Home » Resources » IEEE 2883.1-2025 Explained: What’s New 

IEEE 2883.1-2025 Explained: What's New

The compliance world can be complex. Endless strings of letters and numbers referring to lengthy paywalled documents you don’t know if you should read or not. So, let’s start with an important fact: IEEE Std 2883.1-2025 is not a new version of the 2022 storage sanitization standard that 31% of IT and security teams say they’re already using. 

IEEE 2883.1-2025 is a “Recommended Practice” document intended to sit alongside IEEE 2883-2022 rather than replace it. More than anything, the 2025 document is designed to give practical methods of applying the technical standards enshrined in the 2022 original.

This article summarizes some of these recommendations as they apply to data sanitization. 

Stephen Connolly As a content writer for Blancco, Stephen uses his 10+ years of experience researching and writing about technology to explain how data sanitization is the secure, compliant, efficient, and sustainable choice for end-of-life data management.

2 IEEE documents with 2 different jobs 

IEEE 2883-2022 remains the technical foundation for both the IEEE’s guidelines and also now for NIST 800-88 Rev.2, which refers to the IEEE standard. IEEE 2883-2022 defines three sanitization methods, Clear, Purge, and Destruct, and specifies the exact commands and requirements for applying each one across every major physical storage type, from hard drives and SSDs to memory cards and optical media. That document has not changed. 

Instead of revising or updating those original guidelines, IEEE 2883.1-2025 proposes several mechanisms for making decisions about how they might be used. For example, it gives organizations structured ways of deciding which methods to apply based on the risk profile of the data. 

What IEEE 2883-2022 already covered 

Among other things, IEEE 2883-2022 included: 

• A general comparison of the three methods of sanitization and their impacts on different media 
• A basic risk-tier map and process workflow. Information whose disclosure would cause mild impact points toward Clear, moderate impact toward Purge, and severe impact toward Destruct 
• A stated preference for Purge over Destruct for most data, specifically to support asset reuse and reduce the environmental impact of physical destruction 
• Per-media-type requirements, including paper and optical discs that accept only Destruct regardless of sensitivity 
  

The Blancco 2026 State of Data Sanitization Report found that over 30% of enterprises experienced a data leak in the previous year, and that a third of those leaks resulted from the redeployment of drives or devices still containing data.

What IEEE 2883.1-2025 adds 

The new Recommended Practice document builds on that foundation with: 

• A formal risk equation. 2883.1 frames risk as a function of loss and likelihood, and provides tables mapping adversary skill level (novice, expert, virtuoso) against sanitization method to estimate how likely data recovery is after each one. 
• A four-stage lifecycle model. The practice suggests considering sanitization around four points in the asset lifecycle:
  1. before provisioning new storage,
  2. before internal reuse,
  3. before external reuse or resale, and
  4. before disposal or recycling.
• New supply chain threat scenarios. 2883.1 introduces threats not addressed in the 2022 standard at all, including pre-harvested encryption keys and pre-installed malware on incoming storage. 
• Operating conditions for Destruct. The practice specifies that physical destruction only delivers its expected result when the technique matches the media type (e.g., degaussing of flash-based storage is not possible), the equipment is maintained, and operators are trained, conditions the 2022 standard didn’t spell out in as much detail. 
• More detailed verification guidance, including references to the challenges of non-addressable locations, such as overprovisioned space, etc. 

Want to go deeper? 

For a closer look at the update: 

• How the new risk framework interacts with a rapidly changing threat environment, see our piece on data security risk and the new IEEE risk framework.

You may be interested in

Meeting NCSC & NHS Guidance on Data Sanitization

Sysmex Asia Pacific Achieves Data Protection Compliance in 3 Months with Easy-to-Deploy Erasure Solutions | Blancco Case Study

[Checklist] Decommissioning Checklist for Enterprises: PCs, Laptops & Other IT Assets

[VIDEO] Blancco Drive Eraser Overview