3.7.3Wipe gear before it leaves
Equipment going out for repair has CUI removed first.
The requirement, verbatim
NIST SP 800-171 Rev. 2 · 3.7.3Ensure equipment removed for off-site maintenance is sanitized of any CUI.
NIST's discussion
This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in-house, software maintenance agreement).
NIST SP 800-88 provides guidance on media sanitization.
NIST SP 800-171 Rev. 2, discussion under 3.7.3. Whitespace normalised; wording unchanged.
Assessment objectives
An assessor decides each of these separately. The requirement is met only when every objective is.
- [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI
NIST SP 800-171A, determination statements for 3.7.3.
For assessors: examine, interview, test
NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.
Examine
- System maintenance policy
- procedures addressing controlled system maintenance
- maintenance records
- manufacturer or vendor maintenance specifications
- equipment sanitization records
- media sanitization records
- system security plan
- other relevant documents or records
Interview
- Personnel with system maintenance responsibilities
- personnel with information security responsibilities
- personnel responsible for media sanitization
- system or network administrators
Test
- Organizational processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for systems
- organizational processes for sanitizing system components
- mechanisms supporting or implementing controlled maintenance
- mechanisms implementing sanitization of system components
NIST SP 800-171A, potential assessment methods and objects for 3.7.3.
Evidence
No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.
Scoring weight
Worth 1 point. Not meeting this requirement subtracts 1 from your 110-point SPRS score.
DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.
In Rev. 3
Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is withdrawn and incorporated elsewhere: 03.08.03 Media Sanitization.
See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.
Related requirements
Where this page's facts come from
- Requirement text
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
- Discussion
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
- Practice name
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
- Objectives
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Examine, interview, test
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
- Level
- bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
- Weight
- bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
- Rev. 3 mapping
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Plain-language title and summary
- editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)