03.08.03 media sanitization: what the requirement asks for before CUI media leave your control
Requirement 03.08.03 asks you to sanitize system media that contain CUI before it is disposed of, released out of your organizational control, or released for reuse. The compliance lead's question is usually concrete: a stack of drives is going to a recycler, a laptop is being returned to a leasing company, or a storage array is being reassigned to another project. The requirement does not prescribe one method. It asks that the organization choose a sanitization technique suited to the media type and the sensitivity of the data, apply it, and be able to show that it was done. Sanitization must leave no recoverable CUI behind. Deleting files, reformatting a volume or moving data to a recycle bin does not meet that bar, because the content often remains recoverable from the device. Confirm the method your team uses for each media type against the requirement and the NIST SP 800-171A Rev. 3 assessment procedure before you rely on it.
Rev. 3 also changed the scope of this requirement. Rev. 2 had a separate requirement, 3.7.3, that covered sanitizing equipment removed for maintenance. Rev. 3 withdrew that requirement and incorporated it into 03.08.03, so the same sanitization duty now applies when a device containing CUI leaves your control for repair, warranty replacement or vendor service, not only when it is retired. For contractors still assessed under CMMC Level 2, which uses Rev. 2, the older numbering remains in force. Your System Security Plan and any POA&M should reference the requirement set your assessment uses so that maintenance-related sanitization is not missed.
This requirement is hard in practice for three reasons. CUI media are often scattered across laptops, shared drives, copiers with storage, spare drives in desk drawers and backups, so an inventory of what holds CUI is a prerequisite. Disposal is frequently unlogged, with equipment handed to a facilities team or a waste contractor and no record of who approved it or how it was wiped. Vendor-handled equipment, including warranty returns and leased devices, is outside your direct control, so you need contract terms and documented proof of sanitization. Start by asking your asset management system for a list of devices that have held CUI, and require a certificate or log entry for every item that leaves your control.
Which media, systems and third parties fall under media sanitization scope
Sanitization scope is set by where CUI lives, not by which devices the IT team manages. Each card below is a decision point that changes what gets sanitized, who signs off and what evidence the assessor will ask to see.
Endpoints and servers inside the CUI boundary
Laptops, desktops, servers and virtual machines that process or store CUI are in scope for 03.08.03 when they leave organizational control, are released for reuse or are disposed of. The scoping question is whether the device ever held CUI, including temporary files, browser caches and synced folders, not whether it is currently assigned to a CUI project. The system owner and the security lead should agree on that boundary in writing, and the asset inventory should record which devices fall inside it so that retirement tickets trigger the right sanitization method.
Backup media and replicated storage
Backup tapes, disk snapshots, replication targets and offsite copies hold CUI long after the production system has changed, so they are often the forgotten media in a sanitization plan. Decide which backup generations are retained, how long, and who approves destruction when retention ends. The backup owner usually decides rotation and the security owner decides the sanitization method. Confirm with your backup vendor how deleted data is actually removed from appliances and replicas before you rely on a deletion command as evidence.
Printers, phones and other devices with storage
Multifunction printers, copiers, scanners, phones and collaboration devices often contain internal storage that retains print jobs, scanned images or cached data. These devices are easy to overlook because they sit outside the usual IT asset workflow. Ask the device owner and the facilities or procurement team to identify which units have storage that can hold CUI, and confirm with the manufacturer how that storage is cleared before the unit is returned, leased off or donated.
Equipment leaving for maintenance
Rev. 3 folded the Rev. 2 requirement for sanitizing equipment removed for maintenance into 03.08.03, so repair vendors and warranty returns are now part of this requirement, not only a maintenance control. The decision that matters is whether a drive can leave the premises intact or must be removed and retained. The maintenance owner and the security owner should agree on a rule for each case, and the authorization for that rule should be recorded before the equipment moves.
Disposal vendors and leased equipment
When a third party takes custody of media, the organization still owns the outcome. Contracts with disposal firms, recyclers and equipment lessors should state the sanitization method, the chain-of-custody steps, the certificate of destruction contents and the right to audit. Leased equipment returned at lease end is a common gap, because the lessor's standard process may not match your method. Procurement and legal typically own these terms, and the security owner should review them before signature.
Cloud and virtual storage
Cloud volumes, object storage buckets, virtual disks and managed database snapshots can hold CUI even though no physical drive is involved. Sanitization in these environments usually means cryptographic erasure, deletion of snapshots and versions, and confirmation that the provider's retention rules do not keep copies. The cloud platform owner should confirm which provider mechanisms apply and document them, because the organization cannot physically inspect the storage. Confirm the provider's data deletion terms in the service agreement rather than assuming them.
How an assessor tests media sanitization under SP 800-171A
For 03.08.03, SP 800-171A Rev. 3 gives the assessor one determination statement: the organization must sanitize system media that contain CUI before disposal, before release out of organizational control, or before release for reuse. The assessor does not accept a policy alone as proof. They work through the statement using three methods: examine, interview and test. Each method draws on a different set of objects, and the organization should expect the assessor to ask for evidence from all three. Because this requirement absorbed Rev. 2's 3.7.3 on equipment removed for maintenance, the scope also covers devices that left the environment for repair, so the organization should confirm that its sanitization procedure applies to those cases as well.
Under the examine method, the assessor reads the media protection policy and procedures, the procedures for sanitization and disposal, the applicable standards and policies that govern sanitization, and system audit records. The audit records matter most in practice. The assessor will ask whether a sanitization event leaves a traceable entry showing which media was handled, when, and by whom. Under the interview method, the assessor speaks with personnel who carry out sanitization and with those responsible for records retention and disposition. They will test whether these people know the procedure and whether the retention schedule agrees with the disposal steps. Confirm internally who owns each step before the assessment, since gaps between IT and records staff are a common finding.
The test method is where the assessor checks that sanitization works. They examine the sanitization processes and the mechanisms that support them, such as wiping tools, degaussers, or destruction services, and may ask to see a sample item go through the process. Ask your team to produce a sanitization record for a recent device, then trace it back to the audit log and forward to the disposal or reuse decision. If your organization relies on an outside destruction vendor, confirm in writing what the vendor certifies and what evidence it returns. The organization remains responsible for the outcome, and the assessment is performed by the federal agency or independent assessor, not by any implementation partner.
What assessors request and where sanitization findings usually land
This table compares the three assessment methods SP 800-171A Rev. 3 applies to 03.08.03, the evidence an assessor will ask for under each, and the gaps that most often appear. Read each row as a question the assessor will put to your team, and prepare the matching record before the assessment starts.
| Method | What the assessor requests | Where findings usually land |
|---|---|---|
| Examine | Media protection policy and procedures, documented sanitization and disposal procedures, applicable standards, and system audit records showing sanitization events | Procedures exist but do not name the media types covered, or audit records do not show that sanitization happened |
| Interview | Personnel responsible for media sanitization and personnel responsible for records retention and disposition, asked to walk through a real disposal | Staff describe a method that differs from the written procedure, or records staff do not know that disposal logs are required |
| Test | Sanitization processes and the mechanisms that support them, shown working on sample media or through a traced disposal | No sanitization record exists for a disposed drive, or the method used does not match the media type |
| Maintenance equipment | Records showing how equipment removed for maintenance was sanitized before leaving organizational control | Undocumented handling of equipment returned by vendors, the gap Rev. 2 3.7.3 covered and Rev. 3 now folds into 03.08.03 |
| Disposal chain | Chain-of-custody or disposal tickets linking each sanitized item to its serial number and sanitization date | Drives leave the building through a third-party recycler with no certificate of sanitization on file |
| Reuse and release | Evidence that media were sanitized before reassignment or release out of organizational control | Reused laptops or storage shelves have no record of the wipe, so the assessor cannot confirm it |
How to implement media sanitization in the order that produces evidence
This sequence moves from finding every place CUI lives on media to proving, record by record, that the data is gone before media leaves organizational control, so each step leaves an artifact an assessor can examine.
Inventory media that hold CUI
Start by listing every system media type that stores or has stored CUI, including servers, laptops, workstation drives, USB drives, backup tapes, printers with storage, copiers, phones, and paper. Pull this from the component inventory and asset records, and confirm with system owners where CUI actually flows, since shadow copies often sit outside the official inventory. The output is a media register that names each asset, its owner, its location, and its CUI status. You know this step is done when every asset in the system security plan boundary maps to a register entry and system owners have signed off on it.
