Table Tag: NSA

What CIOs Need to Know About High Security Data Destruction

September 15, 2025 at 8:00 am by Amanda Canale

Chief Information Officers (CIOs) play a critical role in overseeing the full lifecycle of data—from its creation and use to its secure destruction once it reaches end of life. While the vast majority of organizations invest heavily in data storage, cybersecurity, and backup protocols, many overlook the importance of a robust and compliant data destruction strategy.

For C-suite leaders, particularly CIOs responsible for enterprise information security, understanding high security data destruction is not just a matter of best practice, but a mission-critical priority tied to regulatory compliance, operational integrity, and reputational protection.

Critical Shreds

  • Secure data disposal must be integrated into the organization’s core data security strategy to prevent post-use breaches and reputational harm.
  • Compliance frameworks like GDPR and HIPAA require detailed records of how and when data is destroyed, including who performed the task.
  • Digital wiping is simply not enough. Hard drives, SSDs, and other media must be physically destroyed using NSA-approved methods to ensure it is irrecoverable.
  • Destruction technologies should evolve with storage trends while aligning with sustainability and environmental responsibility goals.

The Strategic Imperative of Data Destruction

High security data destruction is far more than simply erasing files or decommissioning hardware. It is a comprehensive, policy-driven approach to ensuring that sensitive data—whether digital or physical—is rendered completely unrecoverable. With increasing regulatory oversight, evolving cyber threats, and growing volumes of data stored across physical devices, cloud environments, and hybrid networks, it is crucial that CIOs treat end-of-life data destruction as an integral part of their organization’s data security strategy.

More than ever, data destruction must be viewed through a strategic lens. CIOs are charged not only with protecting data while it is in use but also ensuring that data cannot be compromised after it has served its purpose. This includes everything from shredded paper records to degaussed, classified hard drives to end-of-life SSDs that require physical destruction with NSA-evaluated equipment. Failing to address this last phase of the data lifecycle leaves organizations vulnerable to data breaches, fines, and long-term brand damage.

Chief Information Security Officer presenting data

Understanding Compliance in the Age of Data Regulation

High-security data destruction is inseparable from regulatory compliance. Laws such as the GDPR and HIPAA—as well as guidelines from NIST, the Department of Defense (DoD), and the NSA—require strict oversight of how data is disposed.

To remain compliant, organizations must go beyond simply destroying data; they must maintain verifiable records detailing how, when, and by whom the destruction occurred. This is especially critical in regulated sectors like healthcare, finance, and defense, where thorough documentation and a clear chain of custody are essential.

It’s up to CIOs to ensure that destruction methods align with their organization’s risk profile, data classification, and regulatory exposure. Even more important to note is that in-house solutions are preferable, offering greater control and traceability while supporting long-term compliance when it comes to audits.

The Physical Dimension of Digital Security

While cloud security and firewalls dominate the cybersecurity conversation, CIOs cannot afford to neglect the physical destruction of data-bearing devices. Data stored on hard drives, SSDs, optical media, and even flash-based storage is often far more persistent than assumed. Standard wipe techniques may leave residual data intact—particularly on SSDs—posing a serious threat if those devices are lost, sold, or recycled without proper destruction.

High security destruction methods, such as NSA-listed degaussers, disintegrators, crushers, and shredders, are specifically engineered to irreversibly destroy media to a point where data recovery is impossible. For organizations handling classified, proprietary, or regulated data, these solutions are not optional, but rather they are essential components of a secure IT infrastructure.

CIOs must lead the charge in implementing enterprise-wide policies that mandate secure media destruction. This includes not only establishing chain-of-custody procedures, but also securing access to destruction equipment, and maintaining logs and certifications for all destroyed assets. By institutionalizing these protocols, CIOs help reduce the risk of attacks and close the gap between cybersecurity and data lifecycle management.

blue and purple data center with running binary code

Managing Risk with Proactive Governance

Data destruction is not a one-time event; it’s a discipline that must be embedded into the organization’s risk management framework. CIOs must collaborate with Chief Information Security Officers (CISOs), legal counsel, and even compliance officers to develop and enforce governance frameworks that account for the secure disposition of all data assets. This includes cloud and hybrid environments where data may be dispersed across multiple geographies and vendors.

