The Five-Point Problem
THE CRUNCH · EP 02
TAP TO PAUSE
PAUSED — TAP TO RESUME
In the DoD Assessment Methodology, every NIST 800-171 requirement carries a weight: one, three, or five points. Five-point controls are the ones whose absence creates direct, exploitable exposure of CUI — and two of them are about your retired hardware.
MP.L2-3.8.3 requires media containing CUI to be sanitized or destroyed before disposal or reuse. MP.L2-3.8.7 requires control over removable media. Both are five-pointers, and under the CMMC final rule, five-point requirements cannot be deferred to a Plan of Action and Milestones.
That means on assessment day, your disposition program is either fully implemented and evidenced, or the requirement is NOT MET — with Phase 2 C3PAO certification arriving in new CUI contracts on November 10, 2026.
The 90-day readiness plan in our guide sequences the whole disposition workstream, and the checklist gives your team the working tool.