What MP.L2-3.8.3 media disposal requires for CUI
When a CMMC Level 2 assessment is on the calendar, the question for the compliance lead is whether every retired drive, backup tape, copier hard drive and printer that ever held CUI can be shown to have been cleared. MP.L2-3.8.3 asks for two things, and an assessor tests each separately: media containing CUI must be sanitized or destroyed before disposal, and it must be sanitized before it is released for reuse. The risk is residual CUI: data that survives a delete, a reformat or a hardware refresh and reaches a recycler, a resale channel or a new user. MP.L2-3.8.3 is a 5-point requirement, and it cannot go on a POA&M, so a gap here blocks Conditional or Final Level 2 status outright. The requirement carries the same weight in the scoring methodology as the other media protection requirements that are not single-objective items, so treat it as a hard gate.
The work is harder than the wording suggests. Asset inventories often miss devices that were never formally registered, such as multifunction printers with storage, spare laptops in a cupboard or test equipment that synced to a cloud account. Media also sits outside the company's own walls: cloud snapshots and backup copies held by a provider, drives returned under a vendor warranty, and devices owned by a managed service provider. Each of these needs a documented owner and a disposal path. Equally important is proof. An assessor will look for sanitization procedures, the standards and policies the company follows, sanitization records and related audit records, and will test that the process actually works. Ask your team which method each media type uses under NIST SP 800-88 and whether a cryptographic erase is documented for encrypted devices, since the DoW FAQ accepts it when properly implemented but encrypted CUI remains CUI until formally decontrolled.
The Level 1 counterpart is MP.L1-b.1.vii, which draws on the same SP 800-171A objectives with federal contract information in place of CUI, so a company that already sanitizes media for Level 1 has a starting procedure to extend. The Phase II suspension announced on 13 July 2026 does not change what must be MET today. Phase I self-assessments, SPRS postings and DFARS 252.204-7012 obligations remain in place, and any contract that requires Level 2 must be supported by a score that shows this requirement as met. Confirm current timing with your contracting officer and the CMMC Program rule text before planning dates, and verify each sanitization claim with records that exist, not with an expectation that they will be produced later.
Which media and disposal paths fall under MP.L2-3.8.3
MP.L2-3.8.3 applies wherever CUI sits on system media, so the scope question is less about which devices you own and more about which storage paths carry CUI at any point. Each card below is a path that often gets missed, with the check to run before you write the sanitization procedure. Confirm each decision with your assessor before the assessment begins.
Hard drives and SSDs
Internal and external hard drives and solid-state drives are the core of this requirement, because they hold CUI long after users delete files. SSDs need particular attention because overwriting does not reliably reach every flash cell, so your procedure should name the sanitization method for each drive type. Inventory every workstation, server and laptop that has ever stored CUI, including drives removed during repair. Confirm your method against NIST SP 800-88 with your assessor.
USB and removable media
USB drives, memory cards and optical discs used to move CUI are media in scope, even when they were used only once for a file transfer. Staff often forget these devices in desks or drawers, so disposal scope should include a sweep of storage locations. Record which removable devices were issued, reused or retired, and sanitize or destroy each one before it leaves your control.
Backup tapes and backup copies
Backup tapes, removable backup drives and retired backup appliances hold CUI copies that people often overlook when they plan disposal. Map every backup location and its retention period so you know which media will age out and when. A backup set that outlives its retention schedule is still CUI media, and its disposal must be documented like any other.
Copiers and multifunction printers
Multifunction printers and copiers with internal storage can retain scanned and printed CUI on their hard drives. Determine whether each device has storage, whether it is covered by a lease, and what the vendor does with the drive at return. Ask the vendor in writing how the drive is sanitized or whether it is removed and destroyed, and keep that record with your disposal evidence.
Mobile devices and cloud volumes
Phones, tablets and cloud storage volumes can hold CUI through synced files, cached data and attached volumes. For mobile devices, define whether a wipe, a management-console action or physical destruction is the disposal method, and record it per device. For cloud volumes, decide how a deleted volume is erased and confirm whether the provider's deletion process meets your sanitization standard before you rely on it.
