MP-6 Media sanitization: requirements and evidence

What MP-6 media sanitization requires and why assessors check it

MP-6 requires that system media be sanitized with defined techniques and procedures before it is disposed of, released out of organizational control or released for reuse, and that the sanitization mechanism be strong enough for the security category or classification of the information on it. If you are deciding what happens to a retired laptop, a failed drive or a backup tape, the question is not only which wipe tool to use but whether that method matches how sensitive the data was. The control applies in the low, moderate and high baselines and in the privacy baseline from SP 800-53B, so a system with modest impact still needs a defined method, and a higher-impact system needs a method that suits its category. Your organization sets the techniques and procedures, so the first task is to write them down by media type and information category.

The control is simple to describe and hard to evidence. Assessors working from SP 800-53A examine the sanitization procedures, the applicable federal standards and policies, and the sanitization records, then interview the people who run sanitization and the people who handle records retention and disposition. They also test whether the process actually works as written. In practice the gap is usually a missing link: a drive was wiped, but nobody can show which device it was, who did it, what method was used and whether the result was verified. Confirm with your assessor which records they expect, and make sure each device can be traced from its asset record through to its sanitization or destruction entry.

Tooling helps with that trail more than with the wiping itself. An asset register such as the one in GLPI's Assets module can hold the serial number, owner, classification and disposal status of each device, while an inventory agent can confirm hardware details before release. Your inventory platform should also be able to show that a device was removed from service. Before you rely on any tool to sanitize media, confirm with the vendor and your assessor which techniques the tool performs, how it reports results and whether the output is accepted as a sanitization record in your environment.

Which media, systems and third parties MP-6 covers in practice

MP-6 applies to whatever media the organization has defined as in scope, so the first job is an inventory of where information actually lives. The cards below cover the decisions that shape that scope: media types, disposal routes, the systems that track media, and the teams and third parties that own each step.

Drives in servers and endpoints

Hard drives and SSDs in servers, storage arrays, laptops and desktops are the media most often missed because they sit inside equipment that is retired as a unit. Confirm whether the defined scope covers the drive itself or the whole chassis, and whether drives that are replaced under warranty or swapped during repair are included. Each removal from a system is a point where sanitization must be decided and recorded.

Removable and portable media

USB drives, external disks, optical discs and memory cards often hold copies of data that never reached the official repository. Decide whether they are in the defined media set, and how staff hand them in for reuse or destruction. Assessors typically ask how the organization knows which removable devices exist, so the sanitization process should start from the same inventory used for MP-2 and MP-7.

Backup tapes and archive media

Backup tapes, tape cartridges and retired archive copies are easy to lose track of because they rarely appear in endpoint or asset tooling. Define how long retired tapes are retained before sanitization, who approves the destruction of each batch, and whether the backup team or a third party performs it. Check that the backup catalog and the disposal log agree on which volumes have left service.

Disposal routes and their owners

Each route carries different risk: internal reuse, return to a leasing vendor, donation, and destruction by a third party. Assign an accountable owner to each route, usually IT asset management for reuse and donation and facilities or security for destruction. Confirm the contract terms for vendor returns and what proof the vendor will supply before the organization releases the media.

Third parties that handle media

Leasing companies, recyclers, destruction firms and cloud or colocation providers may take custody of media outside the organization's control. Review the contract for sanitization method, chain of custody, certificate of destruction, and the right to audit. Ask whether the provider's method matches the strength required for the information's security category, and whether the organization can verify the certificate against its own asset records.

Asset records that prove coverage

Sanitization evidence is only as complete as the asset records behind it. A configuration management database or asset inventory should link each media item to its system, owner, classification and disposal status. Open-source tools such as GLPI and Wazuh can supply part of that inventory, but the organization must confirm which media classes they discover and which must be entered by hand, such as tapes and paper.

How an assessor tests MP-6 media sanitization

This table maps the four SP 800-53A determination statements for MP-6 to the assessment methods, objects, evidence and findings an assessor typically encounters. Read each row as one thing the assessor will ask to see, and check your own evidence against the common findings column before the assessment starts.

