For classified storage media, equipment procurement is rule-bound. The National Security Agency maintains the Evaluated Products List (EPL) through its Center for Storage Device Sanitization Research (CSDSR), and any device used to destroy classified information must appear on the relevant list. The most current authoritative reference is the NSA/CSS Storage Device Sanitization and Destruction Manual (Policy Manual 9-12) dated 19 February 2026, with the seven product-category EPLs themselves dated April 2026. NSA EPL equipment selection is the procurement workstream that federal IT teams, cleared contractors, and SCIF managers either get right or get audited on.
This is the companion guide to our broader Classified Data Destruction: NSA Standards and Requirements pillar. Where that piece treats the full classified disposition framework, this article focuses on the equipment side: how the seven EPLs map to media types, what particle sizes the standard enforces, and what to verify before procurement.
Why Does the EPL Exist as a Procurement Gate?
Classified destruction operates on a different premise than commercial sanitization. NIST SP 800-88 Revision 2 (September 2025) governs civilian-side media sanitization with a risk-based framework that allows the agency to choose Clear, Purge, or Destroy based on data confidentiality. Classified destruction does not work that way. For information classified Confidential, Secret, or Top Secret (and Sensitive Compartmented Information at any classification), the standard requires destruction at specific particle sizes using equipment that has been independently tested by NSA against published performance specifications.
The EPL is the published outcome of that testing. NSA’s CSDSR runs degaussers against coercivity tolerances, runs disintegrators against particle-size verification, and runs shredders against duration-and-throughput durability tests under standardized conditions. Devices that meet specification are added to the relevant EPL with model number, sponsor, and any usage caveats. Devices that fail are not listed, and devices that have not been submitted are not listed regardless of how their published specifications read.
This matters operationally for two reasons. First, a procurement officer cannot lawfully accept a vendor’s representation that a device “meets NSA specifications” if the device is not on the relevant EPL; the EPL is the verification mechanism. Second, the EPLs are dated and revised, which means a device that was listed five years ago may not be listed today, and a device’s particle-size compliance may have been recalibrated as the standard tightened. NSA EPL equipment selection requires checking the current dated list, not a vendor brochure.
Has your agency verified its destruction equipment against the current April 2026 EPLs? Take the free ITAD Readiness Assessment →
What Are the Seven EPL Categories?
NSA maintains seven distinct EPLs, each scoped to a specific media class and destruction mechanism:
- EPL for High Security Crosscut Paper Shredders. Devices evaluated against NSA/CSS Specification 02-01 (Level 6/P-7) that reduce paper to particles of 1mm × 5mm or smaller. Approved for all classification levels including SAP, COMSEC, SCI, and Top Secret paper destruction.
- EPL for Paper Disintegrators. Industrial-scale disintegrators that reduce paper to 5mm or smaller particles via chopping, pulverizing, or wet pulping. Used at high-volume facilities where shredder throughput is insufficient.
- EPL for Magnetic Degaussers. Degaussers tested for coercivity sufficient to randomize the magnetic domains of evaluated media. The standard recognizes that media with coercivity greater than 3,000 Oersteds requires specific high-power degaussing equipment, and the EPL distinguishes accordingly.
- EPL for Hard Disk Drive Destruction Devices. Crushers, deformers, and shredders that physically damage HDDs after degaussing. The standard is sequenced: degauss first, then physically deform or disintegrate to nominally 2mm particles.
- EPL for Solid State Disintegrators. Disintegrators that reduce solid-state media (SSDs, USB drives, micro-SD cards, eMMC modules) to particles 2mm or smaller on edge. This is the most demanding particle-size specification in the manual, reflecting the data density of modern flash memory.
- EPL for Optical Destruction Devices. Devices that disintegrate optical media (CD, DVD, Blu-ray) to 2mm particles, or alternatively subject the media to incineration above specified temperature thresholds.
- EPL for Punched Tape Disintegrators. A narrower category for legacy media still resident in some classified environments. Particle-size specification mirrors the paper disintegrator standard.
The seven-list structure matters because the EPL is not a single document. NSA EPL equipment procurement that says “device is on the EPL” is incomplete; the question is which EPL, with which dated revision, and for which media class.
How Do the Particle Sizes and Sequencing Rules Work?
The destruction methodology hinges on physical specification, not procedural compliance. The current Policy Manual 9-12 destruction specifications:
- Magnetic HDDs and tapes. Degauss using an EPL-listed degausser sufficient for the media’s coercivity, then physically deform the drive (a separate EPL-listed crusher) before release. If disintegration replaces deformation, the resulting particles must be nominally 2mm in size.
- Solid-state media. Degaussing is ineffective on flash memory because data is stored electronically rather than magnetically. The standard mandates direct disintegration to particles 2mm or smaller on edge. This is sometimes called “micro-shredding” in vendor materials; the operative measurement is the 2mm-on-edge specification, not the marketing term.
