CUI media disposal for Ohio's aerospace and defense supply chain
A machine shop in Springfield, a composites supplier in Newark, a wire harness maker outside Dayton: the primes flow CMMC down to all of them, and every one has a drawer of old drives that held drawings. Here is how a small supplier retires CUI media in an afternoon, and what to keep for the affirmation.
What the rules require
- NIST SP 800-171, requirement 3.8.3Sanitize or destroy system media containing CUI before disposal or reuse. This is the requirement your prime's flow-down and your own SPRS affirmation rest on.
- CMMC Level 2 self-assessmentWith third-party assessments suspended since July 2026, a senior official at your company signs the affirmation. The media disposal record is one of the things that signature vouches for.
- DFARS 252.204-7012 and 7021The clauses in your contract that require NIST 800-171 and CMMC. Both are still in force regardless of the Phase 2 pause.
- 32 CFR 2002CUI is unclassified and may travel by tracked carrier, which is why Shred by Mail works for a supplier with a handful of drives.
How we handle it
Most suppliers do not have enough media to need the truck. Count the drives, log the serials, ship them in tamper-evident packaging through Shred by Mail, and you have a Certificate of Destruction with every serial number within five business days. Past about fifty items, or when your prime wants witnessed destruction, the truck comes to you next-day in most of Ohio.
Solid-state media goes to 2 mm. That is not required by NIST for CUI, but it removes the question of whether a chip survived, and it is what we recommend when the data was drawings and process sheets a competitor would pay for.
We hold CMMC Level 1 ourselves, self-assessed and affirmed in SPRS, so the vendor holding your CUI media is inside the same program you are. Download the disposal record template below, fill it as you go, and attach it to your System Security Plan; the certificate we issue matches it line for line.
“Mansfield Technologies did an absolutely professional job grinding up a solid state drive for me per NIST and NSA/CSS policy. I highly recommend this company. I am extremely happy with them. They have the right equipment and the right people to get the job done right. You can fully trust them when you are in a pinch.”
Download
- CUI media disposal record (Excel). The columns an assessor expects, with an example row and instructions, ready to attach to your SSP. Download the template.
Where we do it
Dayton, Springfield, Newark and Heath, Lima, Columbus, Cincinnati, Cleveland, Akron, Fort Wayne, Warren and Sterling Heights, and everywhere else we go.
Read next
Questions from aerospace and defense suppliers
We have twelve old laptops with drawings on them. What do we do?
Log the serials, box them, and ship them through Shred by Mail with tamper-evident tape: whole laptops are $16 each with the drive destroyed to 2 mm and the chassis recycled. The certificate arrives within five business days, and the disposal record template on this page is the SSP attachment.
Does this satisfy our prime's flow-down?
It satisfies NIST 800-171 requirement 3.8.3, which is what the flow-down requires. Keep the certificate and your disposal record together; that is what an assessor or your senior official asks for.
Do we need the 2 mm standard for CUI?
NIST does not require it for CUI, but we recommend it for solid-state media because it removes the verification question. It is a $4 difference per SSD by mail.
Can you help us write the media sanitization policy?
Yes. Our technical consultation covers a one-page policy and procedure sized for a small supplier, and a review of what you already have.