Employees are often the last line of defense in protecting Federal Contract Information (FCI); effective training on MP.L1-B.1.VII — implementing procedures to sanitize or destroy media containing FCI — turns policy into repeatable action and reduces the risk of accidental disclosure that can cost small businesses contracts, penalties, and reputation.
Why this control matters for small businesses
FAR 52.204-21 and CMMC 2.0 Level 1 require basic safeguarding of FCI: when media (laptops, USB drives, backup tapes, paper, photocopier hard drives) reaches end-of-life or is removed from controlled areas it must be sanitized or destroyed. For a small business this is both a technical and people problem: technical because different media types require different sanitization methods (clear, purge, destroy per NIST SP 800-88 Rev.1), and people because staff must recognize FCI, follow the approved method, and document the action. Failure to implement and train on these procedures creates real risks — data leakage, contract loss, and regulatory scrutiny.
Core training topics and learning objectives
Design training so every employee can (1) identify media that may contain FCI, (2) apply the correct disposition method (clear/purge/destroy), and (3) document and verify the sanitization. For technical staff include hands-on modules: using manufacturer secure-erase utilities (ATA Secure Erase or NVMe sanitize), validating cryptographic erase for SSDs, and the limitations of overwriting on flash media. For non-technical staff focus on handling rules: never place removable media in regular trash, use locked disposal bins, and route items to the IT asset disposal (ITAD) process.
Practical, role-based training activities
Break training into role-specific tracks: receptionists and office staff need to know how to isolate and hand off found or dead media and shred paper; IT operators need procedures and checklists for decommissioning devices; managers need to sign off on certificates of destruction. Exercises for a small business include: a) a mock decommission of a laptop with an IT admin walking through secure-erase (hdparm --security-erase on Linux or vendor tools) and documenting serial number, Sanitize method, and verification hash; b) a tabletop scenario where a courier loses a tape backup in transit and staff perform chain-of-custody reconstruction and notification; c) hands-on demo of a cross-cut shredder for paper and shredding verification.
Specific procedures to teach (technical details)
Teach the NIST approach of Clear, Purge, Destroy and map each media type to a method: magnetic HDDs — single-pass overwrite or vendor secure erase is acceptable with verification; SSDs/NVMe — prefer ATA Secure Erase, NVMe Sanitize, or cryptographic erase (crypto-shred) and then verification, and where guarantees are needed use physical destruction (shearing, crushing, or shredding rated for SSDs); removable flash drives — physical destruction or secure-erasure plus verification; backup tapes — degauss (if magnetic) or shred/pulverize; optical media (CD/DVD) — cross-cut shredding or pulverizing; mobile devices — factory reset plus cryptographic key destruction and verification, remove SIM/SD. For cloud-hosted FCI train staff to require documented provider data deletion procedures and key destruction (crypto-shredding) clauses in contracts and to obtain written confirmation when media is deprovisioned.
Documentation, verification, and third-party vendors
Train staff on the required documentation: asset ID, serial number, disposition method, operator, date/time, verification result, and acceptance signature. For small businesses a simple secure spreadsheet or ticketing form works; for larger operations use an ITAD workflow and barcodes. When outsourcing destruction, require certificates of destruction, vendor insurance, and chain-of-custody forms. Demonstrate how to inspect vendor certificates and request photos or serial-numbered receipts. Include a verification step in training where trainees must confirm a wiped device by checking free-space patterns, SMART attributes, or vendor erase logs before signing off.
Compliance tips, best practices, and small-business examples
Best practices to emphasize in training: maintain a media inventory and label FCI-containing devices; require encryption at rest so that even lost media is less likely to expose FCI (encrypt laptops and removable media); restrict use of personal USB drives and implement a locked collection bin for media disposal; schedule periodic refresher training and spot audits. Example: a small subcontractor implemented an “ITAD Friday” where all retired devices are collected, documented, and either securely erased by IT using vendor tools or boxed and sent to a certified recycler — staff receive a short checklist and an annual hands-on refresher. Another scenario: a project manager finds a flash drive with contract documents — training directs them to place it in a labeled evidence envelope and notify IT rather than attempting to open it, preserving chain-of-custody and preventing accidental spread.
Risks of not implementing proper sanitization training
Without trained staff and enforceable procedures, small businesses face tangible consequences: inadvertent release of FCI leading to contract breaches under FAR 52.204-21, loss of future government work, mandatory breach reporting, fines, and reputational harm. Technical risks include residual data on SSDs that survive naïve overwrites, backup tapes stored without encryption that are lost in transit, or copiers with resident images that later get resold. Training reduces human error, ensures repeatable verification, and creates evidence of due diligence for auditors.
Summary: To meet MP.L1-B.1.VII under the Compliance Framework, build a role-based training program that teaches identification, correct sanitization methods (clear/purge/destroy), verification and documentation, and vendor management; use practical exercises and checklists, maintain a media inventory, enforce encryption at rest, and require certificates of destruction when outsourcing — these steps translate policy into defensible practice and materially lower the risk of FCI exposure for small businesses.
