Free templates for media protection and data destruction
Policies, System Security Plan language, a disposal record, and a Business Associate Agreement, written to the standards we destroy to and free to use under a Creative Commons Attribution license. Each has a page that explains what is inside, who it is for, and the rules it rests on, so you can decide before you download.
Templates
- A one-page media protection policy for commercial organizations that have elected to protect their information storage media at the High confidentiality impact level: healthcare, financial services, law enforcement, and defense suppliers holding CUI. Read more and download.
- The same one-page policy for organizations that apply the Moderate confidentiality impact level: general business, professional services, manufacturing without CUI, and education without health or financial records. Read more and download.
- Vendor-neutral, paste-ready implementation statements for the NIST SP 800-171 media protection family and the off-site maintenance requirement, written for a CMMC self-assessment or C3PAO assessment. Read more and download.
- A disposal log with the sixteen columns an assessor expects, an example row, drop-down lists for the sanitization method and media type, and an instructions tab. Read more and download.
- A two-page HIPAA Business Associate Agreement written around what a destruction vendor actually does: custody of PHI only between receipt of the media and its destruction, no designated record set, no access to contents, and a ten-business-day breach reporting window. Read more and download.
Reference documents
- A real certificate with the client redacted, and the media log, explained field by field. Download the PDF.
- One page for contracting officers: UEI, CAGE, NAICS, PSC, past performance, equipment, insurance. Download the PDF.
- A one-page summary for public entities: who we are, what a job includes, how to buy. Download the PDF.
License: the templates are published under Creative Commons Attribution 4.0. Use them, adapt them, and keep the attribution line in the footer. They are starting points, not legal or assessment advice.