Method	Assessment object	Evidence requested	Common findings
Examine	Media sanitization and disposal procedures, plus applicable federal standards and policies on sanitization	Written procedure naming each sanitization technique (clear, purge or destroy) mapped to media type and security category	Procedure names no technique, or cites a standard without saying how it applies to the organization's media
Examine	Media sanitization records	Per-item log with asset identifier, serial number, media type, technique, operator, date and verification result	Records missing serial numbers, no verification step, or entries that cannot be tied to a specific device
Interview	Personnel with media sanitization responsibilities	Staff explain steps, tools and escalation for a failed or partial sanitization, and show they have done it	Staff describe a process different from the written procedure, or cannot say who signs off
Interview	Personnel with records retention and disposition responsibilities	Explanation of how sanitization records are retained, who approves disposal and how records link to asset disposal	Records are kept in a form the owner cannot retrieve, or disposal is approved without a matching sanitization entry
Test	Organizational processes for media sanitization	Walkthrough of a sample of media from disposal request to certificate or log entry, with verification output	No verification of sanitization, sample cannot be traced end to end, or sanitization is skipped for reused devices

Choosing sanitization methods that match the security category

MP-6 ties the strength of a sanitization mechanism to the security category or classification of the information on the media. The control requires the organization to define the sanitization techniques and procedures, and to choose mechanisms whose strength and integrity match that category. In practice, a method that is adequate for a low-impact laptop being reissued inside the organization may be inadequate for a drive that held high-impact data, so the same disposal step cannot be applied to everything. The decision starts with the category of each information type, then moves to the media types that hold it, and only then to the technique.

Organizations usually document this as a sanitization matrix: one row per media type (such as spinning disks, solid-state drives, removable flash, tape, optical discs and paper), one column per security category or classification, and a defined method in each cell along with the disposal path it applies to (reuse, release out of control, or destruction). Three families of technique trade off differently. Overwriting is inexpensive and works well on magnetic media, but its assurance depends on the device accepting writes to every addressable location, which is hard to confirm on flash storage with wear leveling and spare areas. Cryptographic erase destroys the key that protects encrypted data, which is fast and suits self-encrypting devices, but it is only as strong as the encryption, key handling and device implementation behind it. Physical destruction gives the most visible assurance and is often required for the highest categories, at the cost of losing the device and needing a verifiable destruction record.

Before finalizing the matrix, the organization must confirm which technical sanitization guidance its authorizing official, contract or regulator accepts. NIST describes the control's requirements at a level that leaves the specific techniques to the organization, so a federal agency, a contractor or a regulated operator may be bound by a named publication or by contract clauses that the control text itself does not supply. Ask the authorizing official and the contracting officer which guidance is expected, whether they require certificate of destruction or verification steps, and whether the method must be validated on a sample of each media type before it is approved. Record the answers in the MP-6 procedure so the matrix can be traced back to an accepted source.

Implementing MP-6 media sanitization step by step

This sequence turns MP-6 from a policy statement into a repeatable process: every media item is known, every sanitization is chosen for its information category, and every completed action leaves a record an assessor can examine. Each step names the artifact that proves it is done.

Inventory media and assign owners
Build a register of every system media item in scope, including hard drives, solid-state drives, removable drives, tapes, optical discs, backup media and printed or microfilmed records where MP-6 applies. Record each item's identifier, location, the system it belongs to, a named owner and the security category or classification of the information it holds. Start from asset data already held in a configuration or inventory tool, such as the Assets module in GLPI or the Syscollector inventory in Wazuh, then add media that those tools do not see. The step is complete when every item has an owner and a category, and the owner signs off the register. Ask your assessor which media types they expect to see covered before you finalize the list.
Define sanitization techniques by media type and category
For each combination of media type and information category, document the sanitization technique the organization will use, such as clear, purge or destroy, along with the procedure steps and the tools or methods approved for that technique. Mechanisms must be strong enough for the category of the information, so the standard should state which techniques are acceptable for each category and which are not, including techniques suited to solid-state media that behave differently from magnetic media. Confirm the approved techniques against the sanitization guidance your organization or contract follows, and have the security owner approve the matrix. The output is a dated sanitization matrix that becomes the reference for every later step.
Set trigger points for sanitization
Define the events that require sanitization before media leaves organizational control or is reused: disposal, return from a lease or vendor repair, reassignment to another user or system, release to a third party and retirement from service. Map each trigger to the owner who initiates it and to the matrix entry that applies. Triggers should also cover media that fails and cannot be sanitized normally, so that the handling route for those items is decided in advance. The output is a trigger table linked to the register, and it is verified when the procurement, IT service and facilities teams confirm that their workflows call on it.
Assign responsibilities for sanitization work
Name who performs sanitization, who approves it, who verifies it and who keeps the records. Separate the performer from the verifier where the information category is high, and make sure the people responsible for records retention and disposition are part of the design, since assessors interview both groups. Where a sanitization or destruction service is used, the contract should state the technique, the evidence returned and the chain of custody. Record these assignments in the media sanitization procedure and in the role descriptions. The step is done when each role has a named person or team and the procedure has been approved.
Run and record each sanitization with an identifier
For each triggered item, the performer runs the approved technique from the matrix and writes a sanitization record before the item leaves the process. The record should carry a unique identifier, the media item from the register, its category, the trigger that started the work, the technique and tool used, the date, the performer and the destination or next state of the item. Recording the identifier on a physical label or tag keeps the paper and the asset register linked. The output is one completed record per item, and an item without a record is not released, reused or disposed of.
Verify each sanitization result
A second person checks that the technique was applied as documented and that the item is in the state the matrix requires. Verification methods depend on the media and the technique, so the verifier should use the check the procedure defines, record what was checked and the result, and note any exception. Failed or unverifiable items return to the matrix for a stronger technique or for destruction, and the failure is logged the same way as a success. Ask the people who will test your process what verification evidence they expect, because this is the item most often examined in practice. The output is a verification entry on each record.
Retain sanitization records and review the process
Keep sanitization records, certificates of destruction and any vendor evidence in a controlled repository for the period your records retention schedule sets, and make them retrievable by media identifier. Reconcile the register against the records at a defined interval so that no item is missing a record, then feed exceptions into the plan of action and milestones. Review the matrix and trigger table when technologies, contracts or information categories change. The output is a retained, searchable record set and a dated review entry, which together show the assessor that MP-6 operates over time rather than once.

