MA.L2-3.7.3 Equipment Sanitization

CMMC Practice MA.L2-3.7.3 – Equipment Sanitization: Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Links to Publicly Available Resources

Discussion [NIST SP 800-171 R2]
This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement).
NIST SP 800-88 provides guidance on media sanitization.

Further Discussion
Sanitization is a process that makes access to data infeasible on media such as a hard drive. The process may overwrite the entire media with a fixed pattern such as binary zeros. In addition to clearing the data an organization could purge (e.g., degaussing, secure erasing, or disassembling) the data, or even destroy the media (e.g., incinerating, shredding, or pulverizing). Performing one of these activities ensures that the data is extremely hard to
recover, thus ensuring its confidentiality.
For additional guidance on which specific sanitization actions should be taken on any specific type of media, review the description of the Purge actions given in NIST SP 800-88 Revision 1 – Guidelines for Media Sanitization.