EVIDENCE COLLECTION GUIDE • COLLECTING EVIDENCE
Requirement 7: wiping or destroying media before disposal or reuse
KB-034 | Applies to: All plans | Last reviewed: October 1, 2026 | Maintained by AffirmReady Support
Media Protection covers what happens to old computers, hard drives, USB drives, phones, and paper records that contain Federal Contract Information when you throw them away, donate them, or give them to someone else to use.
Who usually collects this
The office manager or owner, with help from your IT provider for wiping devices.
Requirement 7: Wipe or destroy media before disposal or reuse
What you are showing: you have a simple process for disposing of media, and you can show it was followed.
- A short written disposal procedure covering computers, drives, phones, USB drives, and paper. It should say how each is wiped or destroyed and who is responsible.
- A disposal log listing each device or batch disposed of, with the date, device type, serial number if available, method used, and who did it.
- Certificates of destruction or receipts from any shredding, recycling, or IT disposal vendor you use.
- If devices are wiped and reused internally, a note or report from your IT provider showing the wipe was completed before reassignment.
A simple disposal log
You can copy this layout into a spreadsheet and keep it in your evidence folder.
| Date | Item | Serial | Method | Done by |
|---|---|---|---|---|
| 2026-09-15 | Dell laptop | ABC1234 | Drive wiped and reissued | IT provider |
| 2026-09-30 | Paper records, 2 boxes | N/A | Shredding vendor | Office manager |
If you have never disposed of a device that held company information, that is fine. Record the procedure now and start the log the next time it applies.
Checklist
| # | Evidence | Typically from | Collected |
|---|---|---|---|
| 7 | Written disposal procedure | Owner or office | ☐ |
| 7 | Disposal log | Owner or office | ☐ |
| 7 | Vendor certificates or receipts | Owner or office | ☐ |
| 7 | Wipe confirmation for reused devices | IT provider | ☐ |
Where to save it
Save everything from this guide in your own evidence folder under CMMC L1 Evidence / 3 Media Protection, then record the location in AffirmReady for each requirement. AffirmReady does not store evidence files, so your evidence stays in systems your company controls.
Need help?
If you have questions about disposing of devices or records, Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and typically responds within one business day.