Certificate of Sanitization Template (Free, NIST 800-88 Rev. 2)

A certificate of sanitization is the piece of paper, or the record, that proves a drive was wiped. When an auditor or a customer asks "how do you know this drive is clean?", this is the answer.

We've built a free template you can use today, from the fields NIST SP 800-88 Rev. 2 lists, plus a drive log for batches. Below it you'll find what each field means, the mistakes that get certificates rejected, and when it's worth automating.

1. What a certificate of sanitization is

NIST SP 800-88 Rev. 2, the US guidelines for media sanitization, says that after sanitization "a certificate of sanitization (see Appendix C) should be completed for each" storage device. It "may be a physical (e.g., piece of paper) or electronic record of the action taken."

Think of it as the drive's exit paperwork. It names the drive, says what you did to it and how you checked, and carries the signatures of whoever did the work and whoever confirmed it.

Still using NIST's "Appendix G" form?

Many free certificates online are copies of the sample in NIST SP 800-88 Rev. 1, where it was Appendix G. NIST withdrew Rev. 1 on September 26, 2025, when Rev. 2 replaced it. Rev. 2 keeps a sample certificate, now in Appendix C, and its Section 4.6 is the list of fields that counts today. If your form still cites Rev. 1, update the reference before your next audit. Our template follows Rev. 2.

2. The fields, and what to write in each

Section 4.6 of NIST SP 800-88 Rev. 2 says a completed certificate should record at least the fields below. Our template has all of them, in the order of NIST's sample form (Appendix C), so an auditor who knows the NIST form will find everything where they expect it.

3. How to fill it in

1. One certificate per drive. Start a new one for each storage device, even if two drives came out of the same computer.
2. Copy identifiers from the drive, not the box. You want the serial from the drive's label or its own identify data.
3. Record the method and the technique separately. "Purge" is the method; "cryptographic erase" or "block erase" is the technique.
4. Write how you verified it. For example, "read-back of 10% of sectors, all returned the erased pattern."
5. Note anything unusual. A failed first attempt, a fallback to a different technique, a damaged drive.
6. Get the second signature. The concurrence block is for someone other than the person who did the wipe. Our guide to serial-level verification covers why auditors look for it. Who signs, and how much of each drive gets read back, belong in your data sanitization policy.
7. Mark where it went. Internal reuse, resale, recycler or manufacturer, and to whom.

4. One certificate per drive, or per batch?

NIST's guidance is per device. If you've got a batch of 200 laptops, that's 200 or more certificates. So keep one certificate per drive electronically, and attach a drive log to the batch paperwork. Page 2 of the template is that log: one row per drive, with its serial, method, technique, tool, verification and result.

What won't hold up is a receipt that only says "200 drives sanitized." It doesn't identify a single drive, so it can't prove anything about any of them.

5. Mistakes that get certificates rejected

• The computer's serial instead of the drive's. The certificate is about the storage device.
• "DoD 5220.22-M" as the method. It's a technique, and under NIST it counts as Clear. Our article on whether DoD 5220.22-M is still valid explains.
• No tool version. NIST asks for the tool "including version". Without it, nobody can tell which release did the wipe, or whether a known fault applied to it.
• "Verified" with no method. Say how it was checked and how much of the drive was read back. See how much of a wiped drive to read back.
• Blank fields. Write "N/A" so a reader can tell a field wasn't skipped.
• Only one person. Where your process needs a second person to confirm, the certificate should show it.

6. Paper or electronic?

Both are allowed, and you can mix them. NIST's view is that if the records need to be referenced later, "electronic records will likely provide the fastest search capabilities and the best likelihood of being reliably retained." Paper's fine for a handful of drives. At volume, typing serials by hand is where mistakes creep in, and NIST itself suggests scanning barcodes into a tracking application. We'd go further: if a person has to retype it, it'll eventually be wrong. R2v3 facilities have less choice: SERI has ruled that spreadsheets aren't acceptable records of software sanitization (see R2v3 sanitization records: why spreadsheets fail).

7. When to stop filling them in by hand

reCore issues a certificate for every drive it wipes, and fills in most of these fields from the wipe itself: manufacturer, model, the device and drive serials, asset tag, method, technique (mapped to IEEE 2883), tool and version, verification method and coverage, start and finish times, location, and the operator and approver with their roles. A certificate is issued only after a second person, not the one who ran the wipe, approves it. You can download them one at a time or in bulk. See the data wiping and compliance pages, or pricing for plans and the free trial.

Conclusion

A certificate of sanitization is only useful if someone else can read it and trust it: the right drive, the right method, a real verification, and a second person's signature. The template gives you every field NIST lists. Fill in all of them, one drive at a time, and keep the drive log with the batch. If you're doing this for hundreds of drives a week, that's when it's time to let software do the typing.

Sources

• NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025: Section 4.6 (Documentation) and Appendix C (Sample "Certificate of Sanitization" Form).