We've been reviewing our vendor practices and are trying to sort out how to better address the destruction requirements for CUI. We are debating about whether we switch to a single-step destruction and adopt the 1mmx5mm particle size, or whether we stick with our multi-step process and its less stringent requirements.

Thus far, we've used a multi-step process for a variety of reasons. First is that we have about 20 locations around the country, and each uses a different disposal vendor, also each location maintains their vendor relationships. This translates to we don't know exactly what each of our vendors' particle sizes are, but we do know they crosscut shred and then recycle in bulk with other customer materials.

We're going to have each vendor complete a new security questionnaire (being written), but we want to make sure we start with a viable standard.

Along the way, we’ve re-reviewed NIST SP 800-88r1, the 2017 ISOO CUI Notice 2017-02 (2017-08-17), the ISOO CUI Notice 2019-03 (2019-07-15) about destroying CUI, and DCSA CUI destruction guidance version 2 (2020-03-17).

I am advocating that while we could continue to use a multi-step process having a larger particle size than the 1mmx5mm, it would be operationally easier to adopt a more stringent single-step process. Others are advocating continuing what we are doing. Still others agree with me on the single step process and particle size but would rather we purchase shredders for each location and bring it in-house.

Is there a better more comprehensive, more prescriptive document that we should reference?

Does anyone want to share how they are addressing this issue?