ISO/IEC 21964 (formerly DIN 66399)

Three parts

ISO/IEC 21964 (2018) consists of three parts:

1. Principles and definitions: the terms and the system of protection classes and security levels.
2. Requirements for equipment: what a machine for destroying data carriers must meet.
3. Process of destruction: how to organise the destruction process securely, including transport, storage and documentation.

The standard replaces DIN 66399 in this area; DIN recommends ISO/IEC 21964-1 instead of the withdrawn DIN 66399-1.

Protection classes, security levels and material categories

The standard works in three steps. First you determine the protection class (1 to 3) of the information, from normal to very high protection need. That class leads to a minimum security level (1 to 7). The level then specifies, per material category, how small the particles must be:

Category	Media
P	Paper and printed matter
F	Film, microfilm
O	Optical media such as CDs and DVDs
T	Magnetic media such as tapes and diskettes
H	Hard drives with magnetic platters
E	Electronic media such as SSDs, USB sticks and chip cards

So a level E-3 means something different from H-3 or P-3: the required result depends on how data is stored on the medium.

What this means for your equipment

For electronic media, a shredder with a defined particle size is the usual route. According to Garner, the FLASHPRO-E with particles of 4 × 15 mm meets security level E-3. For hard drives, the H levels describe the degree of deformation or particle size; a destroyer deforms the drive, a shredder reduces it to particles.

Which security level you need follows from your own risk assessment or from your customer’s requirements. Tell us the required level and we will check which machine reaches it.