Vendor repair, lease return and third-party disposal
Media that leaves for vendor repair, lease return or third-party destruction is a scoping decision, not an afterthought. Include the vendor in your sanitization records, require a written certificate of sanitization or destruction, and confirm that the vendor is inside the assessment scope or documented as an external service provider. If the vendor cannot show a method aligned with NIST SP 800-88, sanitize the media yourself before release.
How an assessor tests media sanitization before disposal and reuse
This table compares the two assessment objectives for MP.L2-3.8.3, the test approach an assessor applies to each, the evidence requested and the findings that most often cause a requirement to be scored NOT MET. Read each row as a question the assessor will ask, then check whether your records answer it for every device and drive in scope.
| Assessment objective | How the assessor tests it | Evidence requested and common findings |
|---|---|---|
| Media containing CUI is sanitized or destroyed before disposal | Examines the written sanitization procedure and the standards it cites, interviews staff who retire drives and devices, and selects sample media to trace from the disposal log back to a completed sanitization or destruction | Procedure, sanitization records and disposal certificates. Finding: no record for individual devices, or a procedure that staff do not follow in practice |
| Media is sanitized before release for reuse | Checks whether reused drives, laptops and removable media go through the same documented sanitization step before reassignment, and tests the mechanism on sample media where the organization claims a method such as cryptographic erase | Sanitization records showing the method and verification for each reused device, plus audit records. Finding: reused media released without a record, or cryptographic erase claimed without evidence that keys were destroyed |
| Sanitization method matches the media type | Reviews whether the chosen method (overwrite, purge, destroy or cryptographic erase) suits each media class in the inventory, following NIST SP 800-88 as the reference | Method mapping by media type, such as SSDs, HDDs, tape and phones. Finding: one generic method applied to all media without rationale |
| Destruction vendor performs the work | Interviews the staff who hand off media and reviews the contract and chain-of-custody steps before media leaves the organization | Vendor certificate of destruction listing serial numbers, plus custody records. Finding: certificate missing, or it does not identify the devices delivered |
| Records are complete and traceable | Selects a sample of disposal and reuse events and checks that each one links to an asset, a date, a person and a method | Sanitization log linked to the asset inventory. Finding: records kept in email or on paper with no link to asset identifiers |
| Staff understand and follow the process | Interviews administrators and help desk staff to confirm they know when sanitization applies and who signs off | Training or briefing records and named approvers. Finding: staff unaware that devices returned under warranty or lease require sanitization |
Implementing a sanitization process that produces records
This sequence turns MP.L2-3.8.3 from a policy statement into a repeatable process in which every CUI-bearing media item is inventoried, sanitized by a method matched to its media type, verified, and documented well enough for an assessor to test both objectives. The output is a set of sanitization records that tie each device or media item to its method, operator and verification result.
Inventory every media item holding CUI
Start with a complete list of system media that holds or has held CUI, including laptops, workstation drives, servers, storage arrays, removable drives, backup media, printers with storage, copier hard drives and paper-linked media where applicable. Assign each item a unique identifier, record its location, owner and custodian, and link it to the system security plan boundary. Use your asset inventory as the starting point, but confirm it against the systems that actually process CUI. The output is a reconciled media register that lists every item in scope for disposal or reuse.
Classify each item by disposal and reuse path
For each item in the register, decide whether it will be destroyed, sanitized and released for reuse, sanitized and returned to a vendor, or sent off-site for maintenance. Record the path and the reason, such as a failed drive that cannot be wiped or a laptop being redeployed inside the enclave. Items that leave your control, including leased equipment, need a documented route to a party that will sanitize or destroy them. The output is a disposition field on every register entry.
