FCI sanitized before disposal or reuse of digital media

CMMC 2.0 MP.L1-3.8.3 (NIST 800-171r2 3.8.3) requires that FCI is sanitized or destroyed before media is disposed of or reused. In software systems, this translates to hard deletion of user data on account closure, secure cleanup of temporary files after processing, and server-side session invalidation on logout. Soft-delete patterns that only set deleted_at leave FCI in the database indefinitely — accessible to database administrators, backup restores, and potential future bugs that bypass the soft-delete filter. CWE-459 (Incomplete Cleanup) applies when temporary file handles or session records outlive their authorized lifecycle.

Implement hard delete in a transaction that cascades across all user-owned records. Use try/finally to guarantee temporary file cleanup even when processing throws:

// app/api/users/[id]/route.ts
export async function DELETE(req: Request, { params }: { params: { id: string } }) {
  const session = await getServerSession()
  if (!session || session.user.id !== params.id) {
    return Response.json({ error: 'Forbidden' }, { status: 403 })
  }
  await db.$transaction([
    db.document.deleteMany({ where: { userId: params.id } }),
    db.session.deleteMany({ where: { userId: params.id } }),
    db.user.delete({ where: { id: params.id } }),
  ])
  const res = Response.json({ ok: true })
  res.headers.set('Set-Cookie', 'session=; HttpOnly; Max-Age=0; Path=/')
  return res
}

For upload processing in lib/file-processing.ts, write to a temp path and clean up in a finally block — the file is removed whether the processing succeeds or fails. Soft-delete patterns without a scheduled purge job do not satisfy MP.L1-3.8.3.