What is involved in CUI media sanitization?

• A. Sanitizing or destroying media containing CUI (hard drives, USBs, etc.) with approved methods before reuse or disposal
• B. Reformatting without data wipe
• C. Copying to new media
• D. Ignoring

Answer: (A)

CUI media sanitization means ensuring that any storage media that has held controlled unclassified information is made unrecoverable before it is reused or disposed of. This is done by applying approved methods that render or destroy the data, so that no one can recover it.

In practice, you sanitize or destroy drives, USB sticks, SSDs, tapes, and similar media using methods that meet established standards (for example, NIST SP 800-88 and DoD CUI guidance). Sanitation options can include technical clearing or purging to remove data, or physical destruction when the media has no further use. The key is that the method is validated and documented, with proper handling to prevent any data leakage.

Reformatting without a data wipe leaves residual information that can be recovered with common tools, so it does not meet the requirement. Copying data to new media simply transfers the sensitivity risk, rather than mitigating it. Ignoring the issue leaves CUI exposed, which is not acceptable. The correct approach is to use approved sanitization or destruction methods before reuse or disposal.