How to destroy CUI under 32 CFR 2002.14(f) and SP 800-171
CUI may be destroyed only when the agency no longer needs it and the applicable NARA-approved records schedules allow it, and the destruction must leave the information unreadable, indecipherable and irrecoverable. That is the test in 32 CFR 2002.14(f), and it applies whether you are closing out a contract, retiring a server or returning a laptop. The organization holding the CUI owns the disposal decision and the evidence that supports it, even though the agency defines what it needs back. Before any media leaves your control, confirm in writing with the contracting officer or program office whether the contract specifies a return or destruction method, and whether the records schedule requires retention of any copies.
The method depends on three things: what the contract says, what kind of media holds the data, and whether a government-specified method applies. If no agency method is required, the regulation points to the destruction guidance in NIST SP 800-88, or to a method approved for classified information. Your SP 800-171 media sanitization requirement, 03.08.03, asks you to sanitize media containing CUI before disposal, release from organizational control or reuse. Map each media type in scope, including backups, removable drives, printers with storage and cloud volumes, to a sanitization technique, and record who approved it. Cryptographic erase is a legitimate option for encrypted media, but the DoW's July 2026 CMMC FAQ notes that encrypted CUI remains CUI until formally decontrolled, so the erase must be implemented as SP 800-88 describes.
Plan the evidence before the work starts. Keep a disposal log that identifies each asset by serial number or volume, the sanitization method, the person who performed it, the verification step and the date. For DHS contracts, HSAR 3052.204-72 requires a certificate of sanitization sent to the COR and contracting officer, using the SP 800-88 Appendix G template. Ask your contracting officer whether other agencies require a similar certificate. Ask your sanitization vendor, if you use one, to name the standard it follows and to provide signed records. Finally, confirm that decontrol under 32 CFR 2002.18 is a separate decision: destroying data is not the same as removing its CUI status, and only the designating agency can make that decision.
The order to follow when disposing of CUI
This sequence confirms that disposal is permitted, picks a method the media and governing rules support, and ends with a verified, documented record that the CUI can no longer be recovered. Each step produces a artifact you can show an assessor or contracting officer.
Confirm the agency no longer needs the CUI
Start by checking that the contract, agency direction or the designating agency confirms the CUI is no longer needed, and that the applicable NARA-approved records schedule allows disposal. The contracts or contracting officer's representative usually owns this decision, and your contracts or records staff should confirm it in writing. The output you keep is a dated record that names the CUI, the authority that released it for destruction, and the schedule that permits it. If the records schedule does not allow disposal, the CUI must be kept under its safeguards, not destroyed.
Check for a governing destruction method
Before choosing a method, review the CUI category's authority, the contract and any agency instructions for a required destruction method. If the governing authority names one, it controls. If it names none, the fallback in 32 CFR 2002.14(f) points to the guidance in NIST SP 800-53 and SP 800-88, or a method approved for classified information. For DHS contracts, HSAR 3052.204-72 adds that return or destruction follows the contract's terms and NIST SP 800-88. The output is a short note that records the method you will use and the source that requires or permits it.
Select the sanitization method by media type
Inventory every system, drive, backup, removable device, paper stock or other media that holds the CUI, then assign a method to each media type under the SP 800-88 guidance. Hard drives, solid-state drives, mobile devices, tapes and printed pages each call for different techniques, and cryptographic erase is acceptable for encrypted media only when it is implemented under SP 800-88. Encrypted CUI remains CUI until it is formally decontrolled, so encryption alone does not permit disposal without sanitization. The output is a media-by-method register that your team and any destruction vendor can follow.
Sanitize or destroy each item
Run the selected method on each item in the register, or hand it to a destruction provider under a written chain of custody. Under requirement 03.08.03, media that contain CUI must be sanitized before disposal, release from organizational control or reuse. Record which person or vendor performed each action, the device identifier, the date and the method used. Where a vendor is involved, confirm how they handle media in transit and whether they will issue a certificate for each batch. The output is a completed log that ties every media item to a sanitization action.