Write a sanitization standard based on NIST SP 800-88
Document a media sanitization standard that names the approved methods for each media type, the conditions under which each applies, the person who authorizes disposal, and the evidence each sanitization must produce. NIST SP 800-88 describes the sanitization categories and decision considerations, and your standard should cite it directly. Include a rule that encrypted CUI is still CUI until formally decontrolled, so cryptographic erase is only one accepted method when it is implemented correctly. The output is an approved, versioned standard that the operators can follow without interpretation.
Select the method for each media type
Match each media type to a method from the standard: overwriting for drives where overwrite is verified to work, cryptographic erase for self-encrypting or encrypted media where the key can be destroyed, degaussing for magnetic media where the method is suitable, and physical destruction for failed, unsupported or high-risk media. Confirm each choice with the hardware or software vendor, because some solid-state and self-encrypting devices behave differently from spinning disks. Note any media where none of the methods works, and route it to destruction. The output is a method assignment for every media type in the register.
Run and log each sanitization
Have a named operator perform the sanitization using the assigned method, and log the date, media identifier, method, tool and version, operator, and any errors or exceptions. For cryptographic erase, record the key identifier and the step that destroyed the key. For physical destruction handled by a contractor, retain the vendor's certificate of destruction with the item serial numbers. The output is a sanitization log entry for every item that left the active system.
Verify each sanitization before release
Check that the sanitization worked before the item is reused, returned or discarded. Verification might mean sampling sectors on an overwritten drive, confirming that a cryptographic erase left no usable key material, or confirming that a destroyed item matches the destruction record. Record the verification method, the result and the verifier, and send any failure back to a remediation path instead of release. The output is a verified sanitization record for each item, with failures tracked to closure.
Retain and review sanitization records
Store the register, standard, sanitization logs, verification results and vendor certificates in a controlled repository with restricted write access, and keep them for the period your contract and records policy require. Review a sample of records on a schedule you define, checking that each disposal traces back to an inventory entry and that the logs match the method in the standard. Assessors typically test whether these records exist, are complete and are consistent with the process, so the records should be the first thing you show them. The output is a retained, reviewed record set that answers both assessment objectives for 3.8.3.
When cryptographic erase counts as sanitization
Cryptographic erase can satisfy the sanitization objective in MP.L2-3.8.3, but only when the media was encrypted from the start and the encryption keys are destroyed in a way you can document. The DoW CMMC FAQ (July 2026) is clear on the trade-off: encrypted CUI remains CUI until it is formally decontrolled, yet cryptographic erase, properly implemented under NIST SP 800-88, is acceptable for sanitizing controlled media before disposal or reuse. The method therefore has to be proven, not assumed. Your assessor will look for the encryption configuration, the key destruction record and the sanitization record that ties the two together.
Start by verifying that encryption was in place for the whole life of each device. Check the encryption status of every in-scope drive, laptop, server volume and backup target against your asset inventory, and record the date encryption was enabled. A drive that held unencrypted CUI for any period cannot be cleared by destroying its key alone, because the earlier plaintext copies were never protected by that key. Document the cryptographic module and its validation status for each platform, and confirm the setup with your assessor before you rely on it for disposal.
Document the key lifecycle as evidence in its own right. Record where each data encryption key was generated, where it was stored, which role could access it, and when and how it was destroyed, including any escrow or backup copies that also need destruction. Keep the key destruction record linked to the device serial number or asset tag, the sanitization date and the person who approved the action. Where cryptographic erase does not fit, such as unencrypted media, a failed or partial encryption setup, or a device whose key cannot be confirmed as destroyed, fall back to a NIST SP 800-88 overwrite, purge or physical destruction method and document that decision. Confirm your method choices and record formats with your assessor before the first disposal cycle.
Sanitization records that pass an assessment
An assessor testing MP.L2-3.8.3 looks for proof that sanitization happened, not just a policy that says it should. The cards below cover the artifacts that connect a written standard to each device, and the upkeep that keeps those artifacts usable at assessment time.
