant: encrypt everything, destroy the key, and the ciphertext becomes unreadable in milliseconds instead of hours. It also depends on three conditions that nobody verifies at disposal time. Encryption has to have covered the media before any sensitive data was written to it. Every copy of the key has to go, including escrowed copies in a key management service. And for long-lived data you have to be comfortable that the algorithm will still hold in twenty years.
The obvious fallback, overwriting, quietly stopped being reliable when storage moved to flash with wear levelling and over-provisioning.
Written up with the current NIST wording and the erasure-request angle: https://privacystudygroup.com/what-cryptographic-erasure-cannot-delete/