MP.L2-3.8.3
Media Disposal [CUI Data]
Requirement
Assessment objectives
An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.
Determine if:
- asystem media containing CUI is sanitized or destroyed before disposal; and
- bsystem media containing CUI is sanitized before it is released for reuse.
From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.
How to implement
Before media that held CUI is thrown away, recycled, returned at lease end or reissued for another use, sanitize or destroy it so the CUI cannot be recovered. Use the NIST SP 800-88 method that fits the media (clear, purge or destroy), use certified vendors for bulk destruction, and keep a record for every item. Federal CUI rules (32 CFR 2002) require destruction that leaves CUI unreadable, indecipherable and irrecoverable.
- 1PolicyWrite a media sanitization procedure that lists each media type you have (paper, HDDs, SSDs and NVMe, USB flash, optical discs, tapes, phones and tablets, copier and printer drives, network devices) and the NIST SP 800-88 method for disposal and for reuse, plus who performs and who verifies.[a][b]
- 2ProcessFor disposal: shred paper with a cross-cut or micro-cut shredder or a locked shred-bin service; destroy drives and flash media by shredding, crushing or disintegration in-house or through a certified ITAD or destruction vendor that issues serial-numbered certificates; degauss only magnetic media (hard drives and tapes), never flash.[a]
- 3TechnicalFor reuse within the company or release outside it: purge, not just delete or format. Use ATA/NVMe sanitize or secure erase, or cryptographic erase on encrypted drives, for SSDs; overwrite for magnetic hard drives; factory reset for encrypted phones and tablets. Verify a sample after sanitizing.[b]
- 4
- 5
Evidence to collect
Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.
Dated procedure mapping media types to NIST SP 800-88 methods for disposal and reuse.
Spreadsheet or ticket export listing each item, serial, method, performer and verifier.
Vendor certificates of destruction or sanitization[a]
record · each pickup in the assessment period
Certificates from the shredding or ITAD vendor listing serial numbers or containers and dates.
Erasure tool reports[b]
record · each reuse in the assessment period
Reports or screenshots from the erasure tool (for example a Blancco certificate or a vendor tool's completion screen) for reused media.
How assessors check
- Examine
- Media sanitization policy and procedures, sanitization and disposal records, vendor certificates, sanitization equipment and tools, asset inventory.
- Interview
- Personnel who sanitize or dispose of media; the ITAD or shredding vendor contact if needed.
- Test
- Demonstrate the sanitization method on a test drive or show the shredder; pick a retired laptop from the inventory and produce its sanitization record.
Tools and products
Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.
Industry standard for audited erasure with certificates; sized for larger fleets and ITAD vendors.
Locked consoles for paper and hard-drive shredding with certificates; choose NAID AAA certified service.
Look for serial-numbered certificates and on-site shredding if you want to witness destruction.
Degaussers (Garner, Proton) work on magnetic drives and tapes only; a manual drive crusher handles both. Worth buying only if you destroy media regularly.
Vendor tools and nwipe are free; Parted Magic is a low-cost paid toolkit. Use secure erase or sanitize for SSDs and overwrite only for magnetic drives.
The reference the assessment guide cites for choosing clear, purge or destroy per media type.
Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.
Common pitfalls
- Formatting or 'deleting everything' and calling it sanitized.
- Degaussing SSDs or USB drives, which does not remove data from flash memory.
- Recycling vendors that take equipment but give no serial-numbered certificate.
- Copier and printer hard drives left in leased devices at return.
- No reconciliation, so a retired laptop has no sanitization record and the assessor cannot tell what happened to it.
Platform notes
Microsoft 365 (GCC / GCC High)
Intune Wipe or Autopilot Reset on BitLocker-encrypted Windows devices, and wipe on encrypted mobile devices, act as cryptographic erase for reuse; document that method in the procedure and keep the device action history as the record. Cloud data deletion within GCC or GCC High is covered by Microsoft under its FedRAMP package (inherited).
Google Workspace
Admin console wipe for managed devices and ChromeOS powerwash serve the same role. Google handles sanitization of its own cloud media (inherited from its FedRAMP authorization).
On-premises or MSP-managed
Make sanitization and certificates part of the MSP's hardware-retirement service; keep copies of the certificates yourself. For servers and arrays, require vendor drive retention so failed drives stay on-site.
Related practices: MP.L1-b.1.vii, MA.L2-3.7.3, MP.L2-3.8.1, CM.L2-3.4.1
Editorial implementation guidance published November 2, 2026. It is not part of the official requirement and does not replace the assessment guide.
Crosswalk
Full crosswalkThe NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports.
NIST SP 800-171 Rev 2
3.8.3SP 800-171 Rev 3
03.08.03SP 800-53 Rev 5
MP-2DMP-4DMP-6DSHow these were reachedHide how these were reached
- MP-2 · Media Access
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 MP-2 → 800-53 Rev 5 MP-2
- MP-4 · Media Storage
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 MP-4 → 800-53 Rev 5 MP-4
- MP-6 · Media Sanitization
- D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison · via 800-53 Rev 4 MP-6 → 800-53 Rev 5 MP-6
- S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL) · via 800-171 Rev 3 03.08.03 → 800-53 Rev 5 MP-6NIST: 03.08.03 also: 3.7.3 incorporated into
Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. NIST also names this Rev 3 requirement as the successor of other withdrawn requirements: open “How these were reached” under the Rev 5 controls for which, in NIST's words.
Where each link comes from (9 links from 5 official documents)
32 CFR Part 170 Office of the Federal Register / GPO
- MP.L2-3.8.3 → 3.8.3“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)
Trace notes
Notes marked NIST state what the owners' own files say. Notes marked Expert CMMC note are our reading of the links, not official guidance. Neither is a crosswalk link.
About SP 800-171 Rev 2 3.8.3
Expert CMMC note3.8.3 ↔ MP-2 (SP 800-53 Rev 4)
NIST SP 800-171 Rev 2 Appendix D maps basic requirements 3.8.1–3.8.3 jointly to MP-2, MP-4, MP-6. MP-2 mainly supports 3.8.2, not 3.8.3 specifically.
Relies on: NIST SP 800-171 Rev 2, p.87, Appendix D, Table D-8
Expert CMMC note3.8.3 ↔ MP-4 (SP 800-53 Rev 4)
NIST SP 800-171 Rev 2 Appendix D maps basic requirements 3.8.1–3.8.3 jointly to MP-2, MP-4, MP-6. MP-4 mainly supports 3.8.1, not 3.8.3 specifically.
Relies on: NIST SP 800-171 Rev 2, p.87, Appendix D, Table D-8
Further discussion
Practice guide notes
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Sanitize or destroy media containing controlled information before disposal or reuse.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As you pack for an office move, you find some old CDs in a file cabinet. You determine that one has information about an old project your company did for the DoD . You shred the CD rather than simply throwing it in the trash [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media sanitization and disposal; applicable standards and policies addressing media sanitization; system security plan; media sanitization records; system audit logs and records; system design documentation; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Deleting files without applying and verifying the selected sanitization method.
Track this in a workspace
The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Source: DoD CIO · https://dodcio.defense.gov/CMMC/