The short version
If your contract carries DFARS 252.204-7012, every device that has held CUI has to be sanitized before it leaves your control — and you need to be able to show it was.
The requirement is one sentence long. Everything difficult about it is in the evidence.
Which revision applies to you, because it is probably not the current one
This is the detail most pages get wrong, and it changes what your assessor scores.
NIST publishes Revision 3. SP 800-171 Revision 3 was issued in May 2024 and supersedes Revision 2. In Rev. 3 the media sanitization requirement is numbered 03.08.03.
CMMC assesses Revision 2. The CMMC Program final rule was published at 89 FR 83092 on 15 October 2024 and took effect 16 December 2024. It states that the security standards used in the programme come from FAR 52.204-21 and "DFARS clause 252.204-7012 that implements NIST SP 800-171 R2," together with selected requirements from SP 800-172. An Organization Seeking Assessment meets CMMC Level 2 by satisfying all 110 security requirements of NIST SP 800-171 R2.
So when someone tells you to "comply with the current NIST standard," ask which document their assessor will actually score. For a CMMC Level 2 assessment today that is Rev. 2, requirement 3.8.3 — not Rev. 3's 03.08.03.
Both say the same thing about disposal. The numbering, the scoring and the assessment guide do not.
What the requirement actually says
NIST SP 800-171 Rev. 2, requirement 3.8.3, in full:
"Sanitize or destroy system media containing CUI before disposal or release for reuse."
Rev. 3, requirement 03.08.03, for comparison:
"Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse."
Note what Rev. 3 added: "release out of organizational control." Handing a sealed pallet to a transport company is a release out of your control. Rev. 2's wording arguably reaches the same place; Rev. 3 stopped leaving it to argument.
Rev. 3's discussion is worth reading for one reason in particular — the device list:
"Examples include digital media in scanners, copiers, printers, notebook computers, mobile devices, workstations, network components, and non-digital media."
Scanners, copiers and printers. Multifunction devices hold images of everything they processed, and they are the single most commonly forgotten item on a CUI disposal inventory. They are not on our collection list — we take phones, tablets and laptops — but they belong on yours.
Rev. 3 also names the acceptable techniques — "cryptographically erasing, clearing, purging, and destroying" — and points at SP 800-88 as the supporting publication, which is why that document keeps coming up. It adds one constraint people miss: NARA policies govern sanitization of CUI and "may require destruction when other methods cannot be applied to the media."
What changed in NIST SP 800-88 Rev. 2 covers the method definitions themselves, and the fact that no such thing as "NIST 800-88 certified" exists.
Where the clause puts the obligation
DFARS 252.204-7012 paragraph (b)(2)(i) states that the covered contractor information system "shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171."
Two consequences people underestimate:
It follows the information, not the device. "Covered defense information" is unclassified information that "requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies." A laptop that briefly held CUI two years ago is still a laptop that held CUI, and your inventory has to know which ones those were.
It flows down. Paragraph (m)(1) requires the contractor to include the clause, including paragraph (m), in subcontracts for operationally critical support or where performance involves covered defense information. If you are a sub, the obligation is yours directly — not your prime's problem.
What an assessor asks to see
Not whether you sanitized. How you know you did, for that serial number.
The pattern that survives an assessment is boring: an inventory that identifies which assets held CUI, a custody record showing what left the building and who accepted it, and a sanitization record per device naming the method, the tool and its version, the result, the date and the operator.
A batch certificate stating that a quantity of media was processed is not evidence about any particular device, and the device somebody asks about is always a particular one.
What a certificate of destruction should contain — the twelve fields NIST specifies, and what the document does not prove.
Where we fit, and where we don't
We sanitize to NIST SP 800-88 Revision 2 in our own facility, choosing the method per device, with verification and validation recorded separately and a certificate issued per media item. That is the document an assessor asks for against 3.8.3, and it names the method, the technique, the tool and its version, and the people who verified and validated it.
What we hold is no certification and no facility clearance. Not R2, not e-Stewards, not NAID; our R2 certification audit is pending. We are not cleared, we are not on a contract vehicle, and nothing on this page should be read as a claim to any of those. If your flow-down requires a certified provider at award, we are not yet eligible for that clause.
We also produce the custody half, which is the half most often missing when an assessor asks. We work from the list you issue, count the devices at your site before anything is loaded, record discrepancies at the moment they are found, seal what leaves, and hand you a signed manifest with the seal numbers on it. The sanitization certificate reconciles against that manifest by serial number, which is the linkage an assessment actually tests.
How collection and custody works ·
Common questions
Does CMMC require a certified destruction vendor?
The CMMC requirement is that media containing CUI is sanitized or destroyed before disposal or release for reuse. Requirement 3.8.3 does not name a vendor certification. Whether your own policy or your contract imposes one is a separate question, and worth checking before you assume either way.
We encrypted the drives. Is that enough?
Cryptographic erase is one of the techniques Rev. 3 names, but it carries preconditions — see the sanitization page for what they are, including the plaintext rule and its limit. Whether CE is acceptable for your data is a decision for your security function, not for a disposal vendor.
Do we have to destroy the media?
Not automatically. Sanitize or destroy is the wording. Rev. 3 adds that NARA policies may require destruction where other methods cannot be applied to the media — so the answer depends on the media, not on a general preference.
What about a device that held CUI years ago?
It held CUI. The requirement attaches to media containing CUI, and your inventory is the only thing that knows which devices those are. This is the argument for reconciling against a list at collection rather than afterwards from memory.
Who is responsible if we are a subcontractor?
You are. Paragraph (m)(1) flows the clause down to subcontracts involving covered defense information.
Where to read it yourself
DFARS 252.204-7012 · NIST SP 800-171 Rev. 2 (the one CMMC scores) · NIST SP 800-171 Rev. 3 · the CMMC Program final rule
This is general information, not legal advice. R2 Revive is not a law firm. What applies to you depends on your contract, your data and your own policies, so check this with your counsel or compliance function before you act on it. Regulatory content on this page last reviewed: 2026-09-12 · Why we put it that way
How we handle government projects · Talk to a person