HMG IS5 Baseline — UK Secure Data Erasure & Sanitization

HMG IS5 refers to HMG Information Assurance Standard No. 5 — SecureSanitisation, a former UK government information-assurance standard for secure treatment of information stored on media.

The underlying objective of secure sanitisation is to reduce the likelihood that previously stored information can be retrieved and reconstructed after the media is released, reused or otherwise disposed of. UK government documentation continues to use this definition of secure sanitisation while identifying IS5 as the former standard and directing users to current NCSC guidance.

The Baseline profile is the simpler of the commonly referenced HMG IS5 overwrite profiles.

It is generally represented as:

The commonly implemented software profile uses a single overwrite pass, followed by verification. Different software products may document the historical pass value differently, which is why a professional implementation should identify the actual sanitization operation executed rather than claiming that every IS5 Baseline implementation is identical.

The DSP implementation follows a controlled sanitization workflow:

1. 01Select HMG IS5 Baseline
2. 02Identify
3. 03Assess
4. 04Execute
5. 05Verify
6. 06Document
7. 07Certify

The Baseline profile is commonly represented as a single-pass overwrite followed by verification.

A simplified process is:

The purpose is to replace addressable information with the selected overwrite value and then confirm the sanitization result.

Some technical references describe HMG IS5 Baseline as a zero overwrite, while others use a random-value implementation. This reflects differences in software implementations and historical descriptions.

For DSP, the important audit principle is:

This avoids treating a generic software label as proof of an operation that may not have actually been performed.

DSP provides HMG IS5 Baseline as a dedicated method within the DSP Sanitization Engine.

The operator does not need to create a custom overwrite sequence.

HMG IS5 Baseline is most naturally associated with software-based sanitization of rewriteable storage media, particularly traditional HDDs.

For supported HDDs, DSP can record:

• HDD Manufacturer
• Model
• Serial Number
• Capacity
• Interface
• Health Information
• Sanitization Method
• Process Status
• Verification Result

This supports controlled workflows for:

• Hard Drive Erasure
• Secure Disk Wiping
• IT Asset Disposition
• Computer Refurbishment
• Enterprise Hardware Retirement
• Data-Center Decommissioning
• Storage-Device Reuse
• Secure Media Disposal

Modern SSD and NVMe devices require additional technical consideration.

Flash storage incorporates:

• Flash Translation Layers
• Wear Leveling
• Garbage Collection
• Over-Provisioning
• Spare NAND Blocks
• Controller-Level Remapping

As a result, repeatedly writing to logical sectors through a normal interface does not necessarily mean that every historical physical NAND location has been overwritten.

Therefore, HMG IS5 Baseline should not automatically be treated as a universal physical sanitization technique for SSD or NVMe media.

For modern solid-state storage organizations should select a sanitization technique appropriate to:

• Storage Architecture
• Device Capabilities
• Information Sensitivity
• Organizational Policy
• Intended Reuse Or Disposal
• Applicable Current Sanitization Guidance

Where available, device-native sanitization capabilities may be more appropriate than conventional logical overwriting.

Secure sanitization is fundamentally different from ordinary deletion.

Deleting files or formatting a disk does not by itself establish that previously stored information has been securely sanitized.

A professional data-erasure process should have a defined method, controlled execution and documented verification.

Verification is a critical component of a professional sanitization workflow.

DSP records the result of the sanitization operation and verification stage.

The audit record can include:

• Target Device
• Sanitization Method
• Execution Status
• Verification Status
• Errors
• Exceptions
• Start Time
• Completion Time
• Operator
• System Information
• Software Information
• Audit Metadata

This creates evidence connecting the physical device to the sanitization operation.

A storage device's physical condition can affect successful sanitization.

DSP can provide available device-health information including:

• SMART Health
• Temperature
• Power-On Hours
• Firmware
• Model
• Serial Number
• Read/write Errors
• Logical Bad Sectors
• Physical Media Errors
• Performance Indicators

If a device contains inaccessible sectors or reports significant errors, the result should identify those conditions.

A completed software operation should not automatically be interpreted as proof that inaccessible physical areas were successfully overwritten.

HMG IS5 Baseline can be used as a selectable sanitization profile within structured IT Asset Disposition (ITAD) workflows when a customer, contract or organizational policy specifically requires the methodology.

DSP creates a traceable chain:

1. 01Device
2. 02Method
3. 03Execution
4. 04Verification
5. 05Certificate

This allows an ITAD operator to associate each physical storage device with its sanitization result.

Typical applications include:

The two commonly referenced IS5 profiles should not be treated as identical.

Commercial and technical references commonly describe the Enhanced profile as a three-pass sequence using zero, one/complement and random data, followed by verification.

The pass count should not, however, be interpreted as a universal measure of sanitization strength across modern storage technologies.

HMG IS5 and current NIST media-sanitization guidance represent different generations of sanitization practice.

This distinction is important for organizations using the HMG IS5 name today.

UK government documentation identifies HMG IA Standard No. 5 — SecureSanitisation as a former standard and directs users toward current NCSC guidance for secure sanitisation of storage media.

At the same time, current UK government procurement documentation continues to reference IS5 where contractual or departmental requirements specifically call for it. For example, an August 2026 UK government FOI response states that end-of-life hardware/media containing data must be handled in accordance with HMG Information Assurance Standard No. 5 and that relevant certification and a Certified Data Security Report may be required when an external provider performs the service.

Therefore, the correct modern positioning is:

rather than presenting HMG IS5 Baseline as the current universal UK sanitization standard.

DSP supports offline sanitization workflows for environments where internet connectivity is restricted or unavailable.

This can be valuable for:

• Government Facilities
• Secure Environments
• Air-Gapped Networks
• Enterprise ITAD Centers
• Data Centers
• Sensitive Media-Processing Facilities

The sanitization operation can be executed locally while the resulting certificate and audit information are retained for reporting.

Enterprise and ITAD operations may need to process many storage devices.

DSP provides structured device-level processing with visibility into:

• Device Identity
• Sanitization Status
• Progress
• Processing Rate
• Verification
• Errors
• Completion Status

The operational sequence is:

1. 01Identify
2. 02Select HMG IS5 Baseline
3. 03Sanitize
4. 04Verify
5. 05Certify

This allows organizations to standardize the processing of supported storage media.

HMG IS5 Baseline remains a recognizable UK secure-sanitization methodology, particularly where historical requirements, customer contracts or organizational procedures explicitly specify it.

With Data Sanitization Pro, the selected HMG IS5 Baseline profile is executed through the DSP Sanitization Engine, monitored during processing, verified after execution and documented through an audit-ready sanitization certificate.

1. 01Select HMG IS5 Baseline
2. 02Identify
3. 03Assess
4. 04Execute
5. 05Verify
6. 06Document
7. 07Certify

For current deployments organizations should also evaluate applicable NCSC guidance and current media-specific sanitization practices, particularly for SSD, NVMe and other modern storage architectures.