The financial and reputational costs of improper data disposal can also be quite severe. Breaches resulting from discarded or resold devices, inadvertent disclosures of sensitive information, or failure to meet data retention schedules are increasingly common—and costly. In contrast, proactive data destruction policies significantly reduce the risk of exposure, bolster compliance, and demonstrate a strong commitment to data stewardship to regulators, customers, and stakeholders.

Future-Proofing the Enterprise

As storage technologies evolve, so must destruction methods. CIOs need to stay informed about advancements in data storage. Destruction solutions must be able to keep pace with these innovations to ensure future-proof security. Investing in modular or scalable equipment designed to meet NSA and international destruction standards helps enterprises maintain compliance over time and avoid costly retrofits or replacements.

Furthermore, the growing focus on sustainability and environmental responsibility means that data destruction practices must also align with environmental goals. Solutions that offer clean, energy-efficient destruction or support e-waste recycling without compromising security will continue to gain relevance for CIOs tasked with balancing security, compliance, and corporate responsibility.

Conclusion

For the modern CIO, high security data destruction is no longer a technical afterthought—it’s a strategic imperative. As stewards of enterprise data, CIOs must ensure that destruction policies are compliant, auditable, and aligned with organizational risk. By embracing a comprehensive, forward-looking approach to secure data disposal, CIOs can close critical security gaps, support compliance mandates, and help future-proof their organizations in an increasingly complex data environment.

 

Cyber Operational Readiness Assessment (CORA): A Strategic Imperative for Federal Security

July 21, 2025 at 8:00 am by Amanda Canale

In March 2024, the Department of Defense’s cyber operations wing, Joint Force Headquarters–Department of Defense Information Network (JFHQ-DODIN), rolled out the Cyber Operational Readiness Assessment (CORA) program. The new initiative will be responsible for introducing a new era of cyber evaluation and replacing the long-standing Command Cyber Readiness Inspection (CCRI).

Unlike its predecessor, CORA isn’t about checking compliance boxes. Instead, it’s a forward-leaning, mission-driven approach to cybersecurity, fundamentally shifting how the defense ecosystem protects its most critical digital assets.

Critical Shreds

  • The new initiative marks a pivotal shift from compliance‑based cybersecurity to mission‑focused operational readiness.
  • The program emphasizes on MITRE ATT&CK–informed risk indicators, enabling targeted mitigation of cyberattack methods.
  • It is adaptive with assessments updating in real time based on threat intelligence and policy changes.
  • CORA strengthens perimeters and high‑priority systems, aligning limited resources with maximum impact.

A Mission-First Mindset

For over a decade, the CCRI served as the standard for evaluating cybersecurity posture within the DoD. These inspections provided a scorecard of sorts on compliance with security policies and technical controls. However, the approach had clear limitations. It focused heavily on documentation and the consistent enforcement of policies across the board, often without fully addressing the real-world risks posed by evolving cyber threats.

As threat actors continued to grow more sophisticated by using stealthy tactics to exploit misconfigurations and human error, DoD leadership recognized the critical need for a new model. Enter CORA: an agile, intelligence-led framework designed to better reflect real-world risk environments. The program would redefine cybersecurity assurance by focusing on mission assurance, strengthening the DoD’s cybersecurity systems and strategies that matter most when security is on the line.

Air Force Lt. Gen. Robert Skinner, the commander of the JFHQ-DODIN, describes the program’s goal as providing commanders and directors with, “a more precise understanding of high-priority cyber terrain.” In practice, this means key stakeholders can gain a clearer view of critical cyber assets, enabling a more effective and targeted defense strategy that better supports essential operations and empowers improved control and decision-making.

American flag made up of binary code

What Makes CORA Different?

CORA shifts the focus from “Are we compliant?” to “Are we ready?” It’s a readiness assessment, not an audit. This means that evaluations are tailored to the mission of each organization and to the actual threats they face, not just whether they’ve completed policy checklists.

Central to this shift is the use of Key Indicators of Risk (KIORs). These indicators are developed using the MITRE ATT&CK framework, which catalogs common tactics, techniques, and procedures (TTPs) used by threat actors in the wild. By mapping a system’s vulnerabilities and configurations against these known methods, CORA assessments prioritize the risks that could impact operational success the most.