Written sanitization standard
The standard names the methods approved for each media type, such as overwrite, cryptographic erase or physical destruction, and ties each method to NIST SP 800-88. Assessors check that the standard covers both objectives of 3.8.3: sanitizing before disposal and sanitizing before release for reuse. Confirm that the document has an owner, a revision date and an approval record, and that the people running disposal have actually read it.
Method per media type
A single table should map each media class in scope, including spinning disks, SSDs, flash drives, tapes, optical discs, printers with storage and mobile devices, to the method used for it. SSDs and encrypted drives often need a different method than magnetic disks, so a generic line such as "wipe drives" will not hold up. Record which methods your organization has verified for each class.
Per-device sanitization log
Each sanitization event needs its own entry with the device make, model and serial number, the asset identifier from your inventory, the method, the start and end times, and the name of the operator. A log that lists only a batch count cannot show that a specific laptop with CUI was handled. Use an asset system such as GLPI, where you can tie the entry to the asset record, and keep the log under change control.
Verification results
Sanitization should be checked after it runs. Keep the output of the verification step for each device, such as a sample read, a tool's pass report or a confirmation that a cryptographic erase removed the key. A tick box signed by the operator is weaker evidence than a tool result attached to the device record. Note any failures and the action taken, including re-sanitization or destruction.
Vendor destruction certificates
When a third party destroys media, the certificate should list the serial numbers or batch identifiers received, the destruction method, the date, and the chain of custody from pickup to destruction. Compare the list against your own log so no item is unaccounted for. Confirm the vendor's own controls for the destruction facility, and make sure the contract requires certificates for each pickup rather than an annual summary.
Key destruction and audit records
Cryptographic erase is only as good as the destruction of its keys, so keep logs showing when each key was deleted, from which key store, and by whom, with the matching device serial numbers. Pair these with audit records from the systems that performed the steps, showing who ran each action and when. Assessors use these records to confirm the process ran as documented, so keep them retrievable and protected from alteration.
Who sanitizes, who prepares evidence and who assesses
The organization owns MP.L2-3.8.3. Its staff decide which media contain CUI, approve disposal and reuse, perform or supervise sanitization, and keep the records that show it happened. No outside party can take over these decisions, because the assessment tests what the organization actually does with its media. The internal team therefore needs a named owner for the media inventory and a clear hand-off to whoever destroys the media.
- Media inventory: Maintain a current list of drives, tapes, removable media and devices that have held CUI, including those returned from vendors or repairs.
- Disposal decisions: Record who approved each disposal or reuse, the method chosen, and whether the media is in scope for NIST SP 800-88 cryptographic erase or physical destruction.
- Sanitization records: Keep a log per item with date, method, operator, serial number and verification result, so an assessor can trace each media item to its disposal.
- Destruction vendors: Retain the vendor's certificate of destruction for every batch sent off site, and check that it names the serial numbers or asset tags released.
- Ownership of the control: Assign a responsible person who signs off the procedure and reviews the records on a set schedule.
Before an assessment, confirm that someone on staff can walk an assessor from a single asset in the inventory to its sanitization record and certificate.
An implementation partner helps the organization build the sanitization standard, connect it to its tooling and prepare the evidence templates. The partner does not perform the control on the organization's behalf and does not decide what counts as acceptable disposal. Its work product is documentation, configuration and training that the organization adopts and operates. Engagements are normally fixed in scope, with deliverables agreed in writing before work starts, and the organization should ask for that scope in writing.
- Sanitization standard: Draft a written procedure that maps each media type to a method aligned with NIST SP 800-88, including when cryptographic erase is used and how it is verified.
- Tooling integration: Connect asset records in an inventory tool such as GLPI so that disposal status can be tracked against each asset.
- Evidence templates: Prepare forms for disposal approval, sanitization logs and vendor certificate intake that the internal team completes.
- Staff training: Train the people who perform or approve sanitization so that the records they produce are consistent and complete.
- Clear limits: Confirm in the statement of work that the partner prepares systems and evidence, while the organization owns the control and the partner issues no attestation.
