The short version
The CJIS Security Policy does something HIPAA, FERPA and NIST deliberately avoid: it prescribes methods. Three-pass overwrite or degaussing for digital media, destruction if the media is inoperable, crosscut shredding or incineration for paper.
That specificity makes compliance easier to check and harder to satisfy — because for some modern media, the named technique is one that sanitization science has since moved away from.
What MP-6 says
From the CJIS Security Policy v6.1, dated 25 June 2026, control MP-6 Media Sanitization:
"Sanitize or destroy digital media prior to disposal, release out of agency control, or release for reuse using overwrite technology at least three times or degaussing. Inoperable digital media will be destroyed. Non-digital media will be securely disposed of when no longer needed for investigative or security purposes, whichever is later. Non-digital media will be destroyed by crosscut shredding or incineration."
And the second half:
"Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information."
Three requirements in that first paragraph are easy to skim past:
"Release out of agency control" is a trigger. You do not have to be disposing of the device. Handing it to a vendor is a release.
"Inoperable digital media will be destroyed." A drive that will not respond cannot be verified, so the policy does not let you try. If a laptop is dead, its storage is a destruction case — and that decision gets made at collection, not after somebody has spent an afternoon failing to wipe it.
Non-digital media has a different clock. "When no longer needed for investigative or security purposes, whichever is later" is a retention test, not a disposal test.
The conflict worth knowing about
MP-6 names three-pass overwrite and degaussing. Current sanitization guidance has moved away from both for modern media.
NIST SP 800-88 Rev. 2 and IEEE 2883 treat multi-pass overwriting as a legacy technique aimed at magnetic recording, and the FAQ NIST published for Rev. 2 states that destructive techniques like pulverizing and shredding are ineffective for medium- and high-security categories because of data density. Degaussing does nothing useful to flash memory at all — there is no magnetic domain to disturb, so a degausser applied to an SSD is theatre.
So an agency with SSD-based laptops is holding a policy that names a technique which does not work on its hardware, alongside a fallback — destruction — that does.
We are not telling you MP-6 does not apply. It does, and your CSA enforces it. We are telling you that "we degauss, so we are CJIS compliant" is a claim to examine when the media is solid-state, and that the policy's own destruction path exists for exactly this reason.
What changed in NIST SP 800-88 Rev. 2 covers the method definitions and why a factory reset is usually not one of them.
It is not only hard drives
MP-6's discussion lists what counts as system media:
"Examples include digital media in scanners, copiers, printers, notebook computers, workstations, network components, mobile devices, and non-digital media (e.g., paper and microfilm)."
The multifunction device in the records room has an internal drive and it has seen everything printed in that room. It is not on our collection list — we take phones, tablets and laptops — but it belongs on your inventory.
The part that decides whether a vendor can touch the equipment at all
This is where CJIS differs most from every other rule on this site, and it is the question to settle before anyone quotes you a price.
PS-3 Personnel Screening, from the same policy:
"Screen individuals prior to authorizing access to the information system; 1. To properly screen, state of residency and national fingerprint-based record checks shall be conducted. National fingerprint-based record checks must be conducted pursuant to an FBI approved authority such as a federal statute or a state statute approved pursuant to Public Law 92-544."
The policy defines an authorised user as someone "appropriately vetted through a national fingerprint-based record check."
So for a disposal project the question is not only what happens to the media. It is whether the people in the room have been screened, or whether they are escorted the entire time by someone who has. Your CSA sets how that works in your state, and the answer belongs in the contract before a vehicle is booked.
Where we fit, and where we don't
We sanitize media in our own facility, to NIST SP 800-88 Revision 2, with verification and validation recorded separately and a certificate issued per media item. Nothing on this page is a claim that we satisfy MP-6 on your behalf. MP-6 is a control your agency is assessed against, and whether our procedure and records meet your CSA's reading of it is their determination, not ours.
We hold no CJIS clearance and our personnel are not fingerprint-screened under PS-3. If your agency requires screened personnel for physical access to media, we are not the right provider for the collection step unless your policy permits continuous escort by your own authorised staff. That is a determination for your CSA and your policy, not for us — and we would rather you asked it now than discover it at the door.
What we can do, where escorted collection is permitted, is the custody record and the sanitization: count the devices against your list at your site, record discrepancies as they are found, flag inoperable units as destruction cases at the point of collection, seal what leaves, hand you a signed manifest with seal numbers, then sanitize to NIST SP 800-88 Revision 2 in our facility and issue a certificate per media item that reconciles against that manifest.
Whether that satisfies your agency's reading of MP-6 is a determination for your CSA. We can show you the procedure and the records; we cannot make that call for you, and a vendor who says otherwise is guessing about your policy.
How collection and custody works ·
Common questions
What should the destruction record contain?
CJIS does not specify a certificate format. NIST's field list is the usual reference — what a certificate of destruction should contain.
Is there a CJIS certification for disposal vendors?
No. The FBI certifies no disposal vendors and publishes no approved list. Compliance is assessed through your CSA and the agency audit process, against the policy. A vendor advertising itself as "CJIS certified" is describing something that does not exist.
Does a cloud or offsite arrangement change this?
The policy reaches contractors, private entities and noncriminal justice agency representatives with access to or operating in support of criminal justice services. Being offsite does not remove you from scope; it changes which controls you have to evidence.
What if the drive is encrypted?
MP-6's discussion lists cryptographic erase among the sanitization techniques. Whether it is acceptable for your data category is a decision for your agency and your CSA — and it carries preconditions. What those preconditions are.
Can we just degauss everything?
Not if it is flash. Degaussing acts on magnetic media; an SSD has no magnetic domains to disturb. For solid-state media the policy's destruction path is the one that actually does something.
Who decides what is adequate?
Your CSA. Not your vendor, and not this page.
Where to read it yourself
CJIS Security Policy v6.1, 25 June 2026 — MP-6 Media Sanitization and PS-3 Personnel Screening. The FBI publishes it in full; if a vendor summarises it for you, check the summary against the document.
This is general information, not legal advice. R2 Revive is not a law firm. What applies to you depends on your agency, your CSA's requirements and your own policies, so check this with your counsel or compliance function before you act on it. Regulatory content on this page last reviewed: 2026-09-12 · Why we put it that way
How we handle government projects · Talk to a person