A Continuous and Adaptive Process

One of the most significant benefits CORA brings to the table is adaptability. Unlike the rigid evaluations and cycles of CCRI, CORA is a continuous assessment model that evolves in real time. Its structure allows JFHQ-DODIN to adjust the scope of assessments based on new policy directives, threat intelligence, or known vulnerabilities across the Department of Defense Information Network (DODIN).

For example, if a new threat actor is observed targeting edge devices like routers or firewalls, CORA assessments can pivot quickly to evaluate exposure in those areas. This makes the program not just a snapshot in time, but a living strategy that mirrors the dynamic nature of cyber warfare.

Enhanced Boundary Control

Another hallmark of CORA is its emphasis on boundary defense. Boundary systems—such as firewalls, VPN concentrators, and routers—serve as the entry points into a network, forming the barrier between internal DoD systems and the public internet. They are often the first line of defense and, unfortunately, a frequent target for attacks.

The CORA framework places elevated priority on these devices because of their role in protecting mission-critical environments. Misconfigured boundary systems can be exploited for initial access, lateral movement, or data theft. To mitigate these malicious attempts, CORA encourages rigorous, up-to-date configuration management and auditing of these access points.

Military personnel in data center

Real-World Application

CORA’s debut reflects a much broader move towards aligning cyber defense with military command intent. As noted earlier by Lt. Gen. Robert Skinner, the program was designed to give commanders and directors better control over their most critical terrain in cyberspace. Instead of treating all systems equally, CORA distinguishes between those that are peripheral and those that are vital to a mission’s success.

A key element of the rollout is collaboration. CORA assessments involve not only cyber specialists but also leadership across the operational chain, ensuring that recommendations align with the specific needs and realities of the mission at hand.

What This Means for the Broader Security Community

For federal agencies, defense contractors, and companies working with classified data or within the Defense Industrial Base (DIB), CORA signals a cultural shift in cybersecurity expectations. While not every entity will undergo a CORA directly, its principles are likely to filter down through requirements, standards, and best practices, especially for organizations managing Controlled Unclassified Information (CUI).

What commanders and directors can expect is more of an emphasis on active risk identification, real-world threat modeling, boundary hardening, and evidence-based security configurations. Compliance will always remain important, but it will no longer be enough on its own.

Conclusion

The launch of CORA is not just about replacing a program; it’s about reshaping how the defense community understands and practices cybersecurity. In an environment defined by constantly evolving threats, the static, audit-centric model of CCRI simply couldn’t keep up.

CORA represents the future: continuous, adaptive, and mission-focused. It recognizes that true security isn’t about passing inspections, but rather about staying ready when it matters most.

For those in the security industry, from government to private sector, CORA offers a powerful new lens for understanding what it means to be cyber-ready. And as cyber becomes increasingly embedded in every aspect of national defense, readiness is no longer optional; it’s operational.

Uptime Institute’s Tier Classification: Everything You Need to Know

July 25, 2023 at 7:01 pm by Amanda Canale

Just as Security Engineered Machinery has been the global standard when it comes to high security data destruction solutions, the Uptime Institute’s Tier Classification has served as the international standard for data center performances. The classification evaluates data centers’ server hosting availability and reliability, and for the past 25 years, the Uptime Institute has had over 2,800 certifications in over 114 countries across the globe.

With the Uptime Institute’s Tier Classification, comes four tiers that are centered on data center infrastructure and define the criteria needed for maintenance, power, cooling, and fault capabilities: Tiers I, II, III, and IV.

Before we dive into the Uptime Institute’s Tier Classification, I want to run through some data center vocabulary:

Uptime

Uptime is the annual amount of time that a data center is guaranteed to be available and running. This time increases in degrees of “nines,” or a 99% availability guarantee. A data center with 99.671% uptime offers far less availability and reliability than one that has 99.982% uptime. 

Essentially, a data center wants to achieve as many “nines” as possible. A 99.9% availability (or “three nines”) will still allow for approximately eight hours of downtime per year. If a data center has 99.999% (“five nines”) then they have less than six minutes of downtime per year, or approximately twenty-six seconds per month.

