# Contractors Manage CUI Device Sanitization

A discussion of control 3.7.3 examines how contractors should handle equipment containing controlled unclassified information (CUI) when it is removed for shipping, repair, reuse, or disposal. Commenters distinguish tracked, encrypted shipment to an organization’s authorized headquarters from maintenance by an outside provider whose personnel could access CUI. They disagree on how the DoD FAQ’s statement that encrypted CUI remains CUI applies during transport and how that interacts with cryptographic erasure; commenters cite NIST SP 800-88 and DoD FAQ B-A8 in support of cryptographic erase when correctly implemented.

- Contractors assessing maintenance procedures should distinguish internal authorized handling from third-party repair that could expose CUI, and avoid providing CUI access to an unqualified service provider.
- For remote equipment failures, commenters recommend device swaps, keeping recovery keys separate from shipped equipment, and using tracked, encrypted transport where applicable.
- Organizations can document their sanitization, shipping, and maintenance procedures—and supporting evidence—in the System Security Plan (SSP) and maintenance records to support control assessments.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 11, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- FedEx ()
- UPS ()
- HP ()
- Dell ()
- Kailash Consult ()

### Key Quotes
> When properly implemented in accordance with National Institute of Standards and Technology Special Publication 800-88, ‘Guidelines for Media Sanitization,’ cryptographic erase is acceptable for sanitation of controlled media before disposal or reuse.
> — Commenter

> The part 3.7.3 actually cares about is who can unlock the drive once it arrives. Keep the BitLocker or FileVault recovery keys escrowed with your own administrators, and never ship a key with the device.
> — Commenter (Kailash Consult)

### Sources
- [How are people handling 3.7.3 - sanitization of removed equipment](https://www.reddit.com/r/CMMC/comments/1xtno7h/how_are_people_handling_373_sanitization_of) - reddit-cmmc