3.7.3 — Wipe Before Repair
What It Says
Section titled “What It Says”Ensure equipment removed for off-site maintenance is sanitized of any CUI.
What It Actually Means
Section titled “What It Actually Means”Before any CUI system leaves your controlled environment for repair, maintenance, or vendor support, all CUI must be removed. This means: wipe drives per NIST SP 800-88, remove any removable media, verify sanitization, and document the process. Failed drives that can’t be wiped must be physically destroyed — not shipped.
Pass or Fail
Section titled “Pass or Fail”Your assessor needs a “yes” to every row:
| # | Question | What “yes” looks like |
|---|---|---|
| 1 | Is equipment sanitized of CUI before off-site maintenance? | Sanitization records showing method (wipe, degauss, destroy), date, device, and person who performed it |
What to Have Ready on Assessment Day
Section titled “What to Have Ready on Assessment Day”Documents they’ll review: Maintenance policy; sanitization procedures; sanitization records; media destruction records; NIST 800-88 reference; system security plan
People they’ll talk to: Maintenance personnel; information security personnel; anyone who performs sanitization
Live demos they’ll ask for: “Show me your sanitization procedure.” “Show me records from the last device sent for repair.” “What do you do with a failed drive that can’t be wiped?”
The Assessor’s Playbook
Section titled “The Assessor’s Playbook”- “Show me your sanitization procedure for equipment going off-site.”
- “When was the last device sent for repair? Show me the sanitization record.”
- “What method do you use — overwrite, degauss, or destroy? Is it per NIST 800-88?”
- “What happens with failed drives that can’t be sanitized?”
Where Companies Trip Up
Section titled “Where Companies Trip Up”No sanitization. Equipment shipped with CUI intact. Always wipe or remove data storage before shipping.
No documentation. CUI was removed but nobody recorded it. Keep sanitization records for every device.
Failed drives shipped. A drive that can’t be wiped is sent to the vendor anyway. Destroy it instead — degauss and shred per NIST 800-88.
How to Talk About This
Section titled “How to Talk About This”Connected Requirements
Section titled “Connected Requirements”| Requirement | Why it matters here |
|---|---|
| 3.8.3 — Destroy It Properly | Media sanitization standards apply here |
| 3.7.1 — Maintain on Schedule | Maintenance processes that may trigger off-site repair |
| 3.8.6 — Encrypt Media in Transit | If data must travel, encryption is required |
Implementation (coming soon)
Section titled “Implementation (coming soon)”Step-by-step setup for Microsoft 365 / Entra ID, AWS, Azure, and GCP — console steps, CLI commands, and evidence screenshots.
CMMC Practice ID: MA.L2-3.7.3 | SPRS Weight: 1 point | POA&M Eligible: Yes