Downtime

Downtime is the annual amount of time that a data center and its availability will be interrupted. Downtime can occur for a number of reasons: routine maintenance, hardware failures, natural disasters, cyberattacks, and the most common, human error. 

Whenever a data center experiences downtime, there’s a cost: according to the ITIC’s 11th Annual Hourly Cost of Downtime Survey, an hour of downtime can cost some firms and corporations anywhere from $1 to $5 million, not including any potential legal fees, fines, and penalties. The more downtime a data center has, the higher the risk they run of data breaches due to the lack of or little protection and security monitoring they have during this time. It’s also important to mention that downtime not only affects the data center employees: downtime prevents outside customers and clients form accessing services and information, too. So even if a data center experiences downtime that does not result in a data breach, it can have very real monetary and reputational consequences.

Redundancy

Redundancy is a data center component designed to duplicate primary resources and power in the case of failure. These fail-safe systems can be in the form of backup generators, uninterruptible power systems (UPS), and cooling systems, to ensure that data centers can continue to run if another component fails.

Now, let’s dive into each tier!

Tier I

Tier I is a data center at its most basic level of availability. This first tier offers no guarantee of redundancy and at a minimum, offers data centers an UPS for power spikes, lags, and outages. Most small businesses and warehouses that lack around-the-clock operations with minimal power operate at a Tier I level. Tier I facilities operate on a single distribution path for power and cooling, which can easily be overloaded or fall susceptible to planned and unplanned disruptions. In return, Tier I offers 99.671% redundancy, meaning that there is a maximum of 28.8 hours of downtime per year, allowing a lot of vulnerable room for any kind of disruption and subsequent breach. 

Tier II

Tier II facilities offer a bit more uptime, with a 99.741% rating, equaling no more than 22 hours of downtime per year. Like Tier I facilities, Tier II’s operate on a single distribution path for power and cooling but offer other options for maintenance and disruption mitigation. Some of these features include engine generators, cooling units, pumps, and heat rejection equipment. While not by much, this little bump in availability can guarantee data center’s reliability, but it still does not fully protect them from unexpected shutdowns.

Tier III

Unlike Tier I and II facilities, Tier III’s are generally utilized by larger businesses and offer more than one redundant distribution path, meaning that the infrastructure has the capacity and availability to fully support the IT load and offer backup to ensure performance and reliability. This spike in reliability allows for 99.982% of uptime, resulting in less than or equal to 1.6 hours of downtime per year.

While this tier is significantly more reliable, it is not completely fault tolerant. Tier III allows for routine maintenance without impacting service, but are still vulnerable to outages, spikes, and power lags. 

Tier IV

Tier IV is the most sophisticated tier and is typically used by enterprise corporations. This tier offers twice the operational capacity (or 2N) as well as additional backup components (or +1), for ultimate reliability. In this tier, every critical component of the data center’s primary infrastructure is duplicated and fired at max capacity, meaning that even in a disruption, operations are able to continue. 

Tier IV facilities offer a 99.995% uptime per year, or less than or equal to 26.3 minutes of downtime. While this level of classification can be the most expensive to implement, it is the one generally populated by government organizations and larger enterprise corporations.

data-protection-officer

Conclusion

The Uptime Institute’s Tier Classification demonstrates that in any data center setting and scale, it is absolutely vital to have redundancies in place in order to have the lowest amount of down time possible. Data centers should strive to reach the highest tier in order to maintain their high levels of performance, availability, and reliability.

In equal vitality, ultimate data center security also requires a detailed and clear data decommissioning program as part of their operations plan to ensure other safety, security, and operational safeguards are in place. The best way to achieve that level of security is with an in-house destruction plan for HDDs, SSDs, and other data center media types. When implemented improperly, data centers can fall subject to breaches and experience extreme financial loss and irredeemable public trust. At SEM, we offer NIST 800-88 compliant degaussers, crushers, and shredders that are versatile enough to fit in any environment and scale along with auditing and documentation systems. 

Since our inception in 1967, SEM has served as the industry leader in high security, comprehensive end-of-life data destruction solutions that ensure the protection of sensitive, classified, and top secret information within the government, intelligence community, and commercial markets. Our solutions are specifically designed and manufactured to comply with the most frequently cited and stringent of regulatory requirements and compliance mandates, including the National Security Agency’s (NSA) Evaluated Product List (EPL) — which is used to determine if a data destruction device is approved to destroy the US Government’s top secret and classified materials. 

