Which HSM Shredders Are on the NSA/CSS Evaluated Products List
The NSA/CSS Evaluated Products List is the only authoritative list of paper shredders approved for destroying US classified national security information. It is published by the National Security Agency, it lists specific makes and model numbers rather than brands or security levels, and a machine is only compliant while that exact model appears on the current list. A P-7 rating under DIN 66399 is not the same thing as NSA/CSS evaluation, and a vendor claiming "NSA approved" without naming a model number on the current EPL is not making a verifiable claim.
If you destroy classified material, the EPL is the document that matters. Here is how to use it properly.
What the EPL actually covers
The NSA/CSS maintains separate evaluated products lists for different destruction categories — paper shredders, optical media destroyers, degaussers, hard disk destruction devices and punched tape. They are not interchangeable. A device on the paper list says nothing about its suitability for optical media or drives.
For paper, the governing specification is NSA/CSS Specification 02-01, which sets the required residue particle size for destroying classified paper. Our guide to HSM high-security P-6 and P-7 shredders covers the cut sizes in detail.
The three mistakes buyers make
- Treating P-7 as equivalent to NSA evaluation. DIN 66399 P-7 is an international cut-size standard. NSA/CSS evaluation is a US government product approval of a specific model. Many P-7 machines are not on the EPL.
- Buying a brand rather than a model. Evaluation attaches to exact model numbers. A manufacturer having several evaluated models does not make its other models compliant.
- Not rechecking the current list. The EPL is revised. A model that was listed when a machine was purchased may not appear on the current revision, which matters at audit.
How to verify a machine before you buy
- Get the exact model number, including any suffix, from the quote — not the product family name.
- Check it against the current NSA/CSS EPL for paper shredders published by the NSA.
- Confirm the list revision date and keep a copy with your procurement record.
- Check whether your agency or contract imposes anything stricter than the EPL.
If a supplier cannot give you a model number that you can match line-for-line against the published list, treat the claim as unverified.
Classified, CUI and commercial — three different requirements
| Material | Requirement | Typical machine |
|---|---|---|
| Classified national security information | NSA/CSS EPL-listed model | High-security, EPL-listed |
| Controlled Unclassified Information | Agency policy; commonly high-security | High-security shredders |
| Commercial regulated data (HIPAA, GLBA) | Unreadable and unreconstructable | P-5 micro-cut |
Buying an EPL-listed machine for HIPAA paper is not wrong, but it is expensive: these machines have low sheet capacities and fill bins very quickly, because the particle size is extraordinarily fine.
Practical consequences of running an EPL machine
High-security machines trade throughput for particle size. Expect single-figure sheet capacities, frequent bin emptying, and a real oiling regime — these cutting heads generate significant dust and friction. Plan the consumables into the operating budget from the start. See HSM shredder oils and HSM shredder bags.
Frequently asked questions
What is the NSA/CSS Evaluated Products List?
It is the National Security Agency's list of specific equipment models evaluated as suitable for destroying US classified information. Separate lists cover paper shredders, optical media destroyers, degaussers and hard disk destruction devices.
Is a P-7 shredder automatically NSA approved?
No. P-7 is a DIN 66399 cut-size classification. NSA/CSS evaluation is a separate US government approval of a specific model. Some P-7 machines are evaluated and listed, and some are not.
How do I check if a shredder is on the EPL?
Take the exact model number from the quote and match it against the current NSA/CSS evaluated products list for paper shredders published by the NSA. Record the revision date of the list you checked.
Do I need an EPL shredder for CUI?
Not automatically. Controlled Unclassified Information is governed by agency and contract policy rather than by the EPL, though many agencies specify high-security destruction for it. Check the requirement written into your contract.
Why do high-security shredders take so few sheets?
Because the particle size is extremely small, the cutting head makes far more cuts per sheet than a standard office machine. Low sheet capacity and rapid bin fill are inherent to the cut, not a defect.
Buying from HSM Machines
We supply HSM high-security machines for US government and defence contractor work. Browse NSA/CSS approved shredders and high-security shredders. Tell us the classification level and volume you need to handle and we will confirm the exact model and its current listing status before you order.