Define sanitization methods per media type
Write a media sanitization procedure that states, for each media type in the register, the method you will use before disposal, release out of organizational control, or reuse. Methods may include clearing, purging, or destruction, and the procedure should reference the sanitization standard your organization adopts and the approved tools for each. Ask your assessor or contracting officer which standard they expect you to cite, and confirm any requirement that applies to your contract. The output is an approved, versioned procedure with a method table. You know it is done when each register entry points to a specific method and a named approver has signed the document.
Assign authorizers and performers
Name the people who authorize a sanitization decision and the people who carry it out, and document both roles separately where staffing allows. Include the owner of records retention and disposition, since that function often decides when media is ready to leave control. Interview these people during the assessment, so their responsibilities should be written down and they should understand the procedure. The output is a responsibilities matrix tied to the procedure. You know it is done when each media type has an authorizer and a performer, and both have acknowledged their duties in writing.
Add maintenance and vendor handling rules
Extend the procedure to cover equipment removed for repair, returned under warranty, or handled by an external service provider, since Rev. 3 folds the sanitization of maintenance equipment into this requirement. Define when a device must be sanitized before it leaves the site, what happens when sanitization is impossible, and what the vendor must certify or return. Review vendor contracts so they reflect these duties, and confirm the terms with your legal or procurement team. The output is a maintenance and vendor annex to the procedure plus updated contract language where needed. You know it is done when no removable repair path exists that bypasses sanitization.
Record each sanitization event in a log
Create a sanitization log entry for every event that captures the asset identifier, media type, method, date, person who performed it, person who authorized it, destination or disposition, and any exceptions. Store the log in a system with restricted write access and audit trails so entries cannot be quietly changed. Illustrative example: a laptop returned from repair gets one row that links to its service ticket and the verification result. The output is a complete, tamper-evident record for each event. You know this step is working when a random sample of disposed assets can be traced to a log entry.
Verify results and handle exceptions
After each sanitization, verify the result using a method suited to the media type, such as sampling, a read-back check, or a certificate from the tool, and record the outcome in the log. Where sanitization fails or cannot be completed, hold the media under controlled storage, document the exception, and escalate to the authorizer for a decision. Confirm your verification approach with your assessor before relying on it. The output is verified log entries and an exception register. You know it is done when every logged event has a recorded verification result and every failure has an open, owned decision.
Review the procedure and evidence on a schedule
Review the media register, procedure, responsibilities matrix, and log against actual activity at a set interval your governance process defines, and update them when assets, vendors, or methods change. Confirm with your assessor how they expect review to be shown, since examine and interview methods will test whether the procedure matches practice. The output is a dated review record and any revised documents. You know this step is complete when the reviewed artifacts match what staff actually do during a sampled walkthrough.
Evidence that shows media sanitization works and stays current
Assessors testing 03.08.03 look for a written sanitization process, proof that it was followed for each media item, and records that show the process still works. The cards below cover the artifacts that carry that proof and the routine that keeps each one current between assessments.
Sanitization policy and procedure
The written policy states that system media containing CUI is sanitized before disposal, release from organizational control or reuse. The procedure names the owner, the trigger events (retirement, lease return, repurposing, maintenance removal) and the approvals required before media leave the organization. Assessors examine this document first because the assessment objects for 03.08.03 include media protection policy and sanitization procedures. Review it at least once a year and after any change to disposal vendors or storage platforms, and record the review date and approver.
Method matrix by media type
A matrix maps each media type in use, such as hard disks, SSDs, tapes, optical media, mobile devices, printers with storage and paper, to an approved sanitization method and the tool or vendor process that performs it. Flash-based media and drives with wear leveling need methods that reach every cell, so a single overwrite pass is not a universal answer. Record who approved each method and when it was last validated. Update the matrix when new hardware enters the fleet, and confirm each method against the current guidance you have adopted.
Sanitization and disposal log entries
Each media item needs its own log entry showing the asset identifier, media type, the CUI category it held, the method applied, the operator, the date and the verification result. Inventory data helps tie entries to hardware: GLPI's Assets module can hold computers, peripherals and other equipment records, and Wazuh's Syscollector reports hardware and software for each endpoint. Reconcile the log against asset records at least quarterly so that no device leaves the organization without a matching entry.