- Optical media. Disintegration to 2mm particles using EPL-listed optical disintegrators, or incineration at temperatures specified in the manual (above 600°C is the typical operational threshold).
- Paper. Crosscut shredding to 1mm × 5mm particles using a Level 6/P-7 EPL-listed shredder, or disintegration to 5mm or smaller via EPL-listed paper disintegrator. Wet pulping is permitted for high-volume environments.
The sequencing for magnetic HDDs is the part most often missed in procurement reviews. Degaussing alone, without subsequent physical deformation, does not satisfy the standard. Conversely, physical deformation alone, without prior degaussing on a still-readable drive, does not satisfy it either. Both steps are required, and both pieces of equipment must be EPL-listed for the respective function.
Does your destruction workflow document the degauss-then-deform sequence for magnetic media? Take the free ITAD Readiness Assessment →
What Should Federal IT Teams and Cleared Contractors Verify Before Procurement?
NSA EPL equipment procurement should pass through five verification gates before any purchase order is signed.
Confirm the device is on the current EPL revision. April 2026 is the current revision date for the seven equipment EPLs. Check the NSA Media Destruction Guidance page directly rather than accepting a vendor-supplied PDF; the lists are revised periodically and stale copies circulate.
Confirm the device matches the media class. A device on the optical destruction EPL is not interchangeable with one on the solid-state disintegrator EPL, even if they look mechanically similar. Procurement language should specify the EPL by name (for example, “must appear on NSA/CSS Evaluated Products List for Solid State Disintegrators dated April 2026”).
Confirm the device’s particle-size and throughput verification. Each EPL entry includes the model’s tested specification. For shredders, the EPL also lists feed throat width and the quantity of paper reams shredded in the one-hour durability test. Procurement that does not match throughput to actual workload will surface in operational use.
Confirm sponsor and manufacturer relationship. EPL entries identify the sponsor (typically the manufacturer or its US representative). For SCIF and contractor environments where supply-chain provenance matters under the National Industrial Security Program Operating Manual (NISPOM, 32 CFR Part 117), the sponsor relationship should align with the agency’s TSP and CMMC-relevant supply-chain expectations.
Confirm operational deployment requirements. Some EPL-listed devices require facility infrastructure (industrial three-phase power, dust extraction, sound attenuation) that exceeds standard office or SCIF capacity. Witnessed-destruction protocols and cleared-personnel requirements layer on top: a device meeting the specification is necessary but not sufficient if the operating environment cannot support cleared, witnessed destruction.
The major equipment manufacturers operating in this space are Security Engineered Machinery (SEM), Garner Products, Data Security Inc., Phiston Technologies, Whitaker Brothers (Datastroyer), and HSM. Their products appear across the seven EPLs, and most maintain catalogs that map their devices to the relevant EPL category. The catalog is a starting point, not a substitute for verification against the current dated list.
Where You Stand Matters
NSA EPL equipment compliance is binary in a way that most ITAD compliance is not. Either the destruction device is on the relevant current-revision EPL for the media class, or it is not. Either the particle-size specification has been verified, or it has not. Either the degauss-then-deform sequence is documented, or it is not. There is no proportional or risk-based reading of the standard for classified information; the specification is the specification.
The agencies and cleared contractors that get this right tend to share three operational habits. Procurement language references the specific EPL by name and revision date, not “NSA-approved” as a generic claim. Equipment is reverified against the current EPL revision on a periodic schedule, typically annually, because the lists change. And the destruction workflow itself is documented at the sequence level, with the degauss-then-deform pattern for magnetic media and the disintegration-with-particle-verification pattern for solid-state media surfaced explicitly in SOPs.
For agencies and contractors whose classified destruction equipment was last verified against an older EPL revision, the practical first step is a baseline assessment of current state: which devices are deployed, which EPL each is listed on, what the current revision date is, and which workflow steps are documented. That assessment is the substrate for any procurement refresh, and it is what an audit or facility-clearance review will surface first.
Ready to assess your agency’s classified destruction posture against the current EPLs? SureDispose’s free assessment evaluates your destruction equipment, sequencing documentation, and procurement language against the April 2026 EPL revisions, then connects you with certified providers matched to federal contracting requirements. Take the Assessment →
Further reading:
- NSA Media Destruction Guidance and EPLs
- NSA/CSS Policy Manual 9-12: Storage Device Sanitization and Destruction Manual
- NIST SP 800-88 Revision 2: Guidelines for Media Sanitization
- NISPOM (32 CFR Part 117) Federal Register text
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.
This article is educational and reflects SureDispose’s reading of publicly available federal guidance as of April 30, 2026. It is not legal advice. Procurement and compliance determinations for your agency or contract are the responsibility of your contracting officer, security officer, and counsel. Specific guidance documents referenced are summarized from the relevant NSA and NIST publications; characterizations are the issuing agency’s, not SureDispose’s.