Ask the partner to show the templates and the training material, and confirm which deliverables transfer to the organization at the end of the engagement.
A Level 2 certification assessment is performed by a C3PAO authorized or accredited by The Cyber AB, and a self-assessment is performed by the organization itself against the NIST SP 800-171A objectives. The assessor tests the sanitization process independently. It examines the procedure, interviews staff, and samples media records and mechanisms, then decides whether each objective is met. The assessor issues findings and results based only on its own testing, never on work performed by a consultant or partner.
- Procedure review: The assessor checks that the written standard covers media types and disposal or reuse paths.
- Record sampling: The assessor selects items from the inventory and traces them to sanitization logs and destruction certificates.
- Mechanism testing: For cryptographic erase, the assessor looks for evidence that the method was implemented properly under NIST SP 800-88.
- Final-form evidence: Only completed records count. Drafts or unsigned templates do not satisfy the objective.
- Independence: The assessor may use the partner's documents as inputs, but it reaches its own conclusion.
Confirm the assessor's authorization status with The Cyber AB and agree the assessment scope before the records are gathered.
What meeting MP.L2-3.8.3 costs in money and effort
This table breaks down the cost components of sanitizing and disposing of CUI media under MP.L2-3.8.3, who is paid for each, and whether it is one-time or recurring. Use it to build a quote request, since no prices are published here and the real figures depend on your media volume and disposal paths.
| Cost component | Who is paid or who carries the effort | One-time or recurring, and main drivers |
|---|---|---|
| Sanitization tooling or degausser | Your organization (purchase) or a tool vendor (license) | Mostly one-time purchase; recurring if licensed. Drivers: media types (drives, tapes, mobile devices) and number of sanitization stations |
| Shredding or destruction service contract | A certified destruction vendor | Recurring per pickup or per container. Drivers: volume of physical and degraded media, pickup frequency, and whether destruction is on site or off site |
| Key management and cryptographic erase engineering | Internal engineers or an implementation partner | Mostly one-time design and scripting, plus recurring key rotation and reviews. Drivers: number of encrypted systems and key stores in scope |
| Written sanitization procedure | Internal compliance staff or an outside consultant | One-time drafting, then periodic review. Drivers: number of disposal paths (reuse, return to vendor, destruction, lease return) |
| Per-disposal labor and vendor certificates | Internal IT staff and the destruction vendor | Recurring with each disposal event. Drivers: asset count, outsourcing share, and how certificates are logged and stored |
| Sanitization inventory and logging | Internal staff; open-source tools can reduce license spend | Setup is one-time; upkeep is recurring. GLPI Assets can track disposal status and Wazuh can log sanitization events, which reduces manual record keeping |
| Assessor sampling effort | Your staff during the assessment, plus the independent assessor | Periodic, tied to assessment cycles. Drivers: how many disposals you can produce complete records for on request |
Open-source inventory and logging that support sanitization records
GLPI's Assets module can serve as the register of computers, storage devices, network equipment, printers and other hardware that may hold CUI. Entries can be created manually or populated automatically by the GLPI Agent, which uses native inventory built into GLPI since version 10. For sanitization records, the register matters because an assessor will ask which media existed, which ones left service, and whether each one has a documented disposal or reuse decision. Keeping serial numbers, asset tags, location and status in one place makes it possible to match each disposed item to its sanitization record.
- Serial numbers and asset tags: Record the identifiers that tie a physical drive or device to its disposal entry.
- Disposal status fields: Use lifecycle states such as in service, pending sanitization, sanitized, destroyed or released, and make sure changes are dated and attributed.
- Location and custodian: Record where each item sat and who was responsible, so the chain from storage to disposal is visible.
- Automated inventory: Where the GLPI Agent is deployed, use its data to catch devices that appear on the network but are missing from the register.
Confirm with your own environment whether your drives and removable media are captured as separate asset types, since many organizations track storage only at the computer level.