Verify the sanitization result
Check that the method achieved the result it is supposed to achieve. For erasure, this means confirming the data is unreadable and cannot be recovered using the tools and techniques SP 800-88 describes, which may require a sample test or a vendor's verification report. For physical destruction, confirm the media is destroyed to the size or condition the method specifies. Record who performed the check and what was observed. Verification is what separates a disposal that you can defend from one you only hope worked. The output is a verification record for each sampled or destroyed item.
Record and certify the disposal
Close the process with a sanitization certificate that identifies the media, the method, the person responsible and the date. For DHS CUI, HSAR 3052.204-72 requires certification to the COR and contracting officer using the template in SP 800-88 Appendix G. For other contracts, confirm with the contracting officer what evidence they expect. Keep the certificate, the log and the verification record together, and send the certificate to the agency when required. The output is a retained disposal file that an assessor can trace from the CUI inventory to the destroyed media.
Which NIST SP 800-88 method fits which media
NIST SP 800-88 groups sanitization into three levels of increasing strength: clear, purge and destroy. Each level suits different media, and the right choice depends on whether the media will be reused, released or physically disposed of. Check each method against the current SP 800-88 text and your own media inventory before you write it into a destruction procedure.
Clear for reusable digital media
Clear uses logical techniques, such as overwriting, to make stored CUI unrecoverable through ordinary system interfaces. It fits digital media that stay inside your control and will be reused, such as internal workstation drives. Confirm that the clear method your team uses meets the SP 800-88 criteria for the specific device type, because some flash and solid-state media need different handling.
Purge for higher-risk digital media
Purge applies stronger techniques, including cryptographic erase and certain device-level commands, so that CUI cannot be recovered even with advanced laboratory methods. Use purge when media leave your organizational control or hold CUI that is especially sensitive. Ask your vendor or sanitization tool provider to show which purge commands they implement and how they verify completion.
Cryptographic erase for encrypted storage
Cryptographic erase destroys the encryption keys that protect the data, which makes the encrypted CUI unreadable without rewriting the media. The DoW CMMC FAQ (July 2026) says this approach is acceptable for sanitizing controlled media before disposal or reuse when it is properly implemented under SP 800-88. Confirm that keys are destroyed everywhere they exist, including backups and key management systems, and that the implementation has been tested.
Destroy for non-digital and failed media
Destroy renders media unusable through physical methods such as shredding, incineration, pulverizing or disintegrating. It applies to paper, optical discs, and digital media that cannot be reliably cleared or purged, including devices that have failed. Verify that the destruction method and particle size or output meet the SP 800-88 guidance for each media type, and keep records that show what was destroyed and when.
Matching methods to your media inventory
Start with a list of every media type that holds CUI, including laptops, servers, backup tapes, USB drives, mobile devices, printers with storage and paper. For each type, record the planned end state (reuse, release or disposal) and select the lowest SP 800-88 level that still meets the requirement. Ask your sanitization provider to document this mapping and to confirm which items need physical destruction.
What 03.08.03 requires before media leaves your control
Requirement 03.08.03 in NIST SP 800-171 Rev. 3 requires you to sanitize system media that contain CUI before the media is disposed of, released out of organizational control, or released for reuse. The control is about the moment media changes hands or leaves your facility, so the question an assessor asks is whether you can show what was done to each device or medium, by whom, and with which method. Your organization owns this control and decides the sanitization method for each media type. A DeployOpen engagement, where in scope, can help you define the procedure, configure the tooling and assemble the records, but the policy and its operation remain yours.
An assessor tests 03.08.03 with the examine and interview methods in NIST SP 800-171A Rev. 3. Examine means reading the sanitization procedure, the media disposal and reuse records and the system security plan entries for media handling. Interview means asking the staff who run disposal, IT asset management and facilities whether they follow the procedure in practice and can explain how a drive leaving a lease or a faulty array returning to a vendor is handled. Evidence that passes usually includes sanitization logs with device identifiers and serial numbers, the method used for each item, verification results, and chain of custody records showing who held the media until it was destroyed or released. Vendor certificates count only when they name the specific devices and method.
In CMMC, MP.L2-3.8.3 is a 5-point requirement, so under the scoring methodology in 32 CFR 170.24 it is subtracted from the maximum score of 110 if not met. Because it is worth more than 1 point, 32 CFR 170.21 does not allow it on a plan of action and milestones, so it must be met to reach Conditional or Final Level 2 status. Confirm with your assessor and the current DoW guidance which CMMC level and contract clauses apply to you before you rely on this rule. Practically, this means the sanitization procedure, its logs and the disposal vendor contract need to be in place before any assessment date, not scheduled as remediation.
