Physical Destruction: Media, Particle Size and Policy

Short answer

Choose physical destruction by the applicable policy, the actual data-bearing material and the verified output of a suitable process. Do not select a particle size from a generic “secure shredding” advertisement and assume it satisfies every media type or threat model. A damaged enclosure, a small average fragment or a disposal certificate can each leave the essential acceptance question unanswered.

Write the acceptance rule before sending the assets: which components must be treated, what process is permitted, how its output is checked and who can authorize release. If the facility cannot demonstrate that fit, retain custody and resolve the gap. This guide is a method-selection and evidence workflow, not instructions for operating destruction machinery.

Who this is for

This guide is for ITAD teams and data owners buying a destruction service for HDDs, SSDs and mixed storage assemblies. It addresses physical scope and output criteria. It does not prescribe a universal particle size, a home destruction method or a legal compliance determination.

Two current examples illustrate why scope matters. The October 2026 NSA/CSS Solid State Sanitization Devices list specifies a maximum edge size of 2 millimeters or less and requires checking acceptable material for the particular equipment. The UK NCSC's version 2.0 disposal guidance, reviewed February 5, 2025, discusses 6-millimeter-or-smaller particles in its stated OFFICIAL-data threat context and calls for checking the result. That UK guidance excludes protection against a skilled, well-funded laboratory and directs SECRET-or-above cases elsewhere.

These are different authorities with different scopes. Neither number becomes a universal threshold by appearing in a comparison table.

When to use this

Use this workflow when the owner has authorized destruction, reuse is not the approved destination, and the chosen method can be supported for the actual material. It is especially useful when asking a contractor to handle several storage types in one collection.

Decide whether data-removal scope covers only removed drives or the entire retired assembly. A laptop without its SSD, for example, is a different disposition object from that SSD. Do not let a receipt for the drive silently close the record for all possible storage in the original system.

When not to use this

Do not destroy assets subject to an unresolved preservation requirement, ownership dispute or recovery decision. Do not replace a required policy review with a comparison of quoted fragment sizes. Do not feed unfamiliar assemblies into equipment merely because they fit through its opening.

Operators need the facility's qualified safety and equipment procedures, including handling of batteries and other unsuitable materials. The steps below govern selection, custody and acceptance; they do not authorize dismantling, crushing, burning or chemical processing in an improvised setting.

Workflow

1. Make the authority explicit

Put the governing policy identifier, revision and approval owner on the work order. Identify which data category, destination and threat assumptions it covers. If a contract refers to a standard without an edition, resolve that ambiguity before treating the lot.

NIST SP 800-88 Rev. 2, published September 2025, distinguishes destruction from merely making a device unusable. It warns that partial damage such as drilling or bending can leave recoverable portions, and cautions against relying on shredding or pulverizing beyond the lowest security categories. Its program guidance does not make every commercial shredding service suitable for every risk.

For a job governed by another authority, preserve that authority's exact criteria. Do not combine the most convenient sentence from one framework with the smallest number from another and describe the result as compliance with both.

2. Specify the data-bearing material

Inventory the media to be treated rather than only the items to be collected. Keep HDD magnetic storage, flash devices and unresolved hybrid assemblies distinguishable in the order. A crusher that deforms platters and a process that reduces flash components to controlled fragments answer different questions.

The October 2026 NSA HDD equipment list distinguishes deformation, disintegration and special media categories. It requires prior degaussing for its deformation route and treats hybrids and HAMR separately. Do not substitute a general HDD-deformer listing for flash-processing support or assume that HAMR follows an ordinary HDD route.

A requirements summary is not evidence that a particular machine is currently listed. Confirm the actual equipment entry and available route with the responsible authority rather than inventing an approved model from an older brochure.

3. Translate the requirement into a checkable specification

Copy the meaning of the required dimensional criterion into the work order without silently changing it. Maximum edge size, nominal size, average size and screen aperture are not interchangeable descriptions. Ask how the contractor demonstrates that the output meets the particular required criterion.

For example, if the applicable rule is a maximum edge size, a collection of mostly small fragments does not excuse an oversized data-bearing piece. A screen dimension describes part of a machine configuration; the record still needs an accepted way to assess the produced material. Do not infer that a screen label proves every output dimension.

Avoid casual unit conversion between a length and an area. A 2-millimeter edge criterion cannot simply be replaced with “4 square millimeters” without changing what is being measured. Long, narrow pieces illustrate why area and maximum extent can lead to different acceptance decisions. This is a dimensional distinction, not a proposed formula for recoverable data.

4. Review the proposed facility and equipment

Ask for the exact equipment identity, supported materials and operating configuration used for this order. Require the contractor to disclose any preparation, separate processing or excluded components. Check the applicable current equipment entry where your policy requires one, including the acceptable-material remarks.