Wazuh's Syscollector module collects hardware, operating system, installed software, network interfaces, services and other endpoint details, and stores them in the Wazuh indexer for review in the dashboard. This gives the security team an independent view of which endpoints are active. Comparing that view with the device register shows whether an item marked as disposed still reports in, and whether an item in service is missing from the register. Assessors often test whether the inventory matches reality, so this comparison is a practical check on the sanitization program.
- Endpoint inventory: Syscollector reports hardware and operating system details from each enrolled endpoint, which supports identification of devices in service.
- Reconciliation checks: Compare Syscollector output against the GLPI register on a set schedule and document any differences and their resolution.
- Retired device alerts: Review endpoints that disappear from reporting or reappear after being marked for disposal.
- Dated reports: Export or retain inventory reports at points in time that support the sanitization timeline.
Confirm that your Wazuh deployment covers every system type that stores CUI, including servers, laptops and any devices outside the standard agent footprint, because Syscollector only reports where an agent is installed.
Zammad is a web-based helpdesk that gathers requests from email, chat, telephone and social media into one ticket system. It can hold a ticket for each disposal or reuse request, with the request details, the approver's decision and the link to the sanitization outcome. The ticket becomes the workflow record that shows who asked, who approved and when the action was closed. Assessors who test the sanitization process will look for this trail, and it is easier to produce when every request follows the same ticket path.
- One ticket per item or batch: Open a ticket for each disposal or reuse request, referencing the asset identifier from the register.
- Approval steps: Record the data owner or authorized manager who approves disposal, with the date of approval.
- Closure evidence: Attach or reference the sanitization method, the operator, and the verification result before closing the ticket.
- Access restrictions: Limit who can view or close disposal tickets, since the tickets themselves describe CUI-bearing assets.
Confirm your own approval workflow and retention rules before configuring Zammad, because the ticket record must match the process written in your policy.
GLPI, Wazuh and Zammad record evidence about media and disposal, but none of them performs sanitization or destruction. Sanitizing a drive, applying cryptographic erase under NIST SP 800-88, or physically destroying media remains a task for the organization's own tools or a qualified vendor. The records must show that the method was applied correctly, so the sanitization tool's own logs or certificates must be captured and linked to the ticket. Treat these open-source tools as the record-keeping layer around the process, not as the process.
- Sanitization tools are separate: Use approved wiping, cryptographic erase or destruction methods, and retain their outputs.
- Verification evidence: Store the result of each verification step with the corresponding asset record.
- Licensing terms: GLPI is licensed under GPL-3.0-or-later, Wazuh components are under GPL-2.0-only, and Zammad is under AGPL-3.0-only. Review these licenses with counsel before modifying or distributing the software, and especially before offering a modified Zammad as a network service, which the AGPL addresses.
- Scope of responsibility: The organization owns the control. An implementation partner can configure and document the tools, but only an independent assessor judges whether the requirement is met.
Confirm with your counsel which license obligations apply to your planned deployment, including any modifications and any service you offer to others.
Gaps that fail MP.L2-3.8.3 and how to close them
MP.L2-3.8.3 is a 5-point requirement that cannot be carried on a POA&M, so a single unsanitized drive can block Level 2 status. The gaps below share a root cause: media leaves the organization's control without a traceable record of how its CUI was removed. Each closure action creates the record an assessor will ask to see.
Media missing from the asset register
Drives, laptops, copiers and backup tapes that never entered the inventory cannot be traced to a sanitization event. An assessor who samples disposal records will ask where a device went, and a gap in the register becomes a gap in the evidence. Close it by reconciling the asset register against procurement records, the storage room and the disposal log, then recording a unique identifier for every item that holds CUI. Use an asset management tool such as GLPI, which tracks computers, peripherals and network equipment, and confirm it covers removable media and spares.
