SR-12 Component Disposal

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: MP-6

Control statement

Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods].

NIST discussion

Data, documentation, tools, or system components can be disposed of at any time during the system development life cycle (not only in the disposal or retirement phase of the life cycle). For example, disposal can occur during research and development, design, prototyping, or operations/maintenance and include methods such as disk cleaning, removal of cryptographic keys, partial reuse of components. Opportunities for compromise during disposal affect physical and logical data, including system documentation in paper-based or digital files; shipping and delivery documentation; memory sticks with software code; or complete routers or servers that include permanent media, which contain sensitive or proprietary information. Additionally, proper disposal of system components helps to prevent such components from entering the gray market.

Assessment objectives (SP 800-53A)

Objectives and methods for SR-12

Determine if [Assignment: organization-defined data, documentation, tools, or system components] are disposed of using [Assignment: organization-defined techniques and methods].

Examine: Supply chain risk management policy and procedures; supply chain risk management plan; disposal procedures addressing supply chain protection; media disposal policy; media protection policy; disposal records for system components; documentation of the system components identified for disposal; documentation of the disposal techniques and methods employed for system components; system security plan; other relevant documents or records.

Interview: Organizational personnel with system component disposal responsibilities; organizational personnel with information security responsibilities; organizational personnel with supply chain protection responsibilities.

Test: Organizational techniques and methods for system component disposal; mechanisms supporting and/or implementing system component disposal.

Policy statement

• The System owner shall dispose of Fill in: data, documentation, tools, or system components to be disposed of Typical: system components, media and devices that hold or have held organizational information, configurations or credentials; system, design and supply chain documentation, including shipping and delivery records; and development, test and maintenance tools using the following techniques and methods: Fill in: techniques and methods for disposing of data, documentation, tools, or system components Typical: sanitization of storage by the method the media sanitization procedure sets for it (MP-6), removal of cryptographic keys, credentials and licenses, destruction of paper documentation by shredding or incineration, and transfer of hardware only to a disposal or recycling provider under contract that certifies destruction or recycling by serial number. (SR-12)
• These techniques and methods shall apply whenever disposal happens in the life cycle, including during development, testing and maintenance. (SR-12)
• Each disposal of a component shall be recorded with the component’s identifiers, the method, who performed and verified it, the date, and the media sanitization record or the provider’s certificate. (SR-12)
• A component shall not be resold, donated or returned to a lessor or vendor unless its storage has been purged or destroyed as the Media Protection Policy requires and the System owner has approved its release. (SR-12)

From the Supply Chain Risk Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SR-12 asks you to dispose of the data, documentation, tools or system components you name using the techniques and methods you name. NIST’s SR-12 discussion says disposal can happen at any point in the life cycle, not only at retirement: during research and development, design, prototyping or operations and maintenance, with methods such as disk cleaning, removal of cryptographic keys and partial reuse of components. Disposal exposes paper and digital system documentation, shipping and delivery records, memory sticks holding code, and whole routers or servers with permanent media, and proper disposal keeps components out of the gray market. SR-12 is in the Low, Moderate and High baselines.

SR-12 reaches further than media sanitization. MP-6 makes the information on media unrecoverable; SR-12 also covers the documentation, tools and hardware that tell an adversary how the system is built and could be reused, resold or counterfeited. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, updated November 1, 2024; current as of October 2026), says IT security, with the supply chain risk management office, can help set the disposal policies, procedures, mechanisms and techniques.

Common implementations. Storage sanitized by the method the media sanitization procedure sets for it and recorded in the media sanitization record. Keys, certificates, credentials and software licenses removed or revoked before a device leaves. Network diagrams, configuration printouts and shipping records shredded. Hardware handed only to a contracted IT asset disposition provider that certifies destruction or recycling by serial number. The component inventory keeps each disposed component with the status “disposed”, the date and the sanitization record or certificate, so the trail from purchase to destruction is complete.

Organization-defined parameters. Typical values, from the Supply Chain Risk Management policy, which your organization may set differently:

Parameter	Typical value
What is disposed of under this control	System components, media and devices that hold or have held organizational information, configurations or credentials; system, design and supply chain documentation, including shipping and delivery records; and development, test and maintenance tools
Disposal techniques and methods	Sanitization of storage by the method the media sanitization procedure sets for it (MP-6), removal of cryptographic keys, credentials and licenses, destruction of paper documentation by shredding or incineration, and transfer of hardware only to a disposal or recycling provider under contract that certifies destruction or recycling by serial number

The policy applies these methods whenever disposal happens in the life cycle, records each disposal with the component’s identifiers, the method, who performed and verified it, the date and the sanitization record or certificate, and allows no resale, donation or return to a lessor or vendor unless the storage has been purged or destroyed and the system owner has approved the release.

Evidence assessors ask for.

• The disposal procedure, and the contract with the disposal or recycling provider
• Disposal records for a sample of components, matched to their media sanitization records or the provider’s certificates by serial number
• Component inventory entries with the status “disposed”, compared with the disposal records
• How documentation and shipping records are destroyed, and how development and test equipment is handled
• Records for any component resold, donated or returned to a lessor, with the sanitization and the approval

Inheritance. Disposal is usually a common control run by IT asset management, with the contracted provider. The system owner makes sure the system’s components, documentation and tools go through it, including equipment from development and test environments. For a cloud service, the provider disposes of its own media; the system relies on the provider’s attestation, reviewed in the external service review, and disposes of what it controls, such as its encryption keys. Record the split in the system security plan.

Common findings.

• Retired equipment stored for months or years with no inventory status and no one accountable for it.
• Disposal certificates that list a count of items rather than serial numbers, so no component can be traced.
• Leased equipment returned, or failed drives exchanged under warranty, without sanitization.
• System documentation and shipping records thrown out with ordinary waste.
• Disposal during development or testing not covered, so prototype hardware and test data leave without control.

Enhancements in the Moderate baseline. SR-12 has no enhancements.

Artifacts

• Supply Chain Risk Management Decision Worksheet
• Supply Chain Risk Management Policy