Certified Cybersecurity Maturity Model Certification (CMMC) Professional (CCP) Practice Exam

Which statement reflects a proper procedure regarding the disposal of media containing sensitive information?

1. Media can be discarded without any precautions

2. Media must be sanitized before being disposed of or reused

3. Media should be recycled rather than disposed of

4. Media can be temporarily shared before disposal

The correct answer is: Media must be sanitized before being disposed of or reused

The statement indicating that media must be sanitized before being disposed of or reused is a critical aspect of data security and privacy. Sanitization refers to the process of removing or destroying sensitive information to ensure that unauthorized individuals cannot access it after the media is no longer needed. When sensitive data, such as personal identifiable information (PII) or classified information, is stored on various media types (e.g., hard drives, USB drives, CDs), it is essential to apply proper sanitization techniques. This could include methods such as physical destruction (shredding or crushing the media), degaussing, or using software-based overwriting methods that render the data unrecoverable. By adhering to the procedure of sanitization, organizations protect themselves from potential data breaches which could lead to financial losses, legal repercussions, and damage to reputation. This practice is not only a best practice but often mandated by regulatory requirements and standards in the cybersecurity landscape. In contrast, discarding media without precautions can easily lead to unauthorized access to sensitive information. Similarly, while recycling may seem environmentally friendly, it does not guarantee the security of data unless proper sanitization occurs beforehand. Sharing media before disposal also opens up vulnerabilities, as it increases the likelihood of sensitive information being inadvertently accessed. Therefore,