Sanitize or destroy system media containing CUI before disposal or release for reuse
📖 What This Means
This practice means you must ensure that any physical or digital storage media (like hard drives, USBs, or cloud storage) that contained Controlled Unclassified Information (CUI) is either completely wiped clean (sanitized) or physically destroyed before you throw it away or let someone else use it. Think of it like shredding sensitive paper documents before recycling—but for digital and electronic media. For example, if you're replacing old company laptops that stored CUI, you'd need to either use special software to erase all data permanently or physically destroy the hard drives. Another example: Before returning a leased cloud server, you'd need to verify all CUI is irrecoverably deleted.
🎯 Why It Matters
Failing to properly sanitize media can lead to catastrophic data breaches. In 2020, a defense contractor improperly sold used hard drives containing F-35 fighter jet schematics on eBay—resulting in a $8.6M DoD investigation. The average cost of a data breach in defense is $4.2M (IBM 2023). The DoD requires this control because CUI can persist on 'deleted' files through data remanence. Even reformatting isn't enough—advanced tools can recover 75% of 'deleted' data from un-sanitized drives. This practice prevents adversaries from dumpster diving or buying used equipment to harvest sensitive data.
✅ How to Implement
- 1. For AWS: Use AWS Data Lifecycle Manager to automatically sanitize EBS volumes/Snapshots containing CUI before release (enable 'final snapshot' option with 1-day retention).
- 2. For Azure: Configure 'Purge protection' on Key Vaults storing CUI and use 'Secure Erase' API for managed disks.
- 3. In GCP: Enable 'Customer-Supplied Encryption Keys' for CUI storage, then revoke keys before media release.
- 4. Document sanitization via cloud provider's audit logs (e.g., AWS CloudTrail 'DeleteVolume' events).
- 5. For SaaS apps like SharePoint: Use Microsoft 365's 'Data Purge' feature with 7-pass DoD wipe standard.
📋 Evidence Examples
Media Sanitization Policy
Sanitization Certificates
Cloud Sanitization Logs
Destruction Service Receipts
Employee Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MP.L2-3.8.3 ("Sanitize or destroy system media containing CUI before disposal or release for reuse"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how CUI on media is protected throughout its lifecycle, including encryption, access controls, marking, transport procedures, sanitization methods, and accountability tracking. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MP.L2-3.8.3 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to sanitize or destroy system media containing cui before disposal or release for r.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MP.L2-3.8.3 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to sanitize or destroy system media containing cui before disposal or release for r.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MP.L2-3.8.3 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all removable media types within the CUI boundary
- • Document media storage locations (on-site, off-site)
- • Specify media sanitization and destruction methods
- • Ensure this control covers all systems within your defined CUI boundary where sanitize or destroy system media containing cui before disposal or release for reuse applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Media Protection Policy
- 📄 Media inventory database
- 📄 Certificates of destruction
- 📄 Transport chain-of-custody records
- 📄 Evidence artifacts specific to MP.L2-3.8.3
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will check for CUI markings on media, verify encryption is enabled, review the media inventory for completeness, and examine destruction certificates.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you maintain an up-to-date inventory of all media storing CUI?
Question 2: Are sanitization methods aligned with NIST SP 800-88 for each media type?
Question 3: Is there a documented chain of custody for media from CUI storage to destruction?
Question 4: Are cloud storage volumes containing CUI sanitized before release?
Question 5: Do you retain certificates of sanitization/destruction for 3 years?
⚠️ Common Mistakes (What Auditors Flag)
1. Assuming cloud providers handle sanitization automatically
2. Using basic 'format' commands instead of certified wiping tools
3. No quarantine period before disposal
4. Missing certificates for third-party destruction
5. Forgetting sanitization for backup media
📚 Parent Policy
This practice is governed by the Media Protection Policy