Equipment Sanitization

The laptop sent out for repair is the scenario this requirement exists for.

Before any device that has held CUI, Controlled Unclassified Information, leaves your control for repair, the CUI comes off. Whoever works on it has the whole drive regardless of account passwords, so sanitize first or the device does not ship.

Sanitize means the data is gone, not locked.

Account passwords, multifactor authentication, and a login screen are access controls, and they do not satisfy [a]. Follow NIST SP 800-88: overwrite the media, purge it, cryptographically erase it by destroying the encryption keys, or destroy the media outright. Disk encryption with the keys intact is protection, not sanitization.

When you cannot wipe it, remove or destroy the storage.

A dead drive cannot be overwritten. Pull the drive and ship the chassis, destroy the failed drive and forfeit the warranty return, or buy the warranty terms that let you keep failed media. Decide which before the failure, because the vendor's return label does not wait on a policy discussion.

Cloud-managed devices have a one-step answer.

For a laptop enrolled in Microsoft Intune, the cloud service that manages your devices, a remote wipe or Autopilot reset before it ships removes the data. Capture the wipe confirmation as the record.

Keep a sanitization record per device.

Record the date, device, serial number, method, and who did it. The record turns a claim of sanitizing into evidence for [a], and the assessment guide's examine list names equipment sanitization records outright.