IEEE 2883: Certification and Compliance
What the standard is, and what "compliant" really means.

No. IEEE 2883-2022 is a standard, not a certification scheme, and IEEE's own page for it lists no certification or conformance program. In 2023 the working group was reported to be exploring one. So when a product says "IEEE 2883 certified", it means one of two things: the vendor's own claim, or that an independent test lab tested a specific version of the product against the standard.

The independent route exists. ADISA, a UK certification body for data sanitization, runs a Product Assurance test that, in ADISA's words, verifies "compliance to NIST 800-88 and/or IEEE 2883 Clear and Purge for supported media and interfaces". It checks the drive commands the product sends, not just the result. ADISA's separate Product Claims Test only checks a vendor's own claim about its product, so the two are not the same certificate. ADISA keeps a public directory of who holds which.

Either kind of claim can be fine. What matters is the evidence behind it, and an auditor will ask for that evidence, not for a logo.

1. The method per drive: Clear, Purge or Destruct, chosen for that storage technology.
2. The command actually sent: for example NVMe Sanitize or Format, ATA Sanitize or Secure Erase, SCSI Sanitize.
3. What happens when Purge isn't available on a drive: fall back, fail, or destroy, and who decides.
4. How the result was verified, with a check that suits the method.
5. A record for every drive: serial, method, result, verification, tool and version, who did it and when.
6. A certificate of sanitization built from those records (IEEE 2883 points to ISO/IEC 27040 for its contents).
7. Failed and repeated attempts kept, not overwritten by the final success.
8. Any independent test report, naming the exact product version in use.

1. Which method does the tool use for NVMe, SATA SSD, SAS and hard drives?
2. Which drive command does it send for each, and how does it know the drive supports it?
3. How does it verify the result, and how much of the drive does it read back?
4. What does the record for one drive contain? Ask to see one.
5. If an independent test is cited: may we see the report, and does it cover the version we'd run?

For decades, data erasure standards assumed spinning magnetic platters where overwriting sectors sequentially guaranteed data destruction. Solid-state technology (NAND flash) completely invalidated this assumption due to the Flash Translation Layer (FTL), dynamic wear leveling, and over-provisioned reserve blocks.

Approved by IEEE in June 2022, IEEE 2883-2022 specifies how to sanitize logical and physical storage, with technology-specific requirements for hard drives, SSDs (NVMe, SATA, SAS) and other media. NIST SP 800-88 Rev. 2 points to it for the technique on each type of storage.

For each drive, reCore reads what the controller supports (NVMe Sanitize and Format options, ATA Secure Erase), picks the strongest method that fits, and sends that command. If the drive can't Purge, it falls back to a Clear overwrite, except at the strictest policy level, where the wipe fails instead.

It then verifies the result with a check that matches the method, and keeps a record for every drive, failed attempts included. A certificate is issued from those records once a second person approves it.