What DHS contracts require you to certify at contract end
When a DHS contract ends, HSAR 3052.204-72 turns CUI disposal into a documented obligation. The cards below cover what the contract tells you to do, how NIST SP 800-88 shapes the method, what the certificate must show, and who signs it.
Follow the contract's return or destroy instruction
HSAR 3052.204-72 requires contractors to return or destroy DHS CUI as the contract states, so the contract is the first document to read at close-out. Confirm whether the agency wants the data handed back, destroyed, or a mix of both, and whether any items must be held longer. Ask the contracting officer in writing if the instruction is unclear before any media is wiped or shipped.
Apply NIST SP 800-88 to every method
The clause requires sanitization that follows NIST SP 800-88, so each disposal method should map to that guidance and not to a generic delete. Record which sanitization level you chose for each media type, and confirm that cryptographic erase is acceptable under the contract before relying on it. Paper and other non-digital media need their own documented destruction step.
List every media item in the certificate
The certificate should identify each device or media item by type, make, model and serial or asset number, so the COR can match it to the inventory. Include where the media was located and whether it was returned or destroyed. A sentence such as "all drives in the enclave" is too vague for a contracting officer to accept.
State the method and the date
For each item, the certificate should name the sanitization method, the tool or procedure used, and the date it was completed. Where a vendor performed destruction, record the vendor's chain-of-custody details and the date media left your control. Keep the tool version and any verification output with the file, because an assessor or the agency may ask how the result was confirmed.
Name the responsible person and sign
The certificate should name the individual responsible for the sanitization and that person's role, and the contractor's authorized official should sign it. The organization certifies its own disposal, so a third party does not sign unless the contract requires one. Check whether the template in SP 800-88 Appendix G is what the agency expects, and send the signed copy to both the COR and the contracting officer.
What sanitization and disposal costs and who is paid for it
This table breaks sanitization and disposal costs into components, showing who is paid for each, whether it is one-time or recurring, and what drives it up. No prices are given because none are supplied, so use the questions in the last column to build a comparable quote. The main takeaway is that media count, locations and cloud storage usually matter more than the sanitization method itself.
| Cost component | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| Media inventory and classification | Internal staff, or a consultant if the inventory is outsourced | One-time for the baseline, recurring as devices and backups change. Drivers: number of endpoints, servers, removable media and backup sets holding CUI |
| Sanitization labor (overwrite, purge or destroy) | Internal IT staff, or a vendor performing on-site or off-site work | Recurring with each disposal or reuse event. Drivers: media count, geographic spread across sites, and whether work happens on-site or at a vendor facility |
| Cryptographic erase tooling and key management | Internal platform team for keys and tooling; vendor only if a managed key service is bought | Mostly one-time setup, then recurring key rotation and audit. Drivers: encryption design, number of key domains, and whether keys are held in hardware modules |
| Destruction services (shredding, degaussing, incineration) | Certified destruction vendor, paid per batch or per service visit | Recurring per disposal cycle. Drivers: volume, chain-of-custody requirements and any on-site witnessing the contract requires |
| Cloud storage and backup sanitization | Cloud provider for platform-level handling; the organization for its own data deletion and key destruction | Recurring as data ages out. Drivers: cloud regions used, snapshot and replica counts, and retention periods set by the records schedule |
| Sanitization documentation and certificates | Internal compliance staff, with vendor certificates included in destruction fees | Recurring per event. Drivers: the certificate template the contract names (for example, the SP 800-88 Appendix G form for DHS work) and number of certificates to the contracting officer |
| Independent review of sanitization records | Independent assessor or auditor, selected and paid by the buyer | Optional and periodic. Drivers: scope of media covered, contract demands and whether the buyer wants a sample test |
| Decontrol review before destruction or release | Internal records and security staff, or legal counsel for disputed markings | Recurring as information ages. Drivers: volume of legacy CUI and the number of decontrol decisions needing agency input |
Questions buyers ask about CUI destruction
Can encrypted CUI simply be deleted instead of sanitized?