Certificates of destruction and vendor records
When a disposal vendor or destruction service performs sanitization, keep the signed certificate of destruction, the chain of custody for transport, the vendor's method description and the list of serial numbers it covered. Check that the vendor's service agreement requires the method you specified and notice of any failed units. Store these records in your document system with version history so changes to a vendor's process are visible. Confirm the vendor's contract terms and insurance with your legal and procurement teams before you rely on them.
Maintenance removal records
Equipment sent out for repair or warranty replacement can leave with CUI still on it, which is why Rev. 3 folded the Rev. 2 maintenance sanitization requirement into 03.08.03. Record each removal with the device, the reason, the sanitization or removal step taken before it left the site, and the vendor that received it. When sanitization is not possible, record the decision to keep the device in custody. Link these records to the maintenance family entries so an assessor can trace one event across both requirements.
Audit records that confirm execution
Audit records show that sanitization actually happened, when, and by whom. Configure logging for the systems that run wiping tools, the asset management platform and the document system so that changes to sanitization records are captured. Forward those logs to a central store and review a sample each month against the disposal log. Protect the logs from edits by the people who perform sanitization, and keep retention long enough to cover your assessment cycle.
What meeting media sanitization costs in money and effort
This table breaks down the cost components of meeting 03.08.03 Media sanitization, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to build a quote request, since no prices or durations are supplied for this requirement and each cost depends on your own media inventory and disposal arrangements.
| Cost component | Who is paid or who spends effort | One-time or recurring | What drives it |
|---|---|---|---|
| Sanitization tooling or licenses | Your organization, or a vendor if you buy commercial wiping or degaussing software | Usually one-time purchase, with recurring license or support fees if subscribed | Number and types of media, and whether the tool produces verifiable completion records. Confirm licensing terms with the vendor. |
| Staff time for procedure and logging | Internal IT and security staff, plus any implementation partner who drafts the procedure | One-time to write the procedure, recurring to log each sanitization event | Volume of devices retired or reused each year and how many teams handle disposal |
| Verification effort | Internal technicians or reviewers who check that sanitization succeeded | Recurring, per media batch or per device | Sampling approach, media type and whether sanitization is verified by a second person |
| External disposal or destruction services | A certified third-party destruction vendor, paid per service or per item | Recurring, tied to disposal volume | Whether you destroy media on site or contract out, and whether the vendor provides certificates of destruction. Ask for the certificate format in the quote. |
| Inventory and tracking records | Internal asset management staff, or a self-hosted asset tool such as GLPI | Setup is one-time, upkeep is recurring | Size of the asset base and how well records link each device to its sanitization outcome |
| Evidence upkeep and assessor time | Internal compliance staff for records, and an independent assessor for any formal assessment | Recurring with each assessment cycle | Scope of systems in the assessment, quality of existing records, and how much evidence must be gathered retrospectively |
| How self-hosted open source reduces license spend | Your organization runs the tools in its own environment, so no per-seat license is paid to a hosted vendor for the platform itself | Recurring savings on platform licenses, with support, hosting and integration costs still applicable | Choice of platform and whether it fits your inventory and logging needs. Confirm each tool's capabilities and license terms before relying on them. |
How GLPI, Wazuh, XWiki and BookStack support sanitization evidence
GLPI's Assets module can hold a record for each computer, monitor, piece of network equipment, peripheral, printer, phone and rack, entered by hand or pushed automatically by the GLPI Agent through native inventory, which GLPI has included since version 10. For sanitization, the useful part is the lifecycle record: an asset that holds or once held CUI can be tracked from issue to disposal, so the organization can show which media left its control, when, and under which status. Assessors usually ask for a link between a disposal decision and the specific device, which an asset record can provide when it is kept current.
- Asset status tracking: Record the state of each device so that items awaiting sanitization, sanitized, or released from control are distinguishable.
- Automatic inventory: The GLPI Agent can populate hardware and software fields, reducing reliance on manual entry.
- Disposal references: Store the sanitization record or ticket reference against the asset so the evidence chain is navigable.