Reuse without sanitization
Reassigning a laptop, reissuing a USB drive or returning a leased printer to a vendor before sanitizing it breaks the second assessment objective of 3.8.3, which covers sanitizing media before release for reuse. This gap often hides in informal handoffs between departments. Close it with a hard gate: no device is reissued, reimaged for another user or returned to a lessor until a sanitization record exists and is linked to its asset ID. Confirm that the gate applies to contractors and loaned equipment too.
No record per device
A policy stating that media is sanitized does not satisfy the requirement on its own. Assessors look for a sanitization record for the specific media, showing the method, the date, the person who performed it and the outcome. A single batch sign-off covering twenty drives is weak evidence. Close it by requiring one record per device, with the method named from NIST SP 800-88 and a verification step, such as a read-back check or a confirmed key destruction result.
Vendor certificates not retained
When a destruction vendor shreds or degausses media, the certificate of destruction is the evidence that the organization disposed of CUI properly. Certificates that sit in an inbox or are never matched to serial numbers will not help during an assessment. Close it by requiring the vendor to list each item by serial number on the certificate, storing the signed document with the asset record, and confirming that the vendor's chain of custody is documented. Your contract should state how long the organization keeps these records.
Cryptographic erase claimed without verified encryption
Cryptographic erase is an acceptable sanitization method under NIST SP 800-88 only when the media was encrypted with a key that is then destroyed. Teams that claim this method on drives that were never encrypted, or that were encrypted with a key still held elsewhere, have no sanitization at all. Close it by checking each device's encryption status before disposal, confirming that the key is unique to the device and is destroyed in a logged step, and testing a sample to show that the data cannot be recovered. Encryption status should appear in the inventory.
Copier and printer storage ignored
Multifunction copiers and printers store scanned and printed images on internal drives, and many are returned to lessors with that data intact. Because these devices rarely appear in disposal procedures, they are a common blind spot for assessors who ask about all system media. Close it by listing every device with storage in the inventory, confirming whether its drive can be removed or overwritten, and adding the lease return or service exchange to the sanitization workflow with a documented record for each unit.
Questions about MP.L2-3.8.3 cost, effort and outside help
Can we sanitize and dispose of CUI media in-house without outside help?
Yes, in most organizations the media disposal process is run by the organization itself, because the organization owns its controls and its evidence. The work is mostly procedural: a written media sanitization standard, a named owner, a method for each media type, and sanitization records kept for each item. Your own staff can do this if they know NIST SP 800-88 and can show the assessor the records. Outside help is most useful when the environment is complex, such as many device types, cloud-hosted storage or a shared IT estate, or when the team lacks time to build the records. Read the requirement's assessment objectives in NIST SP 800-171A before deciding what to build.
What drives the cost and effort of MP.L2-3.8.3 media disposal?
The main drivers are the number and types of media in scope, where they are stored, and how much of the process already exists. Costs fall into three groups: internal staff time to write the standard and keep records, sanitization tools or services for physical media, and any outside help you buy. The number of asset records, the presence of cloud backups and the age of the device fleet all change the effort. Ask any provider for a written scope that lists media types, locations, sanitization methods and the records to be delivered. Costs recur whenever new media types or disposal vendors are added, and the process needs periodic review.
Can a partner help prepare sanitization evidence without affecting assessor independence?
Yes, a partner can prepare systems, procedures and evidence, provided it does not issue the assessment result. Under the CMMC program, Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB, so the assessor must be independent of the organization it assesses and of the team that prepared it. A partner may write the sanitization procedure, configure asset tracking and draft disposal records for your own use. The organization remains responsible for the controls and the final evidence. Confirm in the written scope exactly which artifacts the partner delivers and that the assessor is chosen separately.
How long does preparing media disposal evidence take?
The duration depends on the written scope, so there is no standard timeline to quote here. A narrow scope covering one media type and an existing disposal vendor will take far less time than a scope covering laptops, servers, cloud backups and removed maintenance equipment across several sites. Ask the provider to state the phases, the deliverables and the points where your staff must take part, such as approving the sanitization standard or reviewing disposal logs. Preparation time also depends on how quickly your team can produce records from existing ticketing or asset systems.
