Auditors and assessors
What to ask an operator for
We build the system that produces this evidence, so read it with that in mind.
- Written for
- Assessors
- Jurisdiction
- United States
- Standard
- NIST SP 800-88 Rev. 2
Start with one device, not the policy
Pick a serial off a certificate issued months ago and ask what happened to that device.
- Can they show the capture, not just a line in a spreadsheet?
- What was read, and what was decided?
- The method, the date, and who confirmed it.
- Can the record be shown not to have changed since?
Verification and validation are separate
- Verification is per device: did sanitization run on this one?
- Validation is per method: does it work on this class of media?
What each standard asks the record to show
Clause by clause: what the standard asks for, how it's usually done, and what Serial Xtractor records.
| Standard | Asks for | Today | With Serial Xtractor |
|---|---|---|---|
| NIST SP 800-88 Rev. 2 · §4.6 | A certificate of sanitization for each item | One certificate for the whole load | Partly recorded: One certificate per job, a line for every device |
| NIST SP 800-88 Rev. 2 · §4.6 | The serial number, per item | Typed, or scanned at a bench | Recorded by Serial Xtractor: Read from the label in under a second |
| NIST SP 800-88 Rev. 2 · §4.6 | Media type, and the method — clear, purge or destroy | Typed onto the certificate | Recorded by Serial Xtractor: Recorded per device, method printed on the certificate |
| NIST SP 800-88 Rev. 2 · §4.6 | Verification — each item checked and recorded | One signature for the batch | Partly recorded: Each device recorded with its time and capture |
| NIST SP 800-88 Rev. 2 · §4.6 | Validation — the method shown to work | Often never written down | Stays with the operator: Stays with you — one written basis per method |
| NIST SP 800-88 Rev. 2 · §4.6 | Who performed and who verified — with a signature | Typed onto the certificate | Partly recorded: All recorded and printed — signature still wet-ink |
| R2v3 · Appendix B(2) | Traceability for each device * | A spreadsheet | Recorded by Serial Xtractor: Per device, shown and correctable before certifying |
| R2v3 · Appendix B(15)(b) | Processed matches received | A count at each end | Recorded by Serial Xtractor: Matched, missing and unexpected — by serial |
| NAID AAA · 4.3 | Every drive serial, logged and returned † | The operator's own log | Recorded by Serial Xtractor: A per-device log on the certificate, sent to the client |
| R2v3 B(9) · NAID AAA 2.5 | Video of destruction | Facility CCTV | Stays with the operator: Stays with your CCTV |
- Recorded by Serial Xtractor
- Partly recorded
- Stays with the operator
- NIST SP 800-88 Rev. 2 is guidance — §4.6 says the certificate should record these, and treats verification (per device) and validation (per method) separately.
- * R2v3 accepts the identifier “or tracking through other means”, so a spreadsheet conforms.
- † Unless the data controller signs an opt-out.
- These standards bind the operator. Read from NIST SP 800-88 Rev. 2, R2v3.1 and the NAID AAA manual 0925M.
Three things that look like evidence and aren't
- A batch line. Forty drives on one row can't carry a result for any one of them.
- A certificate with no per-device records behind it.
- A method statement citing Rev. 1, withdrawn in September 2025.
When a record claims to be tamper-evident
- What is signed, and who holds the key?
- Can you verify it without the vendor?
- Is the timestamp trusted, or the device's own clock?