MP.L1-b.1.vii
Media Disposal [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L1-b.1.vii in the reference catalog with its NIST cross-references
Official requirement
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
Assessment objectives
a. system media containing [FCI] is sanitized or destroyed before disposal; and
b. system media containing [FCI] is sanitized before it is released for reuse.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Sanitize or destroy media containing federal contract information before disposal or reuse.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As you pack for an office move, you find some old CDs in a file cabinet. You determine that one has FCI from a project your company did for the DoD . You shred the CD rather than simply throwing it in the trash [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media sanitization and disposal; applicable standards and policies addressing media sanitization; system security plan; media sanitization records; system audit logs and records; system design documentation; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Deleting files or formatting a drive without confirming the information cannot be recovered.