Sanitization records that pass an MP-6 assessment

An assessor testing MP-6 looks for records that show sanitization was defined, performed and verified for each item that left organizational control. The six artifacts below connect to one another, so a gap in one usually shows up in another, and keeping them linked to the asset inventory is what makes them hold up between audits.

Sanitization procedure by category

The written procedure names the techniques and procedures the organization uses for each media category, such as clear, purge or destroy, and ties each one to the security category of the information it held. SP 800-53A has assessors examine procedures addressing media sanitization and disposal, so the document must say which method applies to which media type and who approves exceptions. Check that the techniques match the sensitivity of the data and that the procedure is dated and version controlled.

Per-item sanitization log

Each sanitization event needs its own entry recording the asset identifier, serial number, sanitization method, operator and date. Assessors use these entries to trace a specific device from the inventory to its final disposition. A log entry that cannot be matched to a serial number is weak evidence, so reconcile the log against the inventory at regular intervals rather than only at audit time.

Verification results

Sanitization is only credible when the organization checks that it worked. Record the verification method, such as a sample read-back or a tool report, the result and the person who reviewed it. Failed verifications should show the re-sanitization or escalation that followed. Ask your tool vendor to document what its verification output proves and what it does not.

Certificates and vendor destruction records

When sanitization or destruction is outsourced, keep the vendor certificate, the list of serial numbers covered and the method used. Confirm the contract requires the vendor to follow the organization's categories and to return records. Where the organization sanitizes in-house, the equivalent evidence is an internal certificate signed by the custodian. Review vendor certificates against the log so no item appears to have been destroyed without documentation.

Chain-of-custody and transfer documents

Media moving to a sanitization point, a vendor or a new owner needs a transfer record showing who handed it over, who received it and when. These documents show that media was not left unattended between sanitization steps, and they link to the MP-5 transport controls. Gaps in custody are a common reason assessors question otherwise complete logs.

Retention schedule for sanitization records

Define how long sanitization logs, certificates and transfer documents are kept and who may dispose of them. The schedule should follow the organization's records retention requirements, which SP 800-53A also asks assessors to review with the personnel responsible. Confirm the period with legal or records management, and keep the records in a store that is protected and recoverable, so the audit trail survives system changes.

What MP-6 media sanitization costs to meet

This table compares the cost components of meeting MP-6, who is typically paid for each, whether it is one-time or recurring, and what pushes it up or down. Use it to structure a quote request, since no price list exists and a quote follows the written scope. The main takeaway is that recurring records and verification work usually outweighs the one-time tooling purchase.