- Non-computer media: Assets covers equipment categories, so paper or removable media may need a separate register or a documented convention.
- Ownership and location: Keep the holder and location current so that devices removed for maintenance can be accounted for.
Confirm with your own configuration which asset types, fields and ticket workflows you will use, and whether the register covers removable media.
The Wazuh Syscollector module collects hardware, operating system, installed software, network interfaces, open ports, running processes, services, users and groups, and Windows updates from each endpoint, then stores the results in the Wazuh indexer for inventory views and reports in the dashboard. For sanitization, this gives independent evidence about what systems existed on the network and what they contained at the time of inventory, which helps confirm that a device scheduled for disposal matches the record. It does not prove that data was wiped, so it complements rather than replaces sanitization logs.
- Hardware and software baseline: Syscollector records hardware and installed software, supporting identification of the exact device before disposal.
- Change visibility: Comparing inventory over time shows when a system was retired from active reporting.
- Dashboard reports: Inventory views can be exported into the evidence set for an assessment.
- Scope limits: Syscollector covers endpoints where the Wazuh agent is deployed, so unmanaged devices and removable media fall outside it.
- Retention: Confirm how long inventory data and indexer history are kept in your deployment.
Verify that the agents are installed on every system in scope and that decommissioned endpoints are removed or marked as retired in a documented way.
XWiki keeps every change to a page under version control, recording what changed, when and by whom. Users can compare any two versions and roll back to an earlier one. For sanitization, this matters because the procedure an organization followed must be the procedure it documented. A versioned page lets the organization show which sanitization procedure was in force on a given date, and who approved the change to it.
- Dated procedures: Each revision carries a timestamp, so the procedure in effect at a disposal date can be identified.
- Attribution: Authorship of each change supports accountability for procedure updates.
- Comparison: Diff views show exactly which steps, methods or approval points changed.
- Rollback: Restoring an earlier version is possible, but the rollback itself should be recorded as a change with a reason.
- Approval workflow: Version history records edits, but an approval step is a separate process the organization must define and confirm.
Check that your XWiki instance retains history for the procedure pages you rely on and that approvals are recorded somewhere an assessor can read.
BookStack determines user abilities from the roles assigned to them, and permissions can be overridden per role at the shelf, book, chapter or page level. For sanitization, this answers the question assessors often ask: who is allowed to create, edit or approve the disposal procedure. Restricting edit rights on the sanitization pages to a defined group, and keeping read access broader where appropriate, creates a documented boundary around the procedure content.
- Role-based editing: Assign edit rights on sanitization pages only to the roles responsible for media disposal.
- Granular overrides: Apply permissions at the book or page level when one procedure needs tighter control than its shelf.
- Read access for operators: Staff who carry out sanitization can read the procedure without being able to change it.
- Role review: Periodically confirm that role membership still matches the people who hold these responsibilities.
- Limits: Role settings control access in BookStack, not in the systems the procedure describes.
Record who holds each role and how membership changes are approved, since those records are part of the evidence for access to the procedure.
Each tool carries its own license, which affects how the organization may use, modify and distribute it. GLPI is licensed under GPL-3.0-or-later. Wazuh is licensed under GPL-2.0-only. XWiki is licensed under LGPL-2.1-or-later. BookStack is licensed under MIT. These licenses govern the software itself, not whether a tool satisfies a control, and they do not change the organization's obligations for sanitization.
- GLPI: GPL-3.0-or-later, a copyleft license that applies to modified distributions of the software.
- Wazuh: GPL-2.0-only, a copyleft license with a different version from GLPI, which matters if you combine code from both projects.
- XWiki: LGPL-2.1-or-later, a weaker copyleft license that is commonly applied to libraries.
- BookStack: MIT, a permissive license with minimal conditions on redistribution.
- Legal review: Have counsel confirm license obligations for your specific deployment and any customizations before relying on them.
Confirm the license terms in each project's repository for the exact version you deploy, and confirm that the sanitization tools and methods you choose are themselves documented and approved by your organization.
Gaps that cause media sanitization findings and how to close them
Assessors who test 03.08.03 usually find the same few gaps: media that never reached the inventory, sanitization that nobody recorded, and maintenance equipment that left the building untouched. Each gap below pairs a specific check with the fix that closes it before an assessment begins.