Not on its own. Encrypted CUI remains CUI until it is formally decontrolled, so deleting a file does not end your obligations for it. The DoW's July 2026 CMMC FAQ says cryptographic erase is acceptable for sanitizing controlled media before disposal or reuse, but only when it is implemented properly under NIST SP 800-88. Deleting a file without a sanitization step may leave recoverable copies on the media, which fails the intent of 03.08.03 Media sanitization. Confirm with your contracting officer whether the contract requires a specific method before you rely on it.
Does cryptographic erase count as media sanitization?
It can, provided the encryption and key handling meet the expectations of NIST SP 800-88. The DoW CMMC FAQ (July 2026) accepts cryptographic erase for controlled media when it is properly implemented. In practice, your procedure should show which keys are destroyed, where they were held, how key destruction is confirmed, and that no unencrypted copies or unmanaged key escrow remain. Ask your assessor how they will test the claim, because they will look for the procedure and records, not just the statement.
Who signs the destruction certificate for DHS CUI?
For DHS contracts, HSAR 3052.204-72 requires the contractor to certify the sanitization to the COR and the contracting officer, using the template in NIST SP 800-88 Appendix G. The certificate is the contractor's statement about what it did, so an authorized company representative should sign it after the work is verified. The organization remains responsible for its own statement, and no independent party issues the certificate unless the contract requires one. Confirm the signatory, the required template and the recipients in the contract before work starts.
What happens to backups and cloud copies of CUI at contract end?
They are in scope if they contain CUI. Destruction must reach primary storage, replicas, snapshots, backups, archives and copies held by cloud providers. Many organizations find that backup retention windows, object versioning and disaster recovery sites keep data longer than expected. Your procedure should define retention periods, the point at which backup media is sanitized or cryptographically erased, and how cloud deletion is confirmed. Ask your cloud provider how deletion is performed and what evidence it can supply, and confirm the scope with the contracting officer.
Can a contractor keep CUI after the contract ends?
Only if the contract, agreement or a legal requirement allows it. Under 32 CFR 2002.14(f), CUI may be destroyed when the agency no longer needs it and the applicable NARA-approved records schedule allows it. The contract usually states whether the contractor returns or destroys the material. Retention for records or legal holds may apply to some information, so do not assume destruction is the default. Ask the contracting officer in writing what must be returned, what must be destroyed and whether any records must be kept.
Does a DIBCAC or CMMC assessor check disposal?
Assessors test media protection, including 03.08.03 Media sanitization, using the examine, interview and test methods in NIST SP 800-171A Rev. 3. They will look for a documented procedure, evidence that media is sanitized before disposal or reuse, and staff who can explain the process. Under the CMMC Scoring Methodology, MP.L2-3.8.3 is worth 5 points, and it cannot be placed on a POA&M, so it must be MET to reach Conditional or Final Level 2 status. Confirm with your assessor which records they expect to see.
Can an implementation partner build the disposal procedure and evidence?
A partner can help design and document the procedure, configure encryption and key management, define backup and cloud deletion steps, and prepare the evidence an assessor will review. It cannot issue an assessment result, a certificate or a DIBCAC finding. Your organization owns the controls and must sign the certificate it provides. A fixed-scope engagement should list the systems, media types, cloud services and deliverables covered, and the written scope should state who performs the sanitization. Ask for a written scope before work begins.
What to have in place before the first disposal event
Destruction is the last step in a chain that starts with knowing where CUI lives. The cards below are the prerequisites an assessor will expect to see documented and working before any media leaves organizational control.
A CUI media inventory
Start with a complete list of every system media item that holds CUI, including laptops, servers, removable drives, backup tapes, and copies in cloud storage and backup services. Each entry should name the owner, the location, and the CUI category it holds. Check the inventory against your system security plan and against a sample of actual disposal candidates, since cloud and backup copies are the ones most often left off the list.
A written sanitization procedure
The procedure should state which sanitization method applies to each media type, with the method tied to NIST SP 800-88 and to the requirement in 03.08.03. Cover both destruction and release for reuse, and say who approves each path. To check it, walk one media item from the inventory through the procedure and confirm each step is written down and performed as described.