Over the years, many data centers have pivoted to having the most secure data-decommissioning policy, in-house destruction. By using devices like the SEM 0300 shredder line, EMP1000-HS degausser, 2SSD, and iWitness documentation tool – data centers data is more secure than ever when the drives reach end of life.  

The fact of the matter is: the further we get into the Digital Age, the more criticality there is in protecting our most sensitive of data. Corporations, businesses, and enterprises all require a data center that can deliver reliability comparable to their uptime requirements and an in-house data destruction plan.

How NOT to Destroy Employee Personally Identifiable Information

April 25, 2023 at 8:00 am by Amanda Canale

Employee personally identifiable information (PII) is filled with critically private and personal information, such as financial information, healthcare information if provided by the employer, pay stubs, addresses and phone numbers, and more, so it should always be destroyed with the utmost care. 

Before we get to how not to destroy these types of files, it’s important we discuss how long you should keep them for. When it comes to personnel records, retention periods can vary. For instance, the Department of Labor Correspondence and the Internal Revenue Service (IRS) require any financial statements, documents from the IRS and Department of Labor Correspondence themselves, and plan and trust agreements to be kept three to four years, or even longer depending on the case.

However, when it comes to normal employee files, applications, contracts, and other employee personal information, they should be kept for two to three years from the date of termination. What about their compensation documentation? Keep these on file for three to five years from the termination. (This is important to remember!)

Now, let’s get to the fun part – the destruction!

Ripping Up

While ripping paper into confetti-sized pieces can be a great way to relieve some stress, we don’t necessarily recommend this tactic when getting rid of your most recent fire’s employee file. Even if you weren’t too crazy about your coworker, if not destroyed with high security end-of-life destruction equipment, their information could easily fall into the wrong hands, and your coworker could be the next to fall victim to identity theft – which nobody deserves. Don’t believe us? Take for instance the DARPA Shredder Challenge, where people quite literally competed to reassemble 10,000 shred particles for a large grand monetary prize. While the average person would much rather do anything else than spend 600 hours putting shred pieces back together, the same cannot be said for hackers and thieves; if it’s going to grant them access to your most sensitive information, then chances are they will rise to the occasion!

Shredded paper with text.

Recycling and/or Throwing Away

While we support the green initiative in wanting to recycle end-of-life PII documents, unfortunately this isn’t possible. Again, if it’s not a good idea to rip up your employee’s files, it’s not safe to simply throw it out or recycle. Sadly, the majority of our waste and recycling ends up in landfills and dumpsters which are typically gold mines for hackers and thieves. In addition, recycling and waste are not always transported securely, which makes it easy for people to intercept and have access to your most private and identifiable information.

It is always best to err on the side of caution when it comes to end-of-life data destruction. When it comes to specifically destroying employee files, it is best practice to use a secure, in-house method, like our Model 244/4 high security paper shredder. 

The Model 244/4 is our most popular high security paper shredder. Why? This solution is NSA evaluated and listed by the NSA/CSS EPL and meets DIN 66399 Level P-7 standards. Our 244/4 provides a rugged performance with an NSA one hour durability of 17 reams per hour while encased in a quiet system, making it the perfect choice for small or mid-size department use. 

Want even more security? Our Model 344 offers an even more secure shred size than the current mandate for the National Security Agency (NSA) requires. We like to call the 344’s final particle size as P-7+. This device is the only high security paper shredder on the market that offers a particle size of 0.8mm x 2.5mm (that is 50% smaller than the current National Security Agency requirement!) 

By adopting a shredding policy, you are making the most cost-effective, safe, and secure decision to take preventative measures to ensure that your past and current end-of-life employee information does not fall into the wrong hands.

Centralized vs. Decentralized Destruction: What’s the Difference?

April 17, 2023 at 2:36 pm by Amanda Canale

As with most new technology, ideas, and solutions, there are pros and cons. In this month’s blog, we’re breaking down the main similarities and differences between centralized and decentralized destruction environments.

