03.08.03: Media Sanitization
Control Family:
Threats Addressed:
Previous Version:
- NIST Special Publication 800-171 Revision 2:
- 3.8.3: Sanitize or destroy system media containing CUI before disposal or release for reuse
Incorporates the following control from the previous version of the control set: 3.7.3: Ensure equipment removed for off-site maintenance is sanitized of any CUI.
Requirements
- Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.
Discussion
Media sanitization applies to digital and non-digital media that are subject to disposal or reuse, whether or not the media are considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, mobile devices, workstations, network components, and non-digital media. The sanitization process removes CUI from media such that the information cannot be retrieved or reconstructed. Sanitization techniques (e.g., cryptographically erasing, clearing, purging, and destroying) prevent the disclosure of CUI to unauthorized individuals when such media are reused or released for disposal. NARA policies control the sanitization process for media that contain CUI and may require destruction when other methods cannot be applied to the media.