Cost component	Who is paid, one-time or recurring	What drives it up	How to keep it down
Sanitization tooling or licenses	Tool vendor or open-source support provider. Mostly one-time for purchased tools, recurring if subscription-based	Number of media types, need for vendor-specific wipe utilities, enterprise support tiers	Confirm which techniques your media types need, then compare licensed and open-source options before buying
Staff time per sanitization	Internal IT or platform staff. Recurring, scaled by each disposal or reuse event	High media volume, manual wipe steps, separate procedures for each media category	Standardize procedures by media category and batch sanitization where the security category allows
Verification effort	Internal staff or implementation partner. Recurring for each sanitization event	Sampling depth required by your procedures, multiple verification methods, high-impact information	Define verification steps in the procedure so each event produces the same proof
Sanitization records and inventory reconciliation	Internal records or asset management staff. Recurring	Lack of a central asset inventory, manual spreadsheets, reconciling records against physical stock	Use an asset inventory that records media serial numbers and status, then reconcile on a fixed schedule
External destruction or certificates	Third-party disposal provider. Recurring per shipment or batch	Third-party disposal, certificate requirements, geographically distributed storage, chain-of-custody needs	Ask providers for itemized pricing per batch and certificate formats that match your records
Assessor sampling and testing	Independent assessor (paid by the organization). Recurring at each assessment cycle	Scope of media in the authorization boundary, number of sanitization events sampled, retesting after findings	Keep records complete and organized so assessors can sample without extended requests
Implementation and evidence design	Implementation partner or internal engineers. One-time, with periodic updates	Number of systems in scope, integration with existing asset and ticketing tools, custom procedures	Agree a fixed written scope with defined deliverables before work starts

Open-source tools that support MP-6 evidence

Neither tool sanitizes media, and neither replaces the sanitization record an assessor examines under MP-6. Their value is in anchoring the inventory that tells you which devices and media exist, where they are, and when they left the environment. Confirm fit against your own asset estates before relying on either one.

GLPI Assets as the media register

The GLPI Assets module records computers, monitors, network equipment, peripherals, printers and racks, entered manually or pushed automatically by the GLPI Agent through native inventory in GLPI 10 and later. For MP-6, use the asset record as the anchor for each storage device, with fields that show its status, location and assigned owner. Check whether your media types, such as removable drives, tapes and backup appliances, are modeled as asset types you can actually populate, because hardware inventory alone may not capture every item that needs sanitization.

Wazuh Syscollector presence history

The Wazuh Syscollector module collects hardware, operating system, installed software, users and other data from each endpoint and stores it in the Wazuh indexer, where dashboard inventory views and reports show it. Its inventory data can show that a device was present on a given date and no longer reports afterward, which supports the timeline of a disposal or release. Confirm which endpoint types you can cover, how long inventory history is retained in your deployment, and whether devices that never ran the agent need a separate record.

Linking asset and inventory records

Neither source on its own proves that a device was wiped. Reconcile GLPI asset records with Wazuh inventory on a shared identifier such as serial number or hostname, so each disposed device has an inventory history and a lifecycle status. Illustrative example: a laptop marked retired in the asset register should stop appearing in endpoint inventory, and that gap should match a sanitization entry. Document the reconciliation method and who performs it.

Sanitization records still required

MP-6 assessors examine sanitization records and the procedures behind them, including the technique used, the security category of the information, the person who performed the work and the verification step. Neither GLPI nor Wazuh captures the sanitization method or its result, so those records need their own process, form or ticket. Decide where they live, who signs them and how long they are kept, and confirm that the disposal workflow links each device to its completed record.

Confirming fit to your environment

Before adopting either tool for MP-6 evidence, test them against your real estate: mobile devices, removable media, storage arrays, cloud volumes and any systems outside the agent footprint. Confirm which fields and reports you can export for an assessor, whether the Wazuh agent is supported on each operating system you run, and how GLPI inventory is populated from your procurement and retirement processes. Gaps found here are cheaper to close before an assessment than during one.

Who does what for MP-6: your team, a partner and the auditor

Your organization owns MP-6. Sanitization is a decision about your information, so the policy, the security categories that drive mechanism strength, and each disposal or release decision stay with your staff. The control is only as good as the records showing that defined techniques were applied to specific media.

Sanitization policy: Define which media are in scope, which techniques apply to each security category or classification, and who approves exceptions.
Category mapping: Tie each information category to the sanitization strength required before disposal, release or reuse.
Disposal decisions: Decide whether media are destroyed, cleared or released, and record the reason.
Sanitization records: Keep the records assessors examine, including media identifiers, method, date, operator and verification result.
Destruction vendor oversight: If a third party destroys media, keep the contract, certificates of destruction and your own review of them.

Before engaging anyone, confirm internally who signs off on each category decision, since no partner or assessor can make that call for you.

Common questions about MP-6 media sanitization

How much does MP-6 media sanitization cost and what drives the price?

No supplied fact gives a price or effort figure for MP-6, so confirm numbers with your own environment and with any firm you ask to quote. The main cost drivers are the number and types of media in scope (laptops, servers, storage arrays, removable media, backup tapes), the sanitization method your information category requires, whether sanitization is done in-house or by a contracted destruction vendor, and how much evidence capture you build. Some costs are one-time, such as writing the procedure and setting up records. Others recur with every disposal cycle, such as tooling, vendor fees and witnessed destruction. Ask any quote to split labor, tooling, vendor services and recurring versus one-time work, and to state which media classes and sites it covers. DeployOpen quotes follow from a written scope.