Centralized Environment

A centralized environment is, essentially, one space where all of the magic happens. Whether it is a centralized record center or destruction environment, everything that happens and everything being stored are in one location. 

For example, let’s refer back to our Level 6 Data Centers: Best Practices in Security blog. The sixth level of the Google data center is known as a centralized destruction environment because all the destruction occurs in one, central space. At this level, security is at an all-time high, with very few personnel having access. 

 

 

Another example of a centralized environment, but in this case a record center, is a single space where all records are kept. It could be a doctor’s office where all patient files are kept or a cloud-based system where all files and documentation are stored. Since centralized environments hold a substantial amount of information, they are typically organized by separate teams or personnel with a very high level of clearance.

CENTRALIZED ENVIRONMENT PROS:

One main pro when it comes to a centralized environment, in this case destruction, is that all of your destruction occurs in one place. There isn’t a concern for whether a drive was left on someone’s desk or an end-of-life document was misfiled since there is a system in place that requires all end-of-life drives and documentation to be in one place at the same time. This allows for a highly organized destruction plan and seamless organization system.

With a centralized environment typically comes extra security (remember, all your eggs are in one basket!), which just adds an additional level of protection. This can be in the form of more security cameras, keypads and ID badges, physical security guards, and more. Not only do centralized environments come more protected, they also allow for more opportunities for control.

CENTRALIZED ENVIRONMENT CONS:

By putting one’s eggs all in one basket, while it offers a sense of control and safety, it can also have its drawbacks. Hypothetically speaking, if someone was able to breach that centralized location, they have the world at their fingertips since everything is in one place. Servers can be hacked into, destruction solutions can be tampered with, and precious information can easily be stolen. However, this is also why extra security measures are taken, whether the environment is centralized or not.

Decentralized Environment

On the contrary, a decentralized environment is where all of the records or destruction occurs across multiple rooms, spaces, or even floors. A decentralized environment could be the same doctor’s office mentioned earlier, but where patient personal health information (PHI) is kept spread out among various storage locations, workstations, multiple servers, etc. 

DECENTRALIZED ENVIRONMENT PROS:

Decentralized environments allow for data to be stored in more than one place offering more accessibility, and allowing those who need to access the data to be closer to it. By having their data in multiple and closer locations, there’s no need for long walks across the data center or building, or extra physical layers of security.

Depending on how sensitive the information is, a decentralized record center can sometimes offer more protection since there are multiple points of access and entry, which mean more opportunities for a hacker to fail.

DECENTRALIZED ENVIRONMENT CONS:

With multiple points of entry and access, also come…more money. Decentralized networks, destruction, or record environments require more upkeep, more maintenance, more storage, and more security. 

 

 

The consequences of improper data destruction are endless. By opting for in-house, centralized destruction, companies have complete oversight and can be certain that your information has been securely destroyed.  At SEM, we offer an array of various high-quality NSA listed/CUI and unclassified data destruction solutions, and are experts in designing and creating, implementing, installing, and servicing centralized destruction facilities across the globe. Whether it’s for the federal government, one of their agencies, or a commercial data center, we do it all. Learn more about our scalable and customizable solutions here. 

On a final note, we want to stress that when it comes to centralized destruction, maximizing your facility’s space is of critical importance. When selecting destruction solutions, it is important to ask yourselves a few questions on your facility’s size and space requirements, along with relevant compliance regulations. All are aspects of a physical space that need to be addressed when choosing the right solution. You can find out more on how to maximize every square foot of your centralized destruction facility below.
 

Paper Shred Sizes (and What They Mean)

March 30, 2023 at 2:14 pm by Amanda Canale

When destroying any end-of-life data, whether it be paper, hard drives, solid state drives, or other forms of media, there are very strict guidelines and laws that address how classified, top secret, and controlled unclassified information (CUI) should be disposed and securely destroyed. These requirements are determined by the National Security Agency (NSA) and the National Institute of Standards and Technology (NIST). 

For further context, the NSA mandates specific final particle sizes for top secret and/or classified data, regardless of the media form. They then evaluate and list end-of-life data destruction solutions that follow these mandates for destruction. (For a list of media destructions solutions evaluated and listed by the NSA, click here, and for more information what each data classification type really means, click here.)