Is cryptographic erase accepted for sanitizing CUI media before disposal?
Cryptographic erase is accepted for sanitizing controlled media before disposal or reuse when it is properly implemented under NIST SP 800-88, according to the DoW CMMC FAQ dated July 2026. Encrypted CUI still counts as CUI until it is formally decontrolled, so the encryption and key destruction must be documented and verifiable. Your records should show the encryption method, the key lifecycle, when keys were destroyed and which device was affected. Confirm the current wording in the CMMC Program FAQ and check how your chosen tools implement the method before relying on it.
Does the Phase II suspension remove the media disposal requirement?
No. The Department of War suspended CMMC Phase II on 13 July 2026, but that does not remove MP.L2-3.8.3 from contracts that already incorporate the requirement. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, and the Department said it will enforce NIST SP 800-171 Rev. 2 in the interim. Because MP.L2-3.8.3 is a 5-point requirement, it cannot go on a POA&M and must be MET for Conditional or Final Level 2 status. Plan the disposal process now, and confirm your current obligations with the contracting officer.
What must our team supply before a media disposal engagement starts?
Your team must supply the facts that the provider cannot know from outside. The list usually includes:
- an inventory of systems and media types that hold or have held CUI, including backups and cloud storage
- your current disposal vendors, certificates of destruction and any sanitization tools in use
- the existing media handling policy, asset records and ticket history for past disposals
- named owners for approval, sanitization and record keeping
Ask the provider to list these inputs in the written scope, with the date each is needed, so that delays do not shift the delivery dates.
Which parts of media disposal are usually outsourced?
Organizations usually outsource the physical destruction of hard drives, the shredding or degaussing of older media and the recovery of disposal certificates from specialist vendors. Those vendors should be checked against NIST SP 800-88 expectations before you rely on them. Writing the sanitization standard, deciding the method for each media type and keeping the disposal log typically stay in-house, because the organization must own and show those controls. Outside help can also cover asset tracking setup, such as recording sanitization events in an open-source asset tool, but confirm the tool's capabilities with its documentation before committing.
How DeployOpen prepares MP.L2-3.8.3 evidence
DeployOpen plans, implements and documents media sanitization processes and their evidence inside the client's own environment, under a fixed written scope agreed before work starts. In practice that means mapping every location where CUI-bearing media lives or leaves the environment, including workstations, servers, NAS and backup targets, laptops, and any cloud storage volumes. For each class of media, the written scope should name the sanitization method, the tool or procedure that performs it, the person who authorizes disposal or release for reuse, and the record that proves it happened. DeployOpen builds those procedures and the records template around the assessment objectives in NIST SP 800-171A, so the client's sanitization steps can be tested directly against the two objectives for 3.8.3.
Cryptographic erase is the method most likely to need deliberate design. Under the DoW CMMC FAQ (July 2026), encrypted CUI remains CUI until formally decontrolled, but cryptographic erase implemented properly under NIST SP 800-88 is acceptable for sanitizing controlled media. DeployOpen can configure and document the encryption keys that make this work, but the client must confirm with its assessor that its implementation meets the NIST SP 800-88 expectations and that key destruction is verifiable. Sanitization logs, device inventories and disposal tickets, produced by inventory and helpdesk tools such as GLPI and Zammad where the client already uses them, can then tie each device to its outcome. DeployOpen supports that evidence trail; it does not certify that the sanitization meets any standard.
Readers should be clear on roles. The organization owns its controls and its sanitization decisions. DeployOpen prepares systems, procedures and evidence under the agreed scope. Only an independent assessor, or a C3PAO for Level 2 certification where that applies, issues assessment results or certifications. Because the current CMMC phase timing is in flux following the July 2026 suspension of Phase II, the client should confirm with its contracting office which assessment path applies before it commits to a scope. Ongoing support, periodic re-testing of sanitization records and updates to procedures can be covered by a retainer after the initial scope is delivered.
