AR 380-19 Army — Secure Data Erasure & Media Sanitization

AR 380-19 was an Army Information Systems Security regulation, rather than a standalone disk-wiping algorithm.

The regulation established an Army information-systems security framework covering areas such as:

• Computer Security
• Communications Security
• Electronic Security
• Risk Management
• System Accreditation
• Protection Of Classified Information
• Protection Of Sensitive Unclassified Information
• Media Clearing And Sanitization
• Equipment Release And Disposal

The 1998 regulation specifically included procedures for computer components and magnetic media that were no longer usable, required transfer or needed to be released from control.

AR 380-19 should therefore be represented accurately as a historical U.S. Army security regulation containing media-sanitization requirements and procedures.

It should not be marketed as:

• A Current NIST Media-Sanitization Standard
• A Current IEEE Storage-Sanitization Standard
• A Current Universal U.S. Army Disk-Wiping Standard
• A Government Certification Issued By DSP
• An External Certification Issued By The U.S. Army

One of the important sections of AR 380-19 addressed:

1. 01Clearing
2. 02Sanitizing
3. 03Declassification
4. 04Release
5. 05Destruction

The regulation explicitly distinguished these activities.

Clearing was defined as eradicating data before reuse where the subsequent environment provided an acceptable level of protection for the previously stored information.

The regulation also required the overwrite operation to be verified by the ISSM or designee.

This is an important technical distinction:

The historical Army procedure documented in the 1998 regulation specified a three-pass magnetic-disk overwrite consisting of random, specified and complementary values.

DSP provides the AR 380-19 methodology as a dedicated option within the DSP Sanitization Engine.

The historical magnetic-disk overwrite sequence can be represented as:

1. 01Random
2. 02Specified Character
3. 03Complement

This differs from other historical sanitization methodologies.

The number of passes should not be interpreted as a universal measure of modern sanitization effectiveness.

AR 380-19 specifically required verification of the overwrite procedure by the Information Systems Security Manager (ISSM) or designee.

This makes verification an important part of the historical methodology.

DSP translates this operational concept into a software workflow:

1. 01Execute
2. 02Verify
3. 03Record Result

DSP can record:

• Sanitization Method
• Device Information
• Operation Status
• Pass Status
• Errors
• Verification Result
• Operator/system Information
• Date And Time

AR 380-19 did not treat overwriting as the only possible sanitization mechanism.

The regulation also described degaussing for magnetic media.

Degaussing uses a reverse magnetic field to reduce the magnetic flux of the storage medium. The regulation required the coercivity of the media to be determined before selecting an appropriate degausser.

The regulation identified three historical magnetic-media categories based on coercivity and specified corresponding degaussing requirements.

Therefore, AR 380-19 should be understood as a broader media-security and sanitization framework, rather than simply a three-pass wiping algorithm.

The historical regulation included stronger requirements for certain categories of information.

For example, its Appendix E states that media that had contained SCI, other intelligence information or Restricted Data could not be sanitized by overwriting under those procedures and instead required degaussing before release.

It also specified that media that had ever contained cryptographic material could not be sanitized under those procedures and had to be destroyed.

This illustrates an important principle:

The media procedures were heavily oriented toward magnetic storage technologies, including:

• Magnetic Tape
• Magnetic Disk Packs
• Magnetic Disks
• Removable Hard Disks
• Non-Removable Hard Disks
• Other Historical Magnetic Media

The regulation's table provided different procedures depending on media type and degaussing category.

For non-removable and removable hard disks, the historical procedures included:

• Degaussing
• Or Three-Pass Overwrite
• Subject To The Applicable Media/security Requirements

The regulation explicitly recognized that overwriting effectiveness could be reduced by factors including:

• Equipment Failure
• Read/write-Head Alignment Problems
• Inability To Overwrite Bad Sectors
• Inability To Overwrite Bad Tracks
• Information In Inter-Record Gaps

This is particularly relevant to professional data-erasure software.

A software process reporting completion does not automatically establish that every required storage location was successfully overwritten.

DSP can therefore combine:

DEVICE ASSESSMENT+ERROR MONITORING+SANITIZATION+VERIFICATION

to provide a more complete operational record.

