HMG IS5 Enhanced — UK Secure Data Erasure & Sanitization Software

HMG IS5 Enhanced was designed as a stronger multi-pass sanitization profile than the Baseline method.

In commonly implemented software profiles, the Enhanced method performs three overwrite passes:

This three-pass representation is documented in Common Criteria security-target material for certified erasure products.

The purpose is to replace previously stored information with multiple defined patterns before completing a final verification stage.

DSP implements HMG IS5 Enhanced as a dedicated sanitization method, rather than presenting it as a generic multi-pass wipe.

SELECT HMG IS5 ENHANCED ↓ IDENTIFY DEVICE ↓ ASSESS STORAGE MEDIA ↓ DSP SANITIZATION ENGINE ↓ PASS 1 — 0x00 ↓ PASS 2 — 0xFF ↓ PASS 3 — RANDOM DATA ↓ VERIFY RESULT ↓ DOCUMENT OPERATION ↓ AUDIT-READY SANITIZATION CERTIFICATE

The selected method, device identity, execution status and verification information can be recorded as part of the sanitization report.

HMG IS5 Enhanced is primarily encountered as a software-based multi-pass data wiping methodology.

It can be relevant where an organization has specifically selected or contractually requires the historical HMG IS5 Enhanced profile.

Typical use cases include:

• IT Asset Disposition
• Computer Refurbishment
• Hardware Recycling
• Enterprise Device Retirement
• Secure Hard-Drive Wiping
• Data-Center Equipment Decommissioning
• Corporate Asset Disposal
• Government Asset Handling
• Secure Media Reuse

A three-pass overwrite should not automatically be treated as equivalent to every modern media-sanitization requirement. The appropriate sanitization technique depends on the storage technology, data sensitivity, device condition and intended disposition.

HMG IS5 Enhanced is particularly associated with traditional magnetic storage and addressable-sector overwrite operations.

For conventional HDDs, DSP can:

• Identify Drive Model And Serial Number
• Detect Capacity And Interface
• Assess Device Health
• Execute The Configured Three-Pass Method
• Monitor Sanitization Progress
• Track Read/write Errors
• Identify Bad Sectors
• Perform Verification
• Generate An Audit-Ready Certificate

DSP can provide operational information such as:

This provides additional device-level context around the actual sanitization operation.

Modern SSD and NVMe storage requires additional consideration.

Unlike traditional magnetic HDDs, flash storage uses technologies such as:

• Flash Translation Layers
• Wear Leveling
• Garbage Collection
• Spare Blocks
• Over-Provisioning
• Remapped Physical Locations

Consequently, repeatedly overwriting logical sectors through a normal interface does not necessarily guarantee that every historical physical flash location has been overwritten.

For this reason, HMG IS5 Enhanced should not be treated as a universal physical sanitization technique for every SSD or NVMe device.

DSP can identify the storage technology and provide the applicable sanitization workflow. Where a media-specific command or stronger sanitization technique is appropriate organizations should select the method according to their security policy and applicable modern guidance.

This distinction is particularly important when comparing historical multi-pass wiping methods with modern storage sanitization approaches such as NIST SP 800-88 Rev. 2 and IEEE 2883.

The Enhanced profile therefore represents a multi-pass historical wiping methodology, rather than simply a higher number of repeated identical writes.

HMG IS5 Enhanced and the historical DoD 5220.22-M three-pass method are frequently grouped together because both are commonly represented by three-pass overwrite profiles.

However, they should not automatically be described as the same standard.

A commonly documented HMG IS5 Enhanced profile uses:

1. 010x00
2. 020xFF
3. 03Random

Historical DoD 5220.22-M software implementations are also commonly represented using a three-pass sequence involving zeroes, ones/complementary data and random data with verification.

DSP maintains them as separate sanitization methods, allowing the operator to select the methodology actually required by the organization's policy or workflow.

Historical multi-pass overwrite methods remain relevant when an organization specifically requires them, but modern storage sanitization has evolved.

The appropriate method should be selected based on data sensitivity, storage technology, device condition, reuse requirements and organizational policy, rather than simply choosing the method with the greatest number of overwrite passes.

Sanitization is more than starting a wipe process.

