CMMC 1.0 Practice MA.3.115 Requirement:
Ensure equipment removed for off-site maintenance is sanitized of any “Controlled Unclassified Information” (CUI).
CMMC 1.0 MA.3.115 Requirement Explanation:
When you send a hard drive off site either individually or within a system such as laptop you can no longer protect it. Encryption does provide protection however it can still be cracked. By wiping the drive you avoid this risk.
Example CMMC 1.0 MA.3.115 Implementation:
Whenever you send a device containing a hard drive or any other storage media to a vendor or other party for maintenance wipe the drive. Even if the drive is encrypted you need to wipe it. You should use the DoD 5220.22-M method to wipe the drive.
CMMC 1.0 MA.3.115 Scenario(s):
- Scenario 1:
A user has reported that their laptop is constantly crashing. You trouble shoot yourself but are unable to resolve the issue so you contact the laptop manufacture. The manufacturer instructs you to send in the laptop for a motherboard replacement. Before sending the laptop you backup the hard drive and then wipe the data on it using the DoD 5220.22-M method.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.