How long does it take to prepare for MP-6 and what does the work need from my team?

No supplied fact sets a duration, so the timeline depends on how much media inventory, procedure and record-keeping already exists. Preparation usually means confirming which system media are in scope, defining the sanitization techniques and procedures for each security category, assigning owners, and setting up sanitization records. Your team will need asset management staff who can reconcile inventories, a security owner who can classify information, and people who handle disposal logistics. Ask a partner for a written work breakdown with the dependencies on your inventory and disposal contracts before work starts.

Can our internal team meet MP-6 without an outside partner?

Yes, the organization owns its controls, and an internal team can define procedures, run sanitization and keep records without an implementation partner. A partner is useful when the team lacks capacity, needs help selecting open-source tooling for inventory and records, or wants an independent check of evidence before an assessment. Be clear about roles: a partner prepares systems and evidence, while only an independent auditor or assessor issues an assessment result. Decide internally who will sign off the procedure, who runs sanitization, and who keeps the records.

What does an assessor ask to see for MP-6?

Under the SP 800-53A procedure for MP-6, an assessor examines the media sanitization and disposal procedures, the applicable federal standards and policies on sanitization, and the sanitization records. They interview personnel responsible for sanitization and for records retention and disposition, and they test the sanitization process in practice. Prepare a current procedure that names the techniques per security category, a media inventory linked to disposal events, and records that show each item, method, date, operator and outcome. Expect the assessor to sample records and ask you to walk through one real disposal from start to finish.

Is a vendor destruction certificate enough evidence for MP-6?

A certificate alone is usually not enough on its own. MP-6 asks that sanitization mechanisms match the security category of the information, so the certificate must show the method used, the items covered, and that the method meets your procedure. Your own records should link each certificate to the specific media, the chain of custody, and the date. Confirm with the vendor which standard their method follows and whether they witness, document and sign each batch. Whether a particular certificate satisfies your assessor is a question to confirm with that assessor, since the decision sits with them.

How does MP-6 change at the privacy baseline?

SP 800-53B allocates MP-6 to the privacy control baseline as well as the low, moderate and high baselines, so the sanitization requirement applies to privacy-scoped systems regardless of impact level. The privacy baseline does not add MP-6 enhancements, so the enhancements that matter are the high baseline additions MP-6(1), MP-6(2) and MP-6(3). For personal information, confirm with your privacy office which media hold PII, how long records must be kept, and whether your retention rules change the disposal schedule.

Which open-source tools help produce MP-6 sanitization evidence?

GLPI's Assets module can record computers, storage-bearing equipment and other hardware, entered manually or pushed by the GLPI Agent, which gives you a disposal-ready inventory. Wazuh's Syscollector collects hardware, operating system and other endpoint data into the Wazuh indexer, which helps confirm what was on a system before it left your control. Neither tool performs sanitization, and you should confirm what each can record in your environment before relying on it for MP-6 records.

How DeployOpen prepares MP-6 sanitization evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so sanitization records come from systems the organization runs. We prepare the procedures, tooling and records that an assessor will examine for MP-6, while the organization owns the control and an independent assessor reaches the conclusion.

How we scope

Confirm which media types, systems and disposal routes fall inside the MP-6 scope and the security category of the information on them.
Agree in writing which sanitization techniques, records and handoff points the engagement covers, including any privacy baseline systems.
Name the roles that own sanitization, records retention and disposition, and the assessor-facing evidence each role must produce.

How we build

Configure GLPI Assets so every computer, drive and network device carries an inventory entry from acquisition through disposal.
Use Wazuh Syscollector inventory to confirm hardware and installed software on endpoints before and after sanitization or reuse.
Document defined sanitization techniques and verification steps as procedures tied to each media category and security category.

How we hand over

Deliver sanitization procedures and a record template covering media identifier, technique, operator, date and verification result.
Provide exported inventory reports and sample sanitization records mapped to the examine, interview and test items in SP 800-53A for MP-6.
Walk responsible staff through the records and the interview questions they are likely to face, so the organization can answer from its own evidence.

How we support

Fixed-scope engagements have written deliverables and timelines agreed before work starts.
Ongoing support, upgrades and continuous testing are available as a retainer to keep sanitization records current as systems change.
Confirm with your independent assessor which evidence formats they accept before the handover is finalized.