NCSC's own guidance says most organizations do not need to shred their drives. Secret clearance and above, yes. Everything else, no. Secure sanitization produces equivalent assurance with an auditable per-device record and a device that still carries resale value. NIST 800-88 in the US says the same thing in its own framework. The two authorities point to the same answer, and they have done so for years.
The gap between what the authorities actually say and what the industry does by default is real, and it is widening. The ITAD operator who closes that gap in 2027 recovers resale value, produces the audit records buyers now demand, and meets the authorities on their own ground. The operator who does not is burning value and accruing audit risk they have no way to answer.
This piece walks through what NCSC actually says, what NIST 800-88 adds, where destruction is still the right call, and what a sanitization-first workflow looks like in practice.
Most operators treat "safer" as "destroyed" and shred every drive by default. NCSC's actual guidance is more nuanced, and the misread is widespread. The two most-cited NCSC pages, "Secure sanitisation of storage media" and "Erasing devices" under the Managing Deployed Devices collection, have been publicly available for years. Both say the same thing: destruction is the right choice for a specific tier of classified data, and secure sanitization is the right choice for the rest.
NCSC tiers destruction to clearance level. Material classified Secret or above requires physical destruction because the residual data risk is unacceptable at any method short of it. Material classified Confidential or below is covered by secure sanitization: software-based erasure that writes over the storage media to a verified standard, with an audit record showing the device, the method, the operator, and the verification result. Routine business data, which is the vast majority of what an ITAD processes, sits at Confidential or below. NCSC's language is deliberate. It says “sanitisation”, not “destruction”, for this tier.
The fix. Read the guidance. Classify the data. Match the method to the classification. Secret and above goes to destruction. Confidential and below goes to secure sanitization with an auditable record. Routine business data, which is the vast majority of ITAD volume, is sanitization territory under NCSC's own guidance. The ITAD operator who defaults every drive to destruction is applying the Secret-tier method to Confidential-tier data, which is wasteful on cost, wasteful on resale value, and tells the buyer nothing more about assurance than the sanitization record would.
US ITAD operators sometimes look to NCSC for context without realizing NIST 800-88 says essentially the same thing in its own framework. The US guidance has been in place since 2014 and was most recently revised in 2025. It is the compliance anchor behind R2v3 and SOC 2 audit expectations. Not knowing it is not an option in 2027.
NIST 800-88 defines three sanitization levels: Clear, Purge, and Destroy. Clear is the lightest, intended for devices that will remain inside the organization's security perimeter after sanitization. Purge is the operational default for devices leaving the perimeter, including everything moving through an ITAD workflow. It is a software-based verified erasure that renders the data irretrievable to any laboratory recovery attempt. Destroy is reserved for the highest-sensitivity data where the residual risk even after Purge is unacceptable. Federal agencies apply Destroy to a narrow category defined by data classification. Most enterprise data does not meet that threshold.
The fix. In the US, Purge is the right default for ITAD operations. Destroy is the exception, not the rule. The two frameworks, NCSC and NIST, agree on the direction: software-based verified erasure for the vast majority of end-of-life storage, physical destruction for the specific high-sensitivity tier. ADISA certification bridges both frameworks. An ADISA-certified erasure product is independently verified against NIST 800-88 Purge requirements. The operator running ADISA-certified erasure is on the right side of both NCSC and NIST at once.
The counter-reflex from reading NCSC and NIST properly is to swing the other way and treat "sanitization" as "sanitization for everything". That is just as wrong. There are three categories where destruction remains the correct method, and an operator who misses them is on the wrong side of the guidance just as much as the one who shreds everything by default.