DSP records the execution and verification outcome of the selected HMG IS5 Enhanced method.

Depending on the configured workflow, the report can document:

A successful sanitization process depends on the storage area being accessible to the selected technique.

DSP can identify and report conditions such as:

• Read Errors
• Write Errors
• Bad Sectors
• Unstable Sectors
• Device Health Warnings
• Inaccessible Regions
• Sanitization Failures

This is important for asset disposition because a drive with inaccessible sectors may require a different sanitization decision rather than simply being marked as successfully wiped.

IT Asset Disposition operations often process large numbers of retired computers and storage devices.

DSP can support ITAD workflows requiring:

• Device Identification
• Serial-Number Tracking
• HMG IS5 Enhanced Selection
• Multi-Device Sanitization
• Progress Monitoring
• Verification
• Failed-Device Identification
• Audit Reporting
• Certificate Generation

This provides a structured workflow from device intake to sanitization evidence.

DSP can support offline sanitization workflows where devices cannot be connected to external cloud services.

This can be useful for:

• Government Environments
• High-Security Facilities
• Air-Gapped Networks
• Enterprise Data Centers
• Restricted Laboratories
• Defense Environments
• Secure ITAD Facilities

The sanitization process can be executed locally while maintaining the relevant device, execution and verification information required for reporting.

After the sanitization process, DSP can generate an audit-ready sanitization certificate documenting the operation performed by the software.

The certificate can include:

The DSP certificate is evidence of the sanitization operation performed by DSP.

It is not a certificate issued by NCSC, CESG, the UK Government or another standards authority and it should not be presented as external HMG certification of DSP.

The distinction is important when preparing compliance, procurement or ITAD documentation.

HMG IS5 is a historical/former UK secure-sanitisationframework. Current UK government and NCSC material refers to modern secure-sanitisation guidance rather than treating IS5 as a universal current wiping requirement. UK government material also shows that HMG IS5 can still appear in specific contractual or departmental requirements.

The NCSC's sanitisation assurance landscape has also evolved; its former CAS-S scheme closed on 5 January 2026, with new assurance arrangements introduced through Cyber Resilience Test Facilities.

Therefore organizations should distinguish between:

Historical HMG IS5 Enhanced methodology and Current UK secure-sanitisationrequirements

when defining their sanitization policy.

DSP provides a dedicated implementation of the HMG IS5 Enhanced methodology through its DSP Sanitization Engine.

IDENTIFY Identify the storage device.

CLASSIFY Determine media type and device characteristics.

ASSESS Check device condition, accessibility and relevant storage information.

SELECT Select HMG IS5 Enhanced.

EXECUTE Run the configured three-pass sanitization process.

VERIFY Verify the sanitization result.

VALIDATE Review the result and determine whether the device meets the organization's acceptance criteria.

DOCUMENT Record the operation and verification evidence.

CERTIFY Generate the audit-ready DSP sanitization certificate.

HMG IS5 Enhanced is one of the sanitization methods available through DSP.

Organizations can use the DSP Sanitization Engine to select the methodology required for their specific workflow rather than maintaining separate wiping applications for different standards.

Supported methodology profiles include modern and historical approaches such as:

Each method is executed as its own selectable DSP sanitization profile, with method-specific processing, verification and reporting.

• 01DSP-DPDP India
• 02NIST SP 800-88 Rev. 1 Clear
• 03NIST SP 800-88 Rev. 1 Purge
• 04NIST SP 800-88 Rev. 2 Clear
• 05NIST SP 800-88 Rev. 2 Purge
• 06IEEE 2883-2022
• 07ISO/IEC 27040:2024
• 08Random Overwrite
• 09DoD 5220.22-M
• 10DoD 5220.22-M ECE
• 11NSA/CSS Policy Manual 9-12
• 12HMG IS5 Baseline
• 13HMG IS5 Enhanced
• 14CSEC ITSG-06
• 15BSI-GSE
• 16BSI VSITR
• 17Gutmann Method
• 18Schneier Algorithm
• 19Pfitzner Method
• 20AFSSI-5020
• 21AR 380-19
• 22GOST R 50739-95
• 23NZISM
• 24NAVSO P-5239-26
• 25RCMP TSSIT OPS-II