UAE
Quick answer: NIST SP 800-88 Revision 2, finalized in September 2025, supersedes Revision 1 and places greater emphasis on an organization-wide media sanitization program, validation and trustworthy vendor controls. UAE IT teams retiring laptops, SSDs or servers should request device-level inventories, appropriate sanitization methods, verification evidence and signed disposition records. A vendor's marketing claim alone is not certification.
When a UAE company retires laptops, desktops, servers or SSDs, the main question is not simply “Was it wiped?” It is whether the organization can show that its chosen method was appropriate, performed and verified for each relevant asset.
The US National Institute of Standards and Technology published SP 800-88 Revision 2 as final on 26 September 2025, superseding Revision 1. NIST's publication announcement emphasizes enterprise sanitization programs, maintaining confidentiality, validation and trust in sanitization tools and providers. This matters for organizations managing hundreds of drives across branches, not just a technician erasing one laptop.
Build a manifest that links each physical asset to its storage media. A laptop may contain multiple drives; a server may contain many. Record the asset tag, serial, drive type, storage capacity, physical condition, data classification, business owner and intended disposition. Do not assume the laptop's outer serial number is sufficient to identify every internal drive.
| Decision area | Questions for IT and security | Evidence to request |
|---|---|---|
| Reuse or resale | Can data be rendered inaccessible at the required assurance level? | Approved method, execution log, validation result |
| Encrypted media | Is cryptographic erase supported and were keys managed correctly? | Device and encryption evidence, key-handling record |
| Failed SSD or HDD | Can a software method reach and verify all relevant media? | Exception record and approved alternative disposition |
| Physical destruction | What destruction process and downstream custody apply? | Media-linked certificate and handover records |
Do not assume an overwrite routine suitable for a conventional hard drive is automatically suitable for an SSD. Storage architecture, wear-leveling, firmware, encryption and failed sectors can change the appropriate approach. Use the current standard and manufacturer guidance to approve a method.
Terms such as “NIST-certified wiping” may be used loosely in marketing. NIST SP 800-88 is a guidance publication; merely citing it does not establish that a vendor holds an independent certification. Ask to inspect a redacted sample certificate, exception handling policy, validation procedure, subcontractor arrangements and the current revision used in the vendor's SOP.
If your procurement policy, statement of work or vendor webpage still names SP 800-88 Revision 1, flag it for a controlled review. A reference to the older version is not automatic evidence of insecure handling, but the current guidance should be evaluated before the next engagement. Document whether your method selection and verification controls require changes.
Rekart's IT asset disposition page describes collection, inventory, erasure, reuse or recycling, and documentation. Its public text includes references to the older Revision 1; buyers should ask the team which current methods, controls and evidence apply to their actual contract. Use Rekart for Business to request a scoped proposal and sample documentation. This article is an evaluation checklist, not a claim that a particular batch has been certified or that a certificate alone satisfies UAE law.
Yes. NIST published Revision 2 as final in September 2025, replacing Revision 1. Organizations should reference the current document when reviewing their media sanitization policies.
No. Citing a NIST publication or claiming to follow it does not itself prove third-party certification. Request the vendor's actual controls, tool evidence, staff procedures and any independently verifiable certification.
No. Ordinary deletion is not equivalent to a validated sanitization process. The appropriate technique depends on media type, sensitivity, encryption state and organizational policy.
Not necessarily. Properly validated sanitization can support reuse where the media and risk assessment permit it. Destruction may be appropriate for failed, inaccessible or especially sensitive media.
Request a unique device or media identifier, method, date, operator or service reference, outcome and verification details. Agree on required fields before handing over the equipment.
No single certificate guarantees compliance with every applicable UAE privacy, records or waste obligation. Ask your legal and security teams to approve the process against the data and jurisdiction involved.
Rekart editorial team — guides for certified refurbished tech in the UAE.
