MA.L2-3.7.3
Equipment Sanitization
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MA.L2-3.7.3 in the reference catalog with its NIST cross-references
Official requirement
Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Assessment objectives
a. equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Sanitize equipment before it leaves organizational control for off-site maintenance.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You manage your organization’s IT equipment. A recent DoD project has been using a storage array to house CUI . Recently, the array has experienced disk issues. After troubleshooting with the vendor, they recommend several drives be replaced in the array. Knowing the drives may contain CUI, you reference NIST 800 -88 Rev. 1 and determine a strategy you can implement on the defective equipment – processing the drives with a degaussing unit [a] . Once all the drives have been wiped , you document the action and ship the faulty drives to the vendor.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System maintenance policy; procedures addressing controlled system maintenance; maintenance records; manufacturer or vendor maintenance specifications; equipment sanitization records; media sanitization records; system security plan; other relevant documents or records
Common mistakes
Removing a device for repair while its storage still contains controlled information.