Heat-assisted magnetic recording (HAMR) drives are impressive technology: 30-terabyte and larger capacities in a standard 3.5-inch form factor, arriving in enterprise storage now. For a commercial data center they are a straightforward upgrade. For a facility that stores classified information, they are a disposition problem that has to be solved before the first drive is installed, because the usual tools do not work on them.
Why a degausser cannot erase a HAMR drive
Conventional hard drives store data on media with a coercivity of roughly 5,000 oersteds. A degausser on the NSA/CSS Evaluated Products List generates a field strong enough to overwhelm that and scramble every magnetic grain on the platter. HAMR media is different. To pack bits more densely, manufacturers use an iron-platinum alloy with a room-temperature coercivity in the tens of thousands of oersteds; the drive writes to it only by heating a microscopic spot with a laser first. No degausser on the EPL, including the one on our truck, produces a field strong enough to erase media like that at room temperature. Run a HAMR drive through a listed degausser and the data is still there.
What the NSA now says
The NSA/CSS Policy Manual 9-12 reissued on February 19, 2026 addresses HAMR directly. Three points matter:
- Hard drives manufactured after 2020 may be HAMR, and at this time incineration at a temperature greater than 670°C is the only approved sanitization method for them.
- HAMR drives can be identified by the label. Because they contain a laser, HAMR drives sold in the United States must carry a Class 1 laser statement on the exterior product label, referencing FDA performance standards or 21 CFR 1040.10 and Laser Notice No. 56. Drives sold in the European Union state "Class 1 consumer laser product EN 50689:2021."
- There is no longer a one-size-fits-all HDD procedure. The same reissue notes that laptop drives made after 2005 and enterprise drives made after 2012 may be hybrid drives with solid-state components, which must be separated and disintegrated to solid-state requirements. Some HDDs and SSDs look identical; the manual tells you to check manufacturer and model numbers.
What this means for a cleared facility
If your SCIF, SAPF, or closed area is standardizing on new enterprise storage, ask the vendor one question before signing: are these HAMR? If the answer is yes, your end-of-life plan for classified data on those drives is incineration, arranged through your security officer, and nothing on a mobile truck will substitute for it. Options to consider before deploying:
- Specify conventional (PMR) or solid-state media for classified storage. Both have EPL-listed sanitization paths: degauss-and-deform for magnetic drives, disintegration to 2 mm for solid-state. HAMR's capacity advantage is real, but so is the disposition cost.
- If HAMR is unavoidable, build the incineration path into the program now: an approved facility, chain of custody to it, and the administrative declassification procedure your security office requires.
- Segregate at intake. Train the people who receive retired drives to read the label. A HAMR drive that slips into the degauss line looks sanitized and is not.
- Ask the CSDSR. The NSA's Center for Storage Device Sanitization Research answers questions about devices the manual does not fully cover, and the EPLs are updated quarterly. Guidance can change; check before each large disposition.
Unclassified HAMR drives
Outside classified environments the rules are NIST SP 800-88 Rev. 2, which does not require degaussing. Physical destruction by shredding meets the Destroy standard for any hard drive, HAMR included, because the platters are physically deformed regardless of coercivity. A HAMR drive from a commercial data center can go through our shredder like any other. The distinction that matters is the classification of the data, not the capacity of the drive.
What we do
We check labels. Every drive that comes to a Mansfield Technologies job is identified by manufacturer, model, and label before it is sanitized, and HAMR drives holding classified data are set aside and documented rather than run through a process that would not work. Hybrid drives have their circuit boards separated and disintegrated. We would rather tell a client that a drive needs a different path than issue a certificate we could not stand behind. See the machines and the media each one is approved for.
Written by Christopher McDevitt with AI assistance. Updated September 2026 for the February 2026 reissue of NSA/CSS Policy Manual 9-12.