The NSA customer FAQ distinguishes equipment evaluation from approval of a destruction service provider. Vet the provider separately: who receives the assets, who can subcontract, where material waits and how exceptions return to the owner. An equipment logo on a quotation does not answer those custody questions.

Do not assume that continued machine performance is established by historical inclusion on a list. The October 2026 solid-state list also calls for equipment retesting under manufacturer guidance. Obtain evidence appropriate to the job rather than treating purchase age as a performance measurement.

5. Bind input assets to processing and output

Agree on an input manifest before collection. Record the asset identifier and storage type, seal or container association, receiving acknowledgement and any discrepancy. If a label must be removed before processing, complete the identity-to-job association first under the approved procedure.

At processing, retain the lot identifier and records that link it to the actual equipment and treatment event. When the output of several assets is commingled, individual attribution becomes harder; the evidence must preserve how the input lot and processed material were controlled. Do not claim that a photograph of anonymous fragments identifies a particular serial number.

Separate three statements in the final record: received, processed and accepted. A missing receipt or incomplete process record should remain an exception even if another part of the order has a certificate. This prevents an invoice total from turning into an unsupported data-removal claim.

6. Inspect outcomes and resolve failures

Use the output-verification approach accepted by the governing procedure and keep its limitations explicit. If inspection finds an oversized piece, an intact storage component or a bypassed item, stop release of the affected material and obtain an authorized reprocessing or alternative-treatment decision.

Do not present a convenient handful of fragments as proof about an entire output lot. Sampling needs a defined population and selection method, and still cannot answer questions outside that population. A photograph may support a recorded inspection, but it is not a laboratory recovery study or a comprehensive measurement by itself.

Finally reconcile the input manifest, treatment records, accepted output and exceptions. Record the authorized onward destination. The owner should be able to find out what happened to a disputed asset after the material itself can no longer be identified.

Verification checklist

• Is the policy edition and its applicability recorded?
• Does the order identify the actual storage materials and unresolved components?
• Does the selected equipment support those materials in the proposed configuration?
• Is the output criterion stated with its correct units and meaning?
• Are input assets linked to controlled processing lots?
• Is there accepted output-verification evidence, with limitations stated?
• Were failed or missing items excluded from the completed count?
• Did the responsible reviewer approve release and disposition?

Verification note: acceptance evidence

No physical destruction, fragment measurement or recovery experiment was performed for this article. A real acceptance package should retain the applicable policy, media inventory, equipment support, job linkage, output checks and exception closure. These are criteria for reviewing a future job, not observed test results.

A useful administrative example is an order containing ten identified SSDs and one unidentified module. If the module's material support is unresolved, ten completed drive records do not justify an eleven-item completion statement. Keep the module open until its own scope and treatment are accepted. These counts are fictional and illustrate reconciliation only.

Resale and evidence checklist

Keep destruction-bound assets physically and administratively separate from reusable stock. Retain owner authorization and any preservation decision before releasing the order. Where another object is reused, describe exactly what was removed and what was sanitized; destruction of a component is not sanitization of every other storage location in the parent asset.

A final certificate should be traceable to the job's evidence. It must not convert an unresolved item into a completed one merely because the certificate template has no exception field.

What not to publish

Do not publish customer identifiers, internal classifications or facility security details. Avoid universal “2 mm means unrecoverable” or “6 mm meets all standards” claims. Do not describe a company as NSA-approved on the strength of an equipment entry, or present an unreviewed destruction result as a certification of upcoming software.

Common mistakes

Frequent specification failures include confusing maximum with average size, using an HDD route for an SSD, assuming a dented case means every storage component was treated, and choosing a contractor before deciding which authority applies. Evidence failures include anonymous photographs, batch totals without an input manifest and missing exceptions in the final certificate.

The remedy is to make the unresolved decision visible before processing. Better wording after the event cannot recreate an identity link or output check that was never collected.

CliDeck workflow fit

Use a repeatable record structure to keep authority, component scope, process events and review decisions connected. Preserve any relevant console intake evidence as identification context, not proof of a physical destruction outcome. This is workflow guidance and makes no claim of hardware testing, destruction certification or unreleased product features.

FAQ

Is smaller debris automatically compliant?

No. Applicability, permitted process, material support, custody and output verification still matter. A dimensional number alone does not establish all of them.

Can a drilled HDD be called destroyed?

Do not use that appearance alone as an acceptance rule. Partial damage can leave data-bearing portions, and the governing method must be satisfied.

Can an older manual fill gaps in a current policy?

Not automatically. The currently linked full NSA Manual 9-12 returned access errors during this review. The October 2026 lists were readable; no inaccessible manual requirements are asserted here. Resolve any additional applicable requirement before authorizing an actual job.

Related guides

Start with the NIST sanitization program, distinguish flash translation and coverage, and keep failed-drive exceptions open until an authorized outcome is accepted. For magnetic-treatment selection, review degaussing compatibility.