Media Disposal (MP.L1-3.8.3): CMMC Level 1 Control
Federal Contract Information stored on physical media poses a critical security risk if not properly destroyed before disposal or reuse. MP.L1-3.8.3 requires your organization to sanitize or destroy all information system media containing FCI to prevent unauthorized access. This foundational control is essential for any contractor handling defense data.
What this means
This control mandates that any physical media—hard drives, USB drives, optical discs, magnetic tapes, or other storage devices—containing Federal Contract Information must be securely sanitized or destroyed before being disposed of or repurposed. Sanitization means rendering data unrecoverable through approved methods like degaussing, overwriting, or physical destruction. The goal is to eliminate the risk of sensitive information falling into unauthorized hands during the disposal process.
How to comply
- 1.Inventory all information system media in your environment and identify which devices contain or could contain Federal Contract Information
- 2.Establish a documented media disposal policy specifying approved sanitization methods (overwriting, degaussing, physical destruction) and destruction procedures
- 3.Implement sanitization processes before any media is removed from service, transferred to another system, or retired
- 4.Use approved sanitization tools or certified destruction services to ensure data is completely unrecoverable
- 5.Maintain records of all media sanitization and destruction activities, including what was destroyed and the method used
- 6.Train staff on proper media handling and disposal procedures to ensure consistent compliance
- 7.Verify sanitization effectiveness through spot checks or validation reports from certified vendors
Evidence auditors look for
- Media disposal policy document defining sanitization and destruction requirements
- Inventory list of organization-owned media devices and their classification
- Certificates of destruction from third-party media disposal vendors
- Sanitization logs showing dates, media serial numbers, and methods used
- Records of approved sanitization tools and their validation/certification status
- Staff training records and acknowledgments on media disposal procedures
- Documented procedures for securely transporting media to disposal facilities
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch tracks all media inventory and automatically schedules sanitization tasks, generating destruction certificates and maintaining audit-ready records—eliminating manual tracking and reducing the risk of oversight.
See how GRCWatch handles this control automatically
Start free trial