MP.L1-B.1.VII
Media Disposal
FCI Data
Security Requirement
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
USU Policy, Procedures, and Standards
University Policy 5200: Information Security and Appropriate Use
- Section 2.3 - Device and Endpoint Management and Security
- Section 3.3 - Information Technology and IT Staff
- Section 3.7 - Contractors and Vendors
States that access controls must be implemented on all devices to ensure only authorized individuals can access university-owned or -managed data and resources. IT staff are accountable for preserving data integrity, enforcing security standards, and protecting university-owned assets. Contractors must follow the security protocols outlined in their agreements, including disposal or return of data.
NIST Cybersecurity Framework v2
- Protect (PR): PR.DS-03 - Data is destroyed according to policy when no longer required.
- Protect (PR): PR.AA-04 - Data is disposed of securely to prevent unauthorized access.
Implementation Details
Documentation should include details to meet the Security Requirement for this control. Complete this list for each system or systems that process or access FCI data:
- List your procedures for securely sanitizing or destroying digital media (e.g., hard drives, USBs, mobile devices) before disposal or reuse.
- List your procedures for securely disposing of physical media (e.g., paper documents) that contain FCI.
- List the tools or services used to carry out media sanitization or destruction.
- List any additional review or oversight processes related to media sanitization.
Document How
- system media containing FCI is sanitized or destroyed before disposal
- system media containing FCI is sanitized before it is released for reuse
Example
All storage media used to process FCI is tracked through USU's asset management system. Prior to reuse or disposal, staff follow NIST 800-88 Rev. 1 guidelines for media sanitization. Digital media is either cryptographically erased or physically destroyed using a certified shredding device. Paper records are cross- shredded and disposed of through a secure document destruction service. Staff involved in the sanitization process receive annual training.
How might an auditor assess this control?
Method
- Examine:
- Review sanitization procedures, disposal logs, training records, and physical or digital media handling policies.
- Interview:
- Ask staff how they determine which media needs to be sanitized and how sanitization is performed.
- Test:
- Attempt to trace a sample storage device or document through the sanitization/disposal process.
Objects (examples of items you could present to the auditor)
- Media Sanitization Policy: Describes procedures and approved methods for destroying sensitive media.
- Asset Disposal Records: Showing dates, devices, and sanitization method used.
- Staff Training Logs: Verification that responsible personnel are trained.
- Shredder Certification: Specifications for any devices used to destroy physical media.
- Vendor Agreements: If third-party destruction services are used.
- NIST 800-88 Rev. 1 Reference Documentation: To show alignment with federal standards.