AR 380-19 was written around an earlier generation of storage technology and its sanitization procedures should not automatically be applied to modern SSD or NVMe architecture.

Modern flash storage may use:

• Flash Translation Layers
• Wear Leveling
• Spare Cells
• Over-Provisioning
• Garbage Collection
• Remapped Physical Locations

Host-level overwrite operations may therefore fail to address every physical location that previously contained data.

Current NIST SP 800-88 Rev. 2 specifically addresses this limitation and explains why conventional overwriting may not sanitize all previous data on certain flash-based media.

Therefore:

For modern flash storage, the appropriate device-specific Clear or Purge technique should be evaluated.

NIST SP 800-88 Rev. 2 is the current NIST media-sanitization publication and superseded Rev. 1 in September 2025.

These two historical U.S. government references are sometimes grouped together in commercial wiping software, but they are not the same methodology.

The AR 380-19 method should therefore not be marketed as simply another name for DoD 5220.22-M.

DSP can provide multiple historical sanitization methodologies for organizations maintaining legacy procedures.

Each methodology should be selected based on the applicable organizational requirement and storage technology.

DSP can generate an audit-ready certificate documenting the sanitization operation actually performed.

AR 380-19 included procedures for the release of systems and components.

The historical regulation required inspection to ensure that media, including internal disks, had been removed or sanitized and required a record of the sanitization procedure and recipient of released equipment.

This creates a useful conceptual connection with modern ITAD workflows:

1. 01Sanitize
2. 02Verify
3. 03Document
4. 04Release

DSP's audit-ready reporting can provide the software-side documentation needed to support this type of controlled asset-release process.

DSP can support offline sanitization workflows for environments where continuous internet connectivity is restricted.

This can be useful for:

• Government Environments
• Secure Facilities
• Enterprise IT
• ITAD Operations
• Data Centers
• Air-Gapped Environments
• Restricted Networks

The selected sanitization method can be executed locally while maintaining a local operational record.

DSP can support professional multi-device sanitization according to the configured licensing and available hardware.

Typical applications include:

• HDD Batch Sanitization
• Enterprise Asset Retirement
• ITAD Processing
• Storage Refurbishment
• Data-Center Decommissioning
• Corporate Equipment Disposal

Each target device can have its own sanitization and verification record.

AR 380-19 can be relevant where an organization maintains a legacy Army information-security or media-sanitization procedure and specifically requires the historical methodology.

For new sanitization programs, the decision should not be based solely on the Army association or historical pass count.

A modern sanitization decision should consider:

DATA SENSITIVITY+STORAGE TECHNOLOGY+DEVICE CONDITION+SANITIZATION OBJECTIVE+VERIFICATION+VALIDATION

For modern SSD, NVMe and flash media, technology-specific sanitization methods should be evaluated rather than assuming that a historical magnetic-disk overwrite procedure provides equivalent coverage.

Data Sanitization Pro provides a dedicated library of established, historical and technology-specific sanitization methodologies.

For organizations maintaining AR 380-19-based workflows, DSP provides:

AR 380-19 Army Sanitization Method

The selected method is executed through the DSP Sanitization Engine, followed by verification and audit-ready documentation.

Method selection should be based on the applicable organizational requirement, storage technology and intended sanitization objective.

• 01DSP-DPDP India
• 02NIST SP 800-88 Rev. 1 Clear
• 03NIST SP 800-88 Rev. 1 Purge
• 04NIST SP 800-88 Rev. 2 Clear
• 05NIST SP 800-88 Rev. 2 Purge
• 06IEEE 2883-2022
• 07ISO/IEC 27040:2024
• 08Random Overwrite
• 09DoD 5220.22-M
• 10DoD 5220.22-M ECE
• 11NSA/CSS Policy Manual 9-12
• 12HMG IS5 Baseline
• 13HMG IS5 Enhanced
• 14CSEC ITSG-06
• 15BSI-GSE
• 16BSI VSITR
• 17Gutmann Method
• 18Schneier Algorithm
• 19Pfitzner Method
• 20AFSSI-5020
• 21AR 380-19
• 22GOST R 50739-95
• 23NZISM
• 24NAVSO P-5239-26
• 25RCMP TSSIT OPS-II