HSM P-4 vs P-5: Choosing a Security Level Without Overbuying

P-5 is not "better" than P-4. It is smaller, slower, and more expensive per sheet — and for a great deal of ordinary business paper it is protection you are paying for and will never use. The instinct to buy the highest security level available is understandable and usually wrong. This guide explains what the two levels actually specify, which categories of document genuinely need P-5, and what choosing it costs you in throughput and running cost.

Quick reference

• P-4 — cross-cut, the standard commercial level for general business documents and most personal data.
• P-5 — micro-cut, materially smaller particles, the normal expectation for sensitive personal, medical and financial records.
• Throughput penalty — a finer cut means fewer sheets per pass on the same machine size.
• Running cost — finer cutting heads work harder, need oiling more attentively, and fill bins faster by volume.
• Decide by document class, not by buying the highest number and applying it to everything.

What the levels actually specify

DIN 66399 defines security levels by the maximum particle size the machine may produce, expressed as a cross-section area for cross-cut and micro-cut geometries. The scale runs from P-1, which is coarse strip-cut, to P-7, which is the level used for classified material.

P-4 and P-5 sit in the middle, and the practical difference between them is a substantial reduction in particle area. In terms of what that means for reconstruction: P-4 particles are small enough that reassembly is impractical for any ordinary adversary; P-5 particles are small enough that reassembly stops being a meaningful concept even with effort and equipment.

The important framing is that both levels are secure against realistic threats to ordinary business paper. The question is not which is safer in the abstract — it is which is required for the specific documents you destroy. Our guide to DIN 66399 security levels covers the full scale and how the media classes work.

Where P-4 is genuinely sufficient

For most US businesses, P-4 cross-cut covers the majority of what actually goes through the machine:

Internal business documents — drafts, meeting notes, superseded reports, internal correspondence, project paperwork. None of this carries the kind of data that would reward reconstruction, and P-4 removes any practical prospect of it anyway.

Routine commercial paperwork — purchase orders, delivery notes, non-sensitive invoices, general administration. Same reasoning.

General customer correspondence without financial or health information attached.

Choosing P-4 for this material is not cutting a corner. It is matching the control to the risk, which is what a proportionate policy looks like and what an auditor expects to see.

Where P-5 earns its place

Certain document classes carry either a specific regulatory expectation or an obvious concentration of sensitive data, and there P-5 is the sensible default:

Health information. Medical records, imaging reports, insurance correspondence containing diagnoses. The requirement is that the information be rendered unreadable and unreconstructable, and P-5 puts that beyond argument.

Financial account data. Statements, account applications, anything carrying full account numbers.

Personnel files. Concentrated personal data, often including identifiers, salary and health-related information in one folder.

Anything an external requirement names. Where a contract, regulator or client specification states a level, that governs regardless of your own analysis.

Machines at this level are in micro cut and, for the highest classes, high security shredders and super micro cut.

What P-5 costs you

Three real costs come with the finer cut, and none of them are reasons not to choose it when it is required — only reasons not to choose it by default.

Sheet capacity falls. On the same machine size, a micro-cut head takes noticeably fewer sheets per pass than a cross-cut head. A machine that felt fast at P-4 will feel slower at P-5, and the specification sheets reflect this if you compare like-for-like models.

Bins fill faster by volume. Finer particles pack differently and the waste is more voluminous per sheet destroyed, meaning more frequent bag changes. Correctly sized shredder bags matter more here than at coarser levels.

The head works harder. More cutting per sheet means more heat and more wear, which makes regular oiling less optional. See shredder oils.

There is also a downstream point: finer shred has shorter fibres and slightly lower recycling value. That is rarely decisive, but it is real.

The policy that avoids the trap

The failure mode at both ends is the same — applying one level to everything. Buy P-4 for everything and your sensitive records are under-protected. Buy P-5 for everything and you have bought throughput you did not need and will feel it every day.

The workable answer for most organisations is a short written classification: two or three document classes, each with a named destruction level. Where volumes justify it, that becomes two machines — a fast P-4 unit for general flow and a smaller P-5 unit for sensitive material. Where volumes do not, it becomes a single P-5 machine accepted with its throughput penalty, which is a legitimate choice made knowingly rather than by default.

To compare model capacities across levels, see our SECURIO model guide and the SECURIO range.

Frequently asked questions

Is P-5 required by HIPAA?

HIPAA requires that protected health information be rendered unreadable, indecipherable and unable to be reconstructed, without naming a DIN level. P-5 micro-cut is the level most organisations adopt because it satisfies that standard without argument, and many treat it as the practical baseline for health information.

Is P-4 enough for personal data generally?

For routine personal data in ordinary business correspondence, P-4 is widely accepted as proportionate. For concentrated personal data — personnel files, financial account records, health information — P-5 is the normal expectation.

How much throughput do I lose going from P-4 to P-5?

Enough to notice. On comparable machines the sheet capacity per pass falls materially, because the head is making many more cuts per sheet. Compare the two variants of the same model rather than comparing across model sizes.

Can one machine do both levels?

No. The cut level is determined by the cutting head, which is fixed for the machine. Organisations needing both levels either run two machines or standardise on the higher level.

Does a finer cut affect recycling?

Slightly. Shorter fibres produce weaker recycled paper, so micro-cut shred is worth marginally less per ton than cross-cut. It is not usually a factor in the decision.

Choosing deliberately

Classify your documents first, then choose the level each class requires, then size the machine. Doing it in that order avoids both the under-protection risk and the far more common problem of buying a slow machine for paper that never needed it.

HSM Machines stocks the SECURIO range across cross-cut, micro-cut and super micro-cut levels. Tell us what document classes you destroy and in what proportion, and we will recommend a level — or a two-machine split — that fits rather than over-specifies. Browse the SECURIO range or ask us about security levels.