Media missing from the inventory
Sanitization can only be shown for media the organization knows about. Spare drives, retired laptops in storage, printer hard disks and removable media often sit outside the asset register, so they are never scheduled for sanitization. Reconcile the inventory against purchasing records and the directory of managed endpoints, then list every device that can hold CUI, including non-digital media where applicable. An unlisted drive cannot be shown as sanitized. Use an asset management platform such as GLPI, with the GLPI Agent pushing hardware data, to find devices that the manual register missed.
No record of sanitization per device
Many teams wipe devices correctly but keep no record tying the wipe to a specific serial number, date, method and operator. An assessor who asks for proof of sanitization for a sample of disposed media receives nothing to examine. Create a sanitization record for each device that captures identifier, media type, method, tool, verification result, person responsible and the destination (reuse, release or destruction). Store these records in a controlled wiki or document system with version history so that later edits can be seen.
Maintenance equipment leaving unsanitized
Rev. 3 folded the Rev. 2 requirement on sanitizing equipment removed for maintenance into 03.08.03, so a vendor repair or loaner swap is now part of the same test. The gap appears when a field technician takes a failed drive or a laptop off site and nobody checks whether it held CUI. Require a sanitization step or a documented exception before any device leaves for repair, and confirm that the maintenance procedures in 03.07 point back to the sanitization steps. Ask repair vendors in writing how they handle drives they receive.
Relying on vendor certificates without checking scope
A certificate of destruction from a recycler or cloud provider is useful evidence, but it proves only what the certificate covers. Certificates often name a batch, a count or a service, and they may not cover the specific drives, the method or the time window the organization needs. Compare each certificate against the device list and confirm the method meets the organization's own sanitization standard. Keep the contract clauses that set these obligations so that an assessor can trace responsibility back to the agreement.
Procedures not updated after Rev. 3
Procedures written for Rev. 2 still refer to a separate maintenance sanitization requirement and may not mention the Rev. 3 wording or the organization-defined parameters that now apply. A sanitization procedure that predates the change can look compliant on paper while missing the maintenance path. Map each step of the current procedure to the 03.08.03 determination statements, assign the organization-defined values in writing, and record the revision date and approver. Confirm the update with the system security plan so the two documents do not contradict each other.
Inconsistent sanitization methods
When each team chooses its own wipe tool, overwrite count or physical destruction threshold, the organization cannot show one defined method for each media type. Assessors test whether the method matches the procedure and whether it is applied the same way across sites. Define one approved method per media type, such as solid-state, spinning disk, mobile and non-digital media, and restrict the tools that may be used. Check a sample of completed records against the approved list at each review.
Media sanitization questions buyers ask before hiring outside help
How much effort does media sanitization take to get right under NIST SP 800-171 Rev. 3?
The effort depends less on the sanitization step itself than on how much media is in scope and how well the process is already documented. Sanitization is a single requirement with one determination statement in SP 800-171A Rev. 3, but the assessor will also examine your media protection policy, sanitization procedures, applicable standards, and system audit records, and interview the people who handle disposal and records retention. Effort rises with the number of asset types (laptops, servers, storage arrays, removable media, printers with memory, phones), the number of disposal routes (internal reuse, returns to vendors, certified destruction), and gaps in asset inventory. Ask any partner to size the work from a written list of your asset classes and disposal paths, and to state which tasks are one-time (procedure drafting, tool setup, inventory cleanup) and which recur (every disposal, every audit cycle).
Can we handle media sanitization in-house without an outside partner?
Yes, an organization can implement and evidence 03.08.03 with its own staff, because the requirement is about owning a repeatable process. The organization owns the control. An implementation partner can help build the procedure, tooling and records, but it does not decide compliance. The practical test is whether your team can show, for any sampled device, what sanitization method was used, who approved it, when it happened, and where the record lives. Teams often outsource the parts that need specialist depth or independent review: choosing sanitization methods that fit each media type, configuring asset inventory so disposal records are complete, and preparing evidence packages for an assessor. Confirm with your assessor which artifacts they expect before you decide what to build internally.
What does a media sanitization project need from our team?
A sanitization project needs named owners from IT operations, the team that handles asset disposal, records management, and whoever holds the system security plan. Expect to supply:
- A current inventory of systems and removable media that have held CUI, including devices in storage and at vendors.
