1Overview
MP.L2-3.8.1 opens the Media Protection family with the core requirement to protect media holding CUI. It requires that the organization physically control and securely store system media containing CUI, both paper and digital, so that the data on that media is safeguarded wherever it lives. It is a three-point requirement that cannot be deferred on a plan of action.
CUI does not only live on servers; it lives on paper printouts, USB drives, backup disks, and other media that can be picked up and carried away. This control extends protection to that media, requiring both physical control, so media does not go missing or fall into the wrong hands, and secure storage, so it is kept somewhere protected when not in use. It covers both paper and digital, because a printed document with CUI needs protecting as much as a drive does. Its three-point weight reflects that unprotected media is one of the simplest ways CUI leaves the organization.
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
The requirement defines protection as two things applied to both media types. Physical control means the media is accounted for and not left where anyone could take it; secure storage means it is kept in a protected place, such as a locked cabinet or a secured area, when not in use. Applying both to paper and digital media gives the four assessment objectives, and the point is that CUI on any medium is controlled and stored securely.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.8.1 into four objectives: physically control paper and digital media, and securely store paper and digital media.
Paper media containing CUI is physically controlled. Printed CUI is accounted for and not left exposed.
Digital media containing CUI is physically controlled. Drives and disks with CUI are accounted for.
Paper media containing CUI is securely stored. Printed CUI is kept in a protected place.
Digital media containing CUI is securely stored. Media with CUI is kept in a protected place.
The four objectives pair physical control and secure storage across paper and digital. The common gap is at objectives [a] and [c], paper media, which is easy to overlook because printouts feel less like data than a drive does. The assessor looks for both control and storage across both media types.
3Failure Patterns
The failures are about media, especially paper, left unprotected.
Printouts left in the open
Printed CUI left on desks, at printers, or in unlocked storage is one of the most common media failures, because paper feels less like sensitive data. Controlling and securely storing paper CUI closes this.
Unsecured digital media
USB drives and disks with CUI left unattended can be taken in a moment. Physical control and secure storage keep digital media accounted for.
Control without storage
Media that is controlled during use but not stored securely afterward is exposed when idle. Both the control and the secure storage are required.
No clean-desk practice
Without a practice of securing CUI when stepping away, media accumulates in the open. A clean-desk and secure-storage habit supports both physical control and storage.
4Ownership
This is an operations-owned control that involves everyone who handles CUI on media.
| Role | Responsibility for this control |
|---|---|
| Operations and facilities | Provides secure storage for media and supports physical control of paper and digital CUI. Owns the storage evidence. |
| All CUI handlers | Control and securely store the media they use, following clean-desk and secure-storage practice. |
| Security or compliance lead | Confirms both paper and digital media are controlled and stored securely. |
5Tooling
The control is largely physical: secure storage and controlled handling of media.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a], [b] | Clean-desk practice, controlled handling | Physical control of paper and digital media. |
| [c], [d] | Locked cabinets, secured storage areas | Secure storage of paper and digital media when not in use. |
The caveat is that paper media needs the same protection as digital, which is where the control most often slips. Secure storage and controlled handling have to cover printouts as well as drives. The assessor examines both media types for control and storage, so paper CUI has to be treated with equal care.
6Evidence
The satisfied version of 3.8.1 shows both media types controlled and securely stored.
| Evidence | What it demonstrates |
|---|---|
| Media handling practice | Objectives [a], [b]. Physical control of paper and digital media. |
| Secure storage | Objectives [c], [d]. Media stored securely when not in use. |
The evidence should show paper and digital media containing CUI both physically controlled and securely stored. The handling practice and secure storage covering both media types are the clearest demonstration, and because this control cannot sit on a plan of action, the protection has to be real at the time of assessment.
A printout of CUI needs the same care as a drive
CUI lives on paper and media that can be carried away, and this three-point control asks for physical control and secure storage of both, where paper is the piece most often overlooked. Building media handling and secure storage into daily practice is part of the onsite readiness work this practice does, and it is one of the controls that must be met rather than deferred.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.8.1. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.8.1[a] through 3.8.1[d]. csrc.nist.gov
- 32 CFR 170.24, CMMC Scoring Methodology, listing MP.L2-3.8.1 among the three-point basic security requirements. ecfr.gov