Why Classified Data Destruction Is in a Different League
When your agency disposes of a workstation that handled unclassified data, NIST SP 800-88 Rev. 2 is the rulebook. When that same workstation handled classified or CUI information, NIST is the floor, not the ceiling. Classified data destruction operates under a separate, stricter regime governed by NSA/CSS Policy Manual 9-12, and the equipment, procedures, and documentation requirements are not optional. Get this wrong and you are not looking at a FISMA finding. You are looking at a national security incident, a 1XX series report to your security officer, and the kind of conversation no agency leader wants to have with the inspector general’s office. This is the part of Government ITAD that keeps security officers awake at night, and rightly so.
What Does NSA/CSS Policy Manual 9-12 Actually Require?
Policy Manual 9-12, the NSA/CSS Storage Device Sanitization and Destruction Manual, governs the destruction of media containing classified and sensitive government information. The core requirement is simple to state and unforgiving in practice: equipment used to destroy classified media must be tested by the NSA/CSS Center for Storage Device Sanitization Research and listed on the appropriate NSA Evaluated Products List (EPL). There are separate EPLs for degaussers, hard drive destroyers, solid state disintegrators, optical media destroyers, and paper shredders. If the device you are using is not on the right EPL for the media you are destroying, you are not compliant, full stop. You can review the current evaluated products lists on the NSA Media Destruction Guidance page.
What Are the Particle Size Requirements for Classified Media?
Particle size is where classified data destruction gets specific. SSDs, NVMe drives, USB flash, M.2 modules, and other solid state media must be reduced to a maximum edge size of 2mm using equipment on the NSA EPL for Solid State Disintegrators. That is because flash memory cells store enormous amounts of data in tiny physical areas, and a fragment larger than 2mm could potentially contain recoverable information. DVDs and Blu-ray discs also require 2mm maximum particle size. CDs are allowed up to 5mm. Classified paper requires a 1mm by 5mm cross cut, fine enough to make reconstruction impractical. A standard office shredder producing 6mm strip cut output does not come close to meeting these requirements, and a commercial SSD shredder that is not on the NSA EPL is not acceptable for classified work no matter how small its output.
Why Can’t You Just Degauss a Classified Hard Drive and Move On?
You can, sort of, but the rules changed. Effective in 2021, NSA hard drive sanitization standards require both degaussing and physical destruction before magnetic media is removed from its secure environment. Degaussing alone is not enough. The hard drive must be physically damaged by deforming the internal platters, typically through crushing or shredding using equipment on the NSA EPL for Hard Disk Drive Destruction Devices. And critically, degaussing does not work on solid state drives at all. SSDs store data using electrical charges in flash memory cells, not magnetic fields, so a degausser will have zero effect. For classified SSDs and flash media, physical disintegration to 2mm is the path. Hybrid drives manufactured in 2013 and later require additional procedures because they contain both magnetic and solid state components.
How Does CUI Change the Classified Data Destruction Picture?
Controlled Unclassified Information sits below classified but above public release, and the disposal rules are governed by 32 CFR Part 2002 and the NARA CUI Program. CUI must be destroyed in a manner that makes it unreadable, indecipherable, and irrecoverable. The accepted technical baseline is NIST SP 800-88 Rev. 2 Purge or Destroy, but many CUI categories carry handling instructions from the originating agency that effectively push you toward the same NSA EPL equipment used for classified work. If your agency or contractor handles CUI tied to defense, intelligence, or law enforcement programs, treat the destruction requirements as classified adjacent. The cost of over destroying CUI is negligible. The cost of under destroying it can include contract termination, debarment, and federal investigation.
What Does Witnessed Destruction Actually Look Like?
Witnessed destruction means at least two authorized personnel are present to observe the destruction process, verify the equipment used, confirm the media identity, and sign documentation attesting to what happened. For classified work, this is not a nice to have. It is a procedural requirement designed to ensure no media gets diverted, mishandled, or inadequately destroyed without independent verification. Best practice adds video documentation, especially for high sensitivity destruction events, so the evidence is preserved beyond the witness signatures. The destruction record should capture the date, time, location, equipment make and model and serial number (so it can be cross referenced against the EPL), the operator, the witnesses, the media identifiers, and the destruction method. Anything less leaves your security officer with a credibility problem if the destruction is ever questioned.
So Why Is Classified Data Destruction Worth Treating as a Separate Discipline?
Because the consequences of getting it wrong are categorically different. Failing to properly sanitize unclassified hardware is a compliance problem. Failing to properly destroy classified or CUI media is a national security problem, a contracting problem, and potentially a criminal problem. Classified data destruction requires NSA EPL listed equipment matched to the specific media type, the right particle size, the right combination of degaussing and physical destruction for magnetic drives, witnessed destruction with two person integrity, and asset level documentation that can survive an inspector general or counterintelligence review. Shortcuts at this level are not cost savings, they are exposures. If your agency or contractor handles classified or CUI information, build your destruction program around NSA/CSS Policy Manual 9-12, verify every piece of equipment against the current EPL, document everything, and treat witnessed destruction as the non negotiable control it is. That is what defensible classified data destruction actually looks like.