Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
MP.L1-3.8.3 · FAR 52.204-21 (b)(1)(vii) · NIST SP 800-171 3.8.3
Media Disposal
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
When you throw out or reuse a computer, phone, USB drive, or paper file, wipe it or destroy it so the next person can't read what was on it.
Why it matters
Selling an old laptop on eBay without wiping it is the textbook CMMC failure. A written disposal procedure plus a running log is one of the cheapest controls to get right.
The proof on file
- Media destruction recordFrom your registers · May 28, 2026On file
The narrative on file
Old drives and USB media are wiped or physically destroyed before disposal, logged on the media destruction record. Paper drawings and travelers tied to federal jobs are shredded on site. No federal media leaves the building intact.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- A written sanitization procedure covers each media type: laptops, phones, USBs, drives, paper
- The disposal log has at least one recent entry with: date, item, serial, method, performer, witness
- Owner signature on the procedure
- For Intune path: device retire/wipe history visible
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365 / Intune, step by step
- 1Go to Intune / Endpoint Manager → Devices → retired or wiped devices
- 2Screenshot the wipe history for any retired device that handled FCI
Capture: Screenshot of Intune retire/wipe history for decommissioned devices.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.