CSDSR Customer FAQs

Customer FAQs

Collapse All Expand All
Expand List item 610Collapse List item 610  Can I lower the classification level of my printer, computer, switch, or other hardware? 

Typically no, but you can contact your local security office for specific guidance.  

Expand List item 611Collapse List item 611  Can I repair my EPL-approved equipment? 

Please contact the manufacturer/vendor and ensure that the repair brings the device back to an "as stock" configuration. Any alterations may invalidate the machine's approval. DoD 5200.01 V3 provides a little more information about this. 

Expand List item 612Collapse List item 612  Do I have to destroy my storage device? Can't I reuse it?

CSDSR currently only handles routine guidance for sanitization of information system storage devices for disposal or recycling. For possible reuse, please contact your local security office.  

Expand List item 808Collapse List item 808  How can I determine if a degausser on the EPL is working as intended?

CSDSR recommends using a properly calibrated field verification device found in the Magnetic Degaussers EPL to determine your degausser's field strength and effectiveness. Using such a device should not replace routine maintenance procedures outlined by your degausser manufacturer; it is simply a supplemental verification method.

Expand List item 613Collapse List item 613  How do I dispose of my storage destruction machine once it reaches its end of use?  

Thoroughly inspect the machine for storage device particulate that may not have been disposed of. Ensure that you perform a thorough search, Once complete, you may dispose of in any manner you like. We recommend you recycle.   

Expand List item 891Collapse List item 891  How do I dispose of my storage device once I've properly destroyed it?

We recommend you recycle, but you are free to dispose of non-classified debris in any manner.

Expand List item 615Collapse List item 615  How often are new EPLs published? 

EPLS are expected to be published every quarter but may be subjected to delays. 

Expand List item 616Collapse List item 616  I degaussed my hard drive, do I still need to deform it? 

Yes, physically destroying a hard drive is an additional level of security and helps ensure that this drive is not accidentally mistaken for a working drive. Note: Deforming does not replace degassing. You MUST degauss your hard drive.    

Expand List item 617Collapse List item 617  I don't have access to any of the equipment on the EPLs. Is there anywhere I can send my storage media? 

Maybe. If you're an eligible entity, the NSA Classified Material Conversion (CMC) office may be able to help you. Please contact them at (301) 688-6672 or visit their website for more information. If you are not eligible for their assistance, we recommend you purchase a unit on our EPL or find a service in your area to destroy your information for you. Work with your local security office to verify that any service you utilize complies with our EPL.

Expand List item 890Collapse List item 890  Is there an approved vendor that can come on-site to destroy my media?

CSDSR does not approve nor authorize vendors for destruction, only equipment found on the Evaluated Products Lists are approved for destruction. It is up to the local security official to select and vet service providers. All service providers must be using NSA/CSS approved equipment and methods for destruction of classified materials.

Expand List item 618Collapse List item 618  I have a printer, router, computer, switch, or other pieces of equipment. How do I sanitize that? 

Please contact the manufacturer and request a "statement of volatility". Follow the instructions contained within and remove all non-volatile storage and disintegrate. If you cannot remove nonvolatile memory, then you must disintegrate the board. Ensure volatile memory is sanitized by disconnecting the power for at least 24 hours. Contact your local security office for guidance and procedures.  

Expand List item 619Collapse List item 619  I have a shredder, or other devices, in my office that isn't on the EPL. Can you add it? 

Potentially, but not instantly. The vendor of the device must initiate a request to have their device evaluated and CSDSR would need to perform a full evaluation of the device before a determination can be made. 

Expand List item 620Collapse List item 620  I've had a data spill. What should I do with the affected hardware?

Report the spill to your local security office and follow your organization's protocol. CSDSR requires the hardware to be destroyed in accordance with our EPLs. 

Expand List item 621Collapse List item 621  My product was removed from the EPL, can I still use it? 

DoD 5200.01 V3 allows for a six-year window for you to use this product until you replace it. The expired devices and the expiration date for this six-year period are listed in the NSA EPL Expired Products List. CSDSR does recommend you replace your device as soon as you can.  

Expand List item 622Collapse List item 622  What about cell phones, iPads, and tablets? 

Batteries need to be removed. Batteries can explode if shredded. If possible, LCD screens should also be removed. Disintegrate these devices utilizing a product approved for the device type on the SSD Disintegrator EPL. 

Expand List item 623Collapse List item 623  What classification can x device destroy? 

All approved products on the EPL are capable of sanitizing TS/SCI material and below.  Any device not listed within the EPLs is not approved for DoD usage for material at any classified level.  

Expand List item 807Collapse List item 807  What is the difference between HAMR vs Non-HAMR drives?

Starting after 2020 Hard Disk Drives have a possibility of being HAMR Drives. What sets HAMR drives apart from Non-HAMR drives is their use of heat during data writing, which allows for increased data density on each platter. Consequently, effectively sanitizing these drives demands a considerably stronger degausser compared to traditional drives.

Expand List item 892Collapse List item 892  How can I tell if I have a Heat Assisted Magnetic Recording (HAMR) Drive?

The first clue is there will be a Laser Safety Warning on the drive of some kind. Manufacturers of these drives are required to place notices on the packaging with United States having the notices of: "Complies with FDA performance standards for laser products except or conformance with IEC 60825-1 Ed. 3., as described in Laser Notice No. 56, dated May 8, 2019" or "Complies with 21 CFR 1040.10 and 1040.11 except for conformance with IEC 60825-1 Ed. 3., as described in Laser Notice No. 56, dated May 8, 2019." Within the European Union, the notice of the HAMR drive will have the notice: "Class 1 consumer laser product EN 50689:2021". Refer to manufacturer and model numbers to correctly identify the drive type

Expand List item 624Collapse List item 624  What should I do with a HAMR Drive or MAMR Drive? 

If you have a HAMR drive or MAMR drive, you'll need to incinerate the drive to 670° C. No other method currently exists that is capable of securely sanitizing this data. 

Expand List item 893Collapse List item 893  I don’t see a product on the EPL that a vendor said is approved, how do I know if its approved?

If a product is not seen on the related Evaluated Product List (EPL), then check the No Longer Manufactured List at the end of the EPL or the Expired Products List. If the product is not found on any of those lists, the product is not approved for use. 

Expand List item 894Collapse List item 894  I am located in an office environment, but don't have approved sanitization equipment nor can I access any, can I use Emergency Destruction?

No, Emergency Destruction is only authorized in certain situations, communicate with your local security office for guidance.

Vendor FAQs

Collapse All Expand All
Expand List item 625Collapse List item 625  Can I become a product distributor of an already EPL approved device that is rebranded as another name and have it listed on the EPL under that name?

It may be possible if certain conditions are met. First, the device must match the design of the originally EPL-approved device precisely. Second, an official signed letter from both the manufacturer and distributor must be submitted to CSDSR, attesting that the device is identical to the previously approved one. Third, CSDSR must approve the device. Finally, a Memorandum of Agreement (MOA) must be in place to add the rebranded device to the EPL.