A lot of this is driven by regulatory, compliance or other outside factors. Working in finance, healthcare, and other secure industries you must demonstrate co

A lot of this is driven by regulatory, compliance or other outside factors. Working in finance, healthcare, and other secure industries you must demonstrate control of the environment, which includes processes to clear up data. Once a standard is common it’s easier to follow it and demonstrate that adherence to a regulator than it is to invent your own process and convince them it’s safe. Even in current world with SSDs that don’t follow the same mechanics as spinning disks, regulators expect a 9-pass DoD wipe because that’s what they’re used to. It’s easiest to just pass drives to a certified data destruction company who will provide a cert of evidence they did a DoD, NIST, etc certified wipe. Reality is seldom part of the process. Similar is the process for password resets. Regulars ask for 90 day resets and crazy complexity schemes when NIST actually just recommends relatively sane complexity, slightly longer passwords and no rotation.