CMMC Practice Requirement:

Ensure equipment removed for off-site maintenance is sanitized of any “Controlled Unclassified Information” (CUI).

CMMC Requirement Explanation:

When you send a hard drive off site either individually or within a system such as laptop you can no longer protect it. Encryption does provide protection however it can still be cracked. By wiping the drive you avoid this risk.

Example CMMC Implementation:

Whenever you send a device containing a hard drive or any other storage media to a vendor or other party for maintenance wipe the drive. Even if the drive is encrypted you need to wipe it. You should use the DoD 5220.22-M method to wipe the drive.


- Scenario 1:

A user has reported that their laptop is constantly crashing. You trouble shoot yourself but are unable to resolve the issue so you contact the laptop manufacture. The manufacturer instructs you to send in the laptop for a motherboard replacement. Before sending the laptop you backup the hard drive and then wipe the data on it using the DoD 5220.22-M method.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance