How to Implement FAR 52.204-21 / CMMC 2.0 Level 1 - Control - MP.L1-B.1.VII: Step-by-Step Media Sanitization and Destruction for Federal Contract Information

FAR 52.204-21 and CMMC 2.0 Level 1 require contractors handling Federal Contract Information (FCI) to ensure media sanitization and destruction processes prevent unauthorized disclosure; this post gives Compliance Framework–specific, step-by-step instructions, practical tools, and small-business examples to implement MP.L1-B.1.VII in production environments.

Overview: what MP.L1-B.1.VII covers and why it matters

The control requires that any media containing FCI be sanitized or destroyed when no longer needed, transferred, or repurposed so that data cannot be recovered by an adversary. Applicable media include hard drives, SSDs, USB flash drives, mobile devices, optical media, backup tapes, and paper. Follow NIST SP 800-88 Rev.1 guidance for “Clear, Purge, Destroy” as the baseline approach and map your procedures to the Compliance Framework evidence requirements so a small assessor can find artifacts easily.

Step-by-step implementation

1) Inventory and classify media

Start with an accurate asset inventory that tags media with type, owner, location, and whether it ever contained FCI. For small businesses, a simple CSV or an asset-tracking sheet is fine if it contains hostname/serial, media type, last known data classification, and custodian. Example: "Laptop-023, SN XXXXX, HDD, last used for FCI on 2026-02-10, custodian: Alice". This inventory drives decisions about sanitization vs. destruction and helps meet auditor evidence requests.

2) Choose the sanitization method based on media type

Map media to an appropriate method: for magnetic HDDs use overwrite (Clear) or physical destruction (Destroy); for SSDs prefer cryptographic erase or secure-erase commands (Purge) because multi-pass overwrites are unreliable on flash; for removable flash drives and USB keys use secure-format tools or physical destruction; for paper use cross-cut shredding; for optical media use shredding or disintegration. Reference NIST SP 800-88 for method selection, and for cloud-hosted FCI require key destruction or CSP attestations of data removal. Example commands: Linux HDD overwrite: shred -v -n 3 /dev/sdX; Linux ATA secure-erase: hdparm --user-master u --security-set-pass P /dev/sdX && hdparm --security-erase P /dev/sdX; for NVMe: nvme format --ses=1 /dev/nvme0n1 (vendor tools may be required). For Windows, use SDelete (Sysinternals) to zero free space: sdelete -z C: for clearing free space; prefer BitLocker + crypto-erase by destroying keys for SSDs encrypted at rest.

3) Execute sanitization and verify

Perform sanitization in a controlled workflow: remove the media from service, document serial/asset tag, perform the chosen method, and capture verification artifacts. Verification can be a tool output indicating success (hdparm exit status, shred verbose output, or vendor secure-erase log), photos of physical destruction, or a certificate of destruction from a certified vendor. For cryptographic erase, capture key destruction or rekey logs. Maintain a simple checklist for operators to sign off on each step to show chain-of-custody and completion.

4) Document, label, and retain evidence

Keep a sanitized-media record that includes asset tag/serial, method used, operator name, date/time, verification output or certificate number, and disposition (reused, recycled, destroyed). Store evidence in your Compliance Framework documentation library (e.g., “Sanitization Log 2026_Q1.csv” plus scanned certificates). For contracts, many COIs expect retention of evidence; as a practical small-business rule, retain sanitization records for the life of the contract plus one year or as contractually required—store logs in a centralized, access-controlled repository.

5) Using third-party destruction and cloud considerations

If you outsource destruction, perform vendor due diligence: require SOC 2 / ISO 27001 evidence, ask for a certificate of destruction that lists serial numbers/asset tags, and include media-handling clauses in the subcontract. For cloud-hosted FCI, require your CSP to provide documented methods for data removal and key destruction (e.g., KMS key deletion with documented policy and audit logs). If using SaaS, obtain a data processing addendum that obligates the vendor to sanitize underlying media on tenant deletion and provide attestations as evidence.

Real-world small-business scenarios

Example 1: Small IT shop disposing of 10 laptops — Inventory each device, full-disk encrypt while in use (BitLocker/FileVault), then for disposal either issue ATA secure-erase for HDDs or cryptographic erasure by deleting encryption keys for SSDs, capture the hdparm or vendor-tool logs, and get a certificate from the recycler for drives physically destroyed. Example 2: Independent consultant with USB drives — if reusable, run a secure-format utility (or overwrite with shred if on Linux) and log the serials; if the cost is low, physically destroy the drives and retain photos and a destruction form. Example 3: MSP rotating backup tapes — schedule purge/retention, use professional tape erasure or certified degaussing and collect vendor certificates listing tape IDs.

Risks of non-compliance and practical best practices

Failing to sanitize or destroy media properly risks accidental disclosure of FCI, contract termination, suspension from federal contracting, and reputational damage. Practical best practices: adopt full-disk encryption by default (reduces risk and simplifies end-of-life cryptographic erase), maintain an accessible sanitization SOP mapped to your Compliance Framework controls, perform periodic audits of the asset inventory, and train the small team members responsible for disposal. Use role-based assignments: assign an asset custodian, an attestor for verification, and a records custodian for archiving certificates.

Implement a simple change-control check for repurposing equipment: no device can be reissued until the sanitization log and verification artifact are filed. For high-assurance scenarios, use physical destruction (shred/crush) for media that ever contained high-sensitivity information; for large volumes, contract an on-site hard-drive shredder vendor and witness the process.

In summary, meeting FAR 52.204-21 and CMMC 2.0 Level 1 MP.L1-B.1.VII is a matter of policy, repeatable procedures, appropriate technical methods per media type, and solid recordkeeping—small businesses can implement a compliant, low-cost program by inventorying assets, selecting NIST-aligned sanitization techniques (or approved vendors), capturing verification artifacts, and enforcing disposal SOPs so that FCI is never recoverable after disposition.