- The people who actually perform disposal, reuse and maintenance-related sanitization, so procedures reflect real practice.
- Access to disposal vendor contracts, certificates of destruction, and any existing media protection policy.
- Records retention rules, because the assessor will interview staff on retention and disposition.
Without these inputs, procedures tend to describe an ideal process that nobody follows, which is the first thing an assessor finds.
Can an outside partner issue the 03.08.03 assessment or certify our compliance?
No. An implementation partner prepares systems, procedures and evidence, but only an independent assessor, a certification body or, for DoD work, the appropriate government assessment process issues findings or reports. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. For 03.08.03, the assessment procedure in SP 800-171A Rev. 3 uses examine, interview and test methods, so the independent assessor will review your documents, speak with your staff, and check sanitization mechanisms and records directly. Ask any firm, including us, to show how its work maps to the assessment objects, and make sure the party issuing the assessment is independent of the party that built the controls.
How did NIST Rev. 3 change media sanitization from Rev. 2 requirements 3.7.3 and 3.8.3?
In Rev. 3, the sanitization requirement is 03.08.03, and it now also covers equipment removed for maintenance, which Rev. 2 treated separately as 3.7.3. NIST withdrew 03.07.03 and folded it into 03.08.03. NIST's change analysis traces 03.08.03 to Rev. 2 requirement 3.8.3 and classifies that change as not significant, meaning editorial. The practical effect is that your procedures must cover maintenance-driven sanitization in the same process as disposal and reuse. Rev. 3 also restructured the requirements into numbered families with organization-defined parameters, so check whether your environment needs any parameter values assigned. Confirm the exact mapping against NIST's published change analysis spreadsheet before you cite it in a plan.
How does media sanitization affect CMMC Level 2 scoring?
Under CMMC Level 2, the Rev. 2 requirement 3.8.3 is assessed as MP.L2-3.8.3 and carries 5 points in the scoring methodology in 32 CFR 170.24. Because it is scored in that way, 32 CFR 170.21 does not allow it to be placed on a plan of action and milestones to reach Conditional status, so an unmet media sanitization requirement cannot be deferred that way. The requirement must be met in full for the scoring that the rule describes. Note that CMMC Level 2 uses Rev. 2 numbering, while your Rev. 3 documentation uses 03.08.03, so keep a crosswalk in your SSP. Check the current scoring rules and any DoD guidance on which revision applies to your contract before you finalize your plan.
How DeployOpen prepares media sanitization evidence for assessment
DeployOpen's part of 03.08.03 is preparing the evidence an independent assessor will examine, interview against and test. The organization owns its sanitization decisions and the assessor issues any conclusion. In a fixed-scope engagement, the written scope first defines which asset sources count as system media that may contain CUI, such as laptops, servers, storage arrays, backup appliances, removable drives and printers with storage, and which of them sit outside the sanitization process today. We then reconcile that scope against the inventory of the client's own systems, so every in-scope disk has a record that can be traced to a sanitization event.
On self-hosted platforms inside the client's environment, the inventory and logging layer is where that traceability comes from. GLPI's Assets module can hold the computers, peripherals and racks that carry media, entered manually or pushed by the GLPI Agent, so disposal and reassignment can be tied to an asset record. Wazuh's Syscollector gathers hardware and installed-software data from endpoints into the Wazuh indexer, which helps show what was present before a device left organizational control. Sanitization procedures, approval steps and certificates of destruction belong in a controlled wiki such as XWiki, where version history shows who changed a procedure and when, and BookStack can restrict who may edit or approve those pages through role-based permissions. Confirm with your own platform owners which fields, retention periods and audit log sources your environment actually produces before the assessor asks for them.
Before the assessor arrives, the client should decide who signs off each sanitization and who reviews the logs, and DeployOpen can prepare the records so that an assessor's examine, interview and test steps have something concrete to check. Ask any implementation partner to state in the written scope which evidence items it will prepare, which remain the client's responsibility, and which require the independent assessor's own testing. DeployOpen prepares systems, controls and evidence for assessment. It does not issue reports, attestations or certifications, and the assessment outcome is determined by the independent assessor.