First, data classified at Secret clearance level or above under NCSC guidance, and the equivalent federal classifications under NIST that call for Destroy. For these categories, the residual risk after software sanitization is not acceptable regardless of the audit record. Destruction is the only method that meets the risk standard. Second, media that cannot be reliably sanitized. This includes severely damaged drives where firmware access to the full storage area is not possible, legacy media types where the erasure method has not been verified against NIST or NCSC standards, and solid-state storage where the controller firmware is unknown or unverified. Third, cases where the regulator or contracting authority specifies destruction as the method, regardless of what the general guidance would allow. Public sector contracts in defense, intelligence, and some financial services frequently specify this.
The fix. Treat destruction as the specific tool for specific cases, not the default for every case. Build the decision into the workflow at intake. Data classification plus media condition plus contractual specification determines the method. Everything else is sanitization. This is what the authorities would actually accept, and it is what an audit against NCSC or NIST would actually expect to see.
Operators who move from destruction-first to sanitization-first often do not have the workflow to prove it. They have the software but not the audit trail, or the audit trail but not the chain of custody, or the chain of custody but not the compliance certification behind the method. All three are needed. Any one missing is a gap that an NCSC-aligned or NIST-aligned auditor would call out, and that a buyer with a procurement team would catch before the contract is awarded.
A sanitization-first workflow has four requirements. One: software erasure certified against NIST 800-88 Purge and recognized by ADISA. The ADISA mark is the independent verification that the method does what it claims. Two: a per-device audit record attached to the device serial, documenting the erasure method, the operator, the timestamp, and the verification result. The record must be retrievable in minutes, not days, and in a format a buyer or regulator can actually read. Three: documented chain of custody from intake to final disposition, so the audit record ties to a physical device journey that would stand up to inspection. Four: ISO 9001 and ISO 27001 certification behind the operation, confirming that the quality management and information security practices around the sanitization meet international standard.
The fix. Build the workflow around all four requirements, not just the first one. Blackbelt360's data erasure is ADISA certified for HDDs and SSDs and NIST 800-88 verified by ADISA. The platform produces per-device audit records retrievable by serial. The company holds ISO 9001 and ISO 27001 certification. The operator moving to sanitization-first in 2027 can stand the workflow up against NCSC, NIST, R2v3, and ADISA audit at the same time.
The authorities are already pointing at sanitization-first. The commercial upside is already proven. The audit trail is already a buyer demand. Blackbelt360 covers mobile, Mac, Windows, Linux, and Chromebook under one workflow, with ADISA certified erasure, NIST 800-88 verified sanitization, ISO 9001 and ISO 27001 certification behind every record, and per-device audit retrievable by serial. The ITAD operator moving to a sanitization-first default in 2027 can do it on a platform that meets NCSC guidance, NIST 800-88, R2v3 audit requirements, and ADISA certification at the same time. One workflow, one record per device, four compliance anchors.
Three cases. First, data classified at Secret clearance level or above under NCSC, and the equivalent federal classifications under NIST 800-88 Destroy. Second, media that cannot be reliably sanitized, including severely damaged drives and unverified controller firmware. Third, cases where a regulator or contracting authority specifies destruction regardless of general guidance. For everything else, including routine business data, secure sanitization with an auditable per-device record is the method the authorities support.
NCSC is the UK authority. NIST 800-88 is the US equivalent. The two frameworks agree on the direction: software-based verified erasure for most enterprise storage, physical destruction for the specific high-sensitivity tier. An ADISA-certified erasure product is verified against NIST 800-88 Purge, so an operator running ADISA-certified software is on the right side of both frameworks at once.
Per-device records attached to the device serial, documenting the erasure method, the operator, the timestamp, and the verification result. The record is produced as a by-product of the workflow rather than assembled retrospectively, and it is retrievable by serial in minutes rather than days. The format is suitable for buyer contract audit, regulator inspection, and internal compliance reporting without further processing.
Book a 20-minute walkthrough. We will show you how Blackbelt360 runs sanitization-first across mobile, Mac, Windows, Linux, and Chromebook, with ADISA certified erasure and a per-device audit record retrievable by serial. Email paul.katzoff@blackbelt360.com or visit www.blackbelt360.com.