NIST 800-53 REV 5 • MEDIA PROTECTION
MP-8(3) — Controlled Unclassified Information
Downgrade system media containing controlled unclassified information prior to public release.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
The downgrading of controlled unclassified information uses approved sanitization tools, techniques, and procedures.
Practitioner Notes
CUI media must be properly sanitized before it can be released to the public or downgraded for use in environments that do not protect CUI. Follow NIST SP 800-88 guidance for the appropriate sanitization level.
Example 1: Before releasing any media that previously contained CUI for public use, perform a Purge-level sanitization per NIST SP 800-88. Verify the sanitization was successful by attempting data recovery. Document the sanitization and verification on your media disposition form.
Example 2: Create a CUI downgrading checklist: identify the CUI categories on the media, select the appropriate sanitization method from NIST 800-88, perform the sanitization, verify, get supervisor approval, re-label the media, and file the record. Include this checklist in your CUI handling procedures.