Records schedule and decontrol checks
Before any disposal, confirm that the agency no longer needs the information and that an approved records schedule permits destruction. Also confirm whether the information was decontrolled, which is a separate decision from destruction and must be recorded as such. An assessor will ask for the schedule reference or the decontrol record that supports each disposal.
A named owner for disposal
Assign one accountable person for media sanitization, with a named backup. This person signs off on each disposal, reconciles the inventory after it, and handles questions from the contracting officer or assessor. Confirm that the owner has authority over systems and vendors, not only a reporting line into the security team, and that the assignment appears in the procedure.
A disposal log template
Build a log that records each media item, its serial or asset number, the sanitization method, the date, the person who performed it, the verification step, and the disposal or reuse outcome. The log is the bridge between the inventory and the certificate. Test the template with a dry run, then check that every entry can be traced back to the inventory record it closes.
Vendor contracts requiring destruction certificates
When a third party destroys media, the contract should require sanitization under SP 800-88, a written certificate for each batch, and notice of any subcontracting. Where a contract covers DHS CUI, check the HSAR 3052.204-72 terms, which require certification to the COR and contracting officer using the SP 800-88 Appendix G template. Ask the vendor to show a sample certificate before you sign.
Who owns the disposal decision and who prepares the evidence
The organization owns every part of CUI disposal: the decision that a given item may be destroyed, the sanitization method applied to each media type, and the sanitization certificate that records the result. Under 32 CFR 2002.14(f), destruction is allowed only when the agency no longer needs the information and an approved records schedule permits it, so the first disposal question belongs to the contract or agreement owner and to the organization's own records manager. An implementation partner such as DeployOpen can help design the disposal procedure, set the approval steps, and build the logging and evidence templates that record who approved each destruction, which method was used, and when it was completed. The partner does not make the disposal call or sign the certificate on the organization's behalf.
The procedure should also state which method applies to which media. NIST SP 800-171 requirement 03.08.03 requires sanitizing media that contain CUI before disposal, release out of organizational control, or reuse, and SP 800-88 governs how that is done. Before work starts, confirm with the contracting officer whether the contract names a method or a certificate format, because a contract clause such as HSAR 3052.204-72 for DHS work sets its own return-or-destroy and certification steps. Where a clause is silent, the organization should document which SP 800-88 method it chose and why, so an assessor can trace the choice back to the requirement.
Only an independent auditor or assessor reviews and reports on whether the disposal controls meet the requirement. DeployOpen does not issue reports, attestations or certificates, and a sanitization certificate is the organization's own record unless a contract requires a specific signatory. Prepare the evidence in advance: sample destruction logs, approval records, chain-of-custody forms for media sent to a third party, and copies of any vendor certificates. Ask any outside destruction provider to state in writing which SP 800-88 method it uses and what certificate it issues, and confirm those terms in the written scope before the first item leaves the building.
How DeployOpen prepares media sanitization evidence
DeployOpen plans, implements and documents the sanitization workflow for CUI media inside the client's own infrastructure. The organization owns its disposal decisions and its controls, while an independent assessor reviews the evidence and issues any report.
How we scope
- The written scope lists which systems, backup sets, storage media and disposal paths hold CUI and need sanitization.
- We record which destruction authority applies to each data set, including any agency or contract instruction that names a method.
- Scope also covers which decisions stay with the organization, such as decontrol, records retention and certification signatories.
How we build
- We configure sanitization procedures aligned to the NIST SP 800-88 methods the organization selects for each media type.
- Where cryptographic erase is the chosen method, we verify that encryption keys are managed and destroyed as the procedure states.
- We test sanitization runs on representative media and retain the logs that show each run completed as designed.
How we hand over
- You receive the written sanitization procedure, media inventory, tool and method records, and the run logs that link each item to its disposal event.
- Sanitization certificate templates are prepared for the organization to complete, using the format a contract or agency requires.
- Handover includes a short walkthrough so staff can repeat the procedure and explain it to an assessor.
How we support
- Ongoing support covers procedure updates when contract terms, media types or NIST guidance change, available as a retainer.
- We can rerun sanitization testing after tooling or hardware changes and update the evidence set to match.
- Confirm with your contracting officer or assessor which certification wording and retention period apply before work begins.