While the federal government and government organizations are strict when it comes to how one should destroy end-of-life information, commercial companies and industries like healthcare, finance, banking, and more, are less stringent with their destruction instructions, with some left open to interpretation. 

Enter the DIN Standards. Also known as Deutsches Institut für Normung, DIN originated at the German Institute for Standardization in 1917 as a non-government organization that serves as the national standard when it comes to improving the rationalization, safety, environmental protection, and quality assurance between the government and the public. DIN is not often mandated but their guidelines serve as a widely accepted global standard while providing clarity to otherwise vague end-of-life information destruction mandates. 

DIN 66399 standards specifically provide end-of-life destruction particle size guidelines for information that resides on a wide range of media – including paper – and that specifies protection categories. (You can find more in-depth information about DIN standards here.) 

Even as we get further and further into the Digital Age, there is still such a high demand for paper. Some may say that paper is dead, but we know that paper will never really be dead. While the industries I listed above are not holding government secrets, they still store a lot of their sensitive and unclassified information on paper; information that needs to be securely destroyed or could result in severe consequences if it lands in the wrong hands.

Now that you have all of this background information, let’s get into why you’re here – what constitutes as a secure paper shred size? 

Seven Specific Security Levels 

P = Paper media requirements

Protection Category

Media Paper

Security Level

Security Level Particle Size Requirement

Class 1

P

1

12mm strips or maximum particle surface area of 2,000mm²

Class 1

P

2

6mm strips or maximum particle surface area of 800mm²

Class 1

P

3

2mm strips or maximum particle surface area of 320mm²

Class 2

P

4

Maximum cross-cut particle surface area of 160mm² with a maximum strip width of 6mm = 6 x 25mm

Class 2

P

5

Maximum cross-cut particle surface area of 30mm² with a maximum strip width of 2mm = 2 x 15mm

Class 3

P

6

Maximum cross-cut particle surface area of 10mm² with a maximum strip width of 1mm = 1 x 10mm

Class 3

P

7

Maximum cross-cut particle surface area of 5mm² with a maximum strip width of 1mm = 1 x 5mm

Here’s what each of these security levels look like:

DIN Level P-2 Paper Shred with penny for size comparison
DIN Level P-2 Paper Shred
DIN Level P-3 Paper Shred with penny for size comparison
DIN Level P-3 Paper Shred
DIN Level P-4 Paper Shred with penny for size comparison
DIN Level P-4 Paper Shred
DIN Level P-5 Paper Shred with penny for size comparison
DIN Level P-5 Paper Shred
DIN Level P-6 Paper Shred with penny for size comparison
DIN Level P-6 Paper Shred
DIN Level P-7 Paper Shred with penny for size comparison
DIN Level P-7 Paper Shred
DIN Level P-7+ Paper Shred with penny for size comparison
DIN Level P-7+ Paper Shred, a 50% smaller particle size than NSA mandate for paper, produced by SEM Model 344.

As you can tell based on the table and photos above, P7 is the smallest, most secure particle size (aside from the 0.8mm x 2.5mm particle from our Model 344, which is half the size mandated by the NSA for classified paper). Essentially, the smaller the particle, the harder it is to put back together. 

Why would you want to put a bunch of paper shreds back together? To get top secret information, of course! 

Allow us to introduce the DARPA Shredder Challenge. The challenge was created by a research and development agency of the U.S. Department of Defense back in 2011. The DoD invited top computer scientists and puzzle enthusiasts to essentially reconstruct paper shreds for a grand prize. 

The challenge ended when the winning team, who went by the name, “All Your Shreds Belong to US”, created an algorithm that automatically reconstructed the 10,000 pieces of paper based on various physical aspects of the shred, such as shred angle, shred size, and paper marks. Other teams used strategies ranging from crowdsourced-style methods to relying heavily on manual reconstruction. 

When it comes to end-of-life data destruction, it is always best to err on the side of caution. By opting for in-house data destruction methods, you and your company or agency are making the most cost-effective, safe, and secure decision. At SEM we have an array of high-quality NSA listed/CUI and unclassified paper shredders to meet any regulation and mandate, ensuring all of your end-of-life paper stays end-of-life. Any one of our exceptional sales team members are more than happy to help answer any questions you may have and help determine which machine will best meet your destruction needs.