CMMC 1.0 Practice MA.3.115 Requirement:
Ensure equipment removed for off-site maintenance is sanitized of any “Controlled Unclassified Information” (CUI).
CMMC 1.0 MA.3.115 Requirement Explanation:
When you send a hard drive off site either individually or within a system such as laptop you can no longer protect it. Encryption does provide protection however it can still be cracked. By wiping the drive you avoid this risk.
Example CMMC 1.0 MA.3.115 Implementation:
Whenever you send a device containing a hard drive or any other storage media to a vendor or other party for maintenance wipe the drive. Even if the drive is encrypted you need to wipe it. You should use the DoD 5220.22-M method to wipe the drive.
CMMC 1.0 MA.3.115 Scenario(s):
- Scenario 1:
A user has reported that their laptop is constantly crashing. You trouble shoot yourself but are unable to resolve the issue so you contact the laptop manufacture. The manufacturer instructs you to send in the laptop for a motherboard replacement. Before sending the laptop you backup the hard drive and then wipe the data on it using the DoD 5220.22-M method.
Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:
Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.
Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.
Supply Chain Verifier
Trust is everything. Verify, monitor, and support subcontactor compliance.