MP.L2-3.8.3
Media Disposal [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.3 in the reference catalog with its NIST cross-references
Official requirement
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Assessment objectives
a. system media containing CUI is sanitized or destroyed before disposal; and
b. system media containing CUI is sanitized before it is released for reuse.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Sanitize or destroy media containing controlled information before disposal or reuse.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As you pack for an office move, you find some old CDs in a file cabinet. You determine that one has information about an old project your company did for the DoD . You shred the CD rather than simply throwing it in the trash [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media sanitization and disposal; applicable standards and policies addressing media sanitization; system security plan; media sanitization records; system audit logs and records; system design documentation; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Deleting files without applying and verifying the selected sanitization method.