DoD 5220.22-M — Secure Data Erasure & Legacy Data Wiping

DoD 5220.22-M was the former National Industrial Security Program Operating Manual (NISPOM) issued as DoD policy.

In the data sanitization industry, the name became strongly associated with a historical multi-pass overwrite approach for writable magnetic media.

Historical NIST documentation describes the DoD 5220.22-M approach as:

• Overwrite Addressable Locations With A Character Or Pattern
• Overwrite With Its Complement
• Overwrite With A Random Character Or Pattern
• Verify The Operation

This is commonly referred to as the DoD 3-pass wipe.

DSP provides a dedicated implementation of the DoD 5220.22-M methodology through the DSP Sanitization Engine.

1. 01Select Method
2. 02Select Device
3. 03DSP Sanitization Engine
4. 04Execute Do D 5220.22-M
5. 05Monitor Process
6. 06Verify Result
7. 07Audit-Ready Certificate

DSP records the actual sanitization operation performed on the selected device.

Commercial data-erasure products have historically used terms such as:

• DoD 3-pass Wipe
• DoD 7-pass Wipe
• DoD ECE
• DoD 5220.22-M Wipe

These terms should not automatically be treated as one official fixed DoD specification.

The DoD 3-pass historical approach is documented in NIST material, while extended commercial profiles can differ in their pass count and pattern configuration.

For this reason, a professional sanitization certificate should identify the actual method and configuration executed by the software.

The historical overwrite methodology is primarily associated with magnetic hard disk drives.

DSP supports supported storage technologies including:

• SATA HDD
• SAS HDD
• Pata/ide HDD
• External HDD
• USB-Connected Storage
• Other Supported Block-Addressable Media

DSP can record:

• Manufacturer
• Model
• Serial Number
• Capacity
• Firmware
• Device Status
• Sanitization Progress
• Processing Rate
• Verification Status
• Errors And Exceptions

Modern SSD and NVMe storage uses architectures such as:

• Flash Translation Layers
• Wear Leveling
• Garbage Collection
• Spare Cells
• Over-Provisioning
• Controller-Managed NAND

Therefore, a historical multi-pass overwrite should not automatically be considered equivalent to a modern purge technique for SSD or NVMe media.

Current NIST guidance explicitly notes that multi-pass overwrite is not necessary for Clear and discusses why traditional overwrite practices can be unsuitable for certain modern flash media.

For modern storage, the sanitization method should be selected according to the device architecture and required level of assurance.

The current NISPOM framework is 32 CFR Part 117, while current NIST media-sanitization guidance is provided by NIST SP 800-88 Rev. 2.

DSP can record relevant sanitization and media information, including:

• Verification Status
• Read/write Errors
• Logical Bad Sectors
• Physical Bad Sectors
• Device Health
• Temperature
• Power-On Hours
• Firmware
• Model
• Serial Number
• Completion Status

This provides additional evidence about the actual device condition and sanitization process.

DSP generates an audit-ready sanitization certificate for its DoD 5220.22-M implementation.

The certificate can document:

DoD 5220.22-M may still appear in legacy customer specifications, ITAD procedures and procurement requirements.

DSP provides a controlled workflow:

1. 01Receive
2. 02Identify
3. 03Sanitize
4. 04Verify
5. 05Certify
6. 06Reuse / Dispose

Typical applications include:

• IT Asset Disposition
• Hard Drive Refurbishment
• Enterprise IT Retirement
• Data Center Decommissioning
• Secure Device Resale
• Government Asset Processing
• Corporate Equipment Recycling

DSP also supports offline sanitization workflows for controlled environments.

These should be maintained as separate DSP methods.

Historical DoD multi-pass sanitization methodology.

DoD 5220.22-M ECE

An extended commercial/industry implementation commonly referred to as Enhanced Character Erase.

The actual pass configuration should always be documented rather than assuming that every commercial ECE profile represents an official DoD specification.

The term continues to appear in:

• Data Erasure Software Searches
• ITAD Requirements
• Legacy Enterprise Policies
• Hard Drive Wiping Specifications
• Refurbishment Workflows
• Data Destruction Procurement
• Secure Media Disposal Procedures

DSP supports the historical method while also providing modern sanitization methodologies for current storage technologies.

DoD 5220.22-M is one of the dedicated sanitization methods implemented in the DSP Sanitization Engine.

Each supported method has its own implementation, allowing DSP to execute the selected methodology and generate corresponding audit-ready documentation.

This allows organizations to choose a method according to:

• 01DSP-DPDP India
• 02NIST SP 800-88 Rev. 1 Clear
• 03NIST SP 800-88 Rev. 1 Purge
• 04NIST SP 800-88 Rev. 2 Clear
• 05NIST SP 800-88 Rev. 2 Purge
• 06IEEE 2883-2022
• 07ISO/IEC 27040:2024
• 08Random Overwrite
• 09DoD 5220.22-M
• 10DoD 5220.22-M ECE
• 11NSA/CSS Policy Manual 9-12
• 12HMG IS5 Baseline
• 13HMG IS5 Enhanced
• 14CSEC ITSG-06
• 15BSI-GSE
• 16BSI VSITR
• 17Gutmann Method
• 18Schneier Algorithm
• 19Pfitzner Method
• 20AFSSI-5020
• 21AR 380-19
• 22GOST R 50739-95
• 23NZISM
• 24NAVSO P-5239-26
• 25RCMP TSSIT OPS-II

DoD 5220.22-M should not be described as a current U.S. Department of Defense data-sanitization standard.

DCSA states that 32 CFR Part 117 replaced the NISPOM previously issued as DoD policy under DoD 5220.22-M and DCSA records DoD 5220.22-M as cancelled on December 10, 2021.

Therefore:

DoD 5220.22-M=Legacy / Historical Methodology

32 CFR Part 117=Current NISPOM Framework

NIST SP 800-88 Rev. 2=Current NIST Media Sanitization Guidance