Disposing of Federal Contract Information (FCI) media in a consistent, documented way is a small-business compliance win: it reduces risk, satisfies FAR 52.204-21 and CMMC 2.0 Level 1 (MP.L1-B.1.VII), and creates auditable evidence that sensitive media were sanitized or destroyed correctly.
Understanding the requirement and Compliance Framework context
The Compliance Framework practice requires organizations to ensure media containing FCI are controlled through their lifecycle and are disposed of so that information cannot be reconstructed or retrieved. FAR 52.204-21 requires contractors to protect covered contractor information systems, and CMMC MP.L1-B.1.VII specifically expects media protection practices for disposal. For a small business that holds FCI, this translates into three operational obligations: identify and inventory media, apply an approved sanitization or destruction method, and record the disposal with evidence.
Scope: what counts as media and what is “disposal”
“Media” includes paper, removable media (USB drives, SD cards), magnetic hard drives, SSDs, mobile devices, backup tapes, and electronic storage in cloud environments. “Disposal” means sanitizing (clearing/purging) or destroying media so FCI cannot be accessed post-disposition. The Compliance Framework emphasizes repeatable processes and documentation—so even a single USB drive must follow the same checklist and produce the same artifacts (chain-of-custody, certificate of destruction, logs) as other media types.
Practical checklist and template fields you can implement today
Create a single Media Disposal Checklist template that your operations team and subcontractors use. At minimum include these checklist items: unique Media ID; media type and manufacturer/serial; owner/contract number; business justification for disposal; classification (FCI); last known location; chosen sanitization method (clear/purge/destroy); who performed the action (name and role); date/time; verification method (hash comparison, vendor certificate, photos); chain-of-custody reference; and final disposition (recycle, shred, vendor disposal). Keep an electronic version in your Compliance Framework documentation repository and a printed copy in the disposal kit if on-site actions are needed.
Template fields — Chain of Custody and Certificate of Destruction
Design two short templates: a Chain-of-Custody (CoC) and a Certificate of Destruction (CoD). CoC fields: CoC ID, Media ID, From (department/person), To (person/vendor), transfer date/time, handling notes, and signature (or e-signature). CoD fields: CoD ID, Media ID(s), destruction method (e.g., physical shred, NIST SP 800-88 Purge with ATA Secure Erase, crypto-erase), vendor name and license/NAID membership (if applicable), destruction date, verification evidence (photos, serial numbers), and authorized signer. Storing these templates as fillable PDFs or in your GRC/IRM tool makes audit retrieval simple.
Technical sanitization methods and verification details
Map allowed sanitization to media type in a small decision matrix: for magnetic HDDs use NIST SP 800-88 Rev. 1 guidance—purge by degaussing if available or physical destruction; for SSDs and flash, prefer vendor-issued Secure Erase/ATA Secure Erase or NVMe sanitize commands, or cryptographic erase (crypto-erase) when full-disk encryption has been used and keys can be destroyed. For devices encrypted with BitLocker or FileVault, document the key destruction process or perform a secure wipe. Cloud-stored FCI requires deletion of snapshots and destruction of encryption keys (KMS) with retention checks and documented confirmation from the cloud provider. Always record verification: for software wipes, capture the tool, version, command used (e.g., hdparm --security-erase for ATA devices or nvme format with secure erase for NVMe), and logs; for physical destroys, capture vendor CoD and photographs of shredded/mashed media labeled with Media ID.
Vendor management and small-business scenarios
Small businesses often outsource destruction. If you do, add vendor due diligence to your Compliance Framework: require NAID membership or equivalent, proof of insurance, onsite destruction options, and contract clauses to provide CoD within a defined SLA (e.g., 7 days). Scenario: a 10-person MSP that wins a contract with FCI uses BitLocker for all laptops and a local certified vendor for hard-drive shredding; before handing drives over, the MSP logs all drives in the Media Disposal Checklist, exports BitLocker key metadata, performs a crypto-erase (destroy the key escrowed in the enterprise KMS), and then transfers the drives under CoC to the vendor who returns a CoD. The MSP keeps all artifacts in a secure archive for the contract term plus any required retention period.
Risks of not implementing structured checklists and templates
Failing to use checklists increases the likelihood of human error: a laptop’s SSD could be reassigned without erasure, a USB drive might be thrown away, or cloud snapshots could persist. Consequences include data leaks, contract noncompliance, CMMC assessment failures, potential termination of contracts, and reputational damage. Technically, improper sanitization of SSDs or relying on a single overwrite for modern flash can leave recoverable data. Legally, you risk failing FAR obligations and exposing your company to investigative actions—documented chain-of-custody and CoDs are your primary defense in post-incident audits.
Compliance tips and best practices
Make disposal procedures simple, auditable, and low-friction: pre-label media with QR-code Media IDs at issuance, include disposal tasks in employee offboarding checklists, automate retention and destruction tasks where possible (e.g., lifecycle policies in cloud storage that cascade and destroy keys), and schedule periodic destruction drills to validate vendors and in-house tools. Train staff on choosing sanitization methods by media type, keep NIST SP 800-88 Rev. 1 and CMMC mappings in your Compliance Framework playbook, and store all artifacts in an immutable archive (WORM storage) for easy retrieval during FAR or CMMC reviews.
Summary: Implement a single, lightweight Media Disposal Checklist and two templates (Chain-of-Custody and Certificate of Destruction), map sanitization methods to media types using NIST guidance, document every step, vet destruction vendors, and incorporate disposal tasks into your Compliance Framework processes. These actionable steps will help your small business meet FAR 52.204-21 and CMMC 2.0 Level 1 expectations while reducing operational risk and leaving a clear audit trail.
