NIST & CMMC Compliance · · 3 min read
What Are the NIST SP 800-88r2 Chain of Custody Requirements for Off-Site Media Transport?
Direct Answer
NIST SP 800-88r2 covers media sanitization rather than a standard transport checklist. For off-site processing, identify each device before release, record custody transfers, and match delivery records to the sanitization paperwork. Choose locks, seals, shielding, and tracking to suit the risk. A transport record does not, by itself, demonstrate sanitization or CMMC compliance.
Know exactly what is leaving
Before pickup, record each device's manufacturer, model, serial number, and owner reference. Link it to its enclosure and seal number. Note who releases it, who receives it, the time, and the destination.
Use that same inventory at delivery. A missing device or a seal that does not match needs to be investigated before anyone signs a clean receipt.
- Use unique inventory references, not descriptive labels alone.
- Record every custody transfer, including approved exceptions.
- Keep sensitive device and customer details out of public tracking links.
Let the information's sensitivity guide the plan
FIPS 199 categorizes federal information and systems by the potential impact of losing confidentiality, integrity, or availability. Confidentiality also informs sanitization decisions under NIST SP 800-88r2. Establish the applicable category and contractual controls before the devices move.
A low, moderate, or high designation describes impact. It is not a transport certification, and following this briefing does not establish CMMC assessment status.
Choose controls that address the actual risk
Locked enclosures, tamper seals, and restricted key access should follow the risk assessment. RF or Faraday shielding may make sense for wireless-capable devices or a specific threat, but SP 800-88r2 does not require it for every shipment. GPS and environmental monitoring can help explain where a device went and how it was handled. They do not replace a signed custody record.
- Agree who may open an enclosure and how access is recorded.
- Document tracker outages, seal changes, and handling exceptions.
- Test shielding and tracker compatibility: shielding can prevent a tracker from transmitting.
Connect custody evidence to the Certificate of Sanitization
At delivery, match the device identifiers and custody receipts to the sanitization provider's records. Those records should cover the method, verification, validation, disposition, and authorization. Revision 2 includes a sample Certificate of Sanitization.
Keep the distinction clear: a receipt proves delivery, not sanitization. A transport receipt or certificate of transit cannot stand in for the provider's sanitization record.
Frequently Asked Questions
Does NIST SP 800-88r2 require GPS or Faraday shielding during every transport?
No. SP 800-88r2 concerns media sanitization. GPS, environmental monitoring, shielding, and enclosure specifications should follow the organization's risk assessment and applicable contractual or regulatory controls.
Is a chain-of-custody receipt a Certificate of Sanitization?
They serve different purposes. A custody receipt records possession and handover. Sanitization documentation identifies the media, the process used, verification and validation, the people responsible, and the final disposition. The two records should match, but one does not replace the other.
Does secure transport establish CMMC compliance?
Secure transport can support applicable media-protection practices. CMMC requirements, assessment scope, and contractual obligations still need to be evaluated separately. No transport method alone confers certification.