DKDavid Koran& Associates
Home The CMMC Guide Part III · Media Protection MP.L2-3.8.4
The CMMC Guide · Media Protection Family

MP.L2-3.8.4  Mark Media

Mark media with necessary CUI markings and distribution limitations.

Family
Media ProtectionMP, 9 requirements
Point Value
1Lower weight, but not POA&M exempt
POA&M Eligible
YesOne-point requirement, may be deferred
Objectives
TwoPer NIST SP 800-171A

1Overview

MP.L2-3.8.4 makes CUI on media visible as CUI. It requires that media be marked with the necessary CUI markings and any distribution limitations, so that anyone handling the media knows it contains controlled information and how it may be shared. It is a one-point requirement and may be deferred on a plan of action.

Protection depends on people knowing what they are handling. Media that contains CUI but carries no marking looks like any other media, and it may be shared, stored, or disposed of carelessly because no one recognizes it as sensitive. This control requires that media be marked with the applicable CUI markings and with distribution limitations, so the marking itself signals both the sensitivity and the rules for sharing. It is what turns unmarked media into media people know to protect.

The requirement · NIST SP 800-171 Rev 2, 3.8.4

Mark media with necessary CUI markings and distribution limitations.

The requirement has two parts: CUI markings, which identify the media as containing controlled information, and distribution limitations, which state how it may be shared. Both have to appear on the media, so a person encountering it knows it is CUI and knows the constraints on distributing it. Marking follows the applicable CUI marking guidance, and the two assessment objectives correspond to the markings and the distribution limitations.

2The Assessment Objectives

NIST SP 800-171A decomposes 3.8.4 into two objectives: mark with CUI markings and mark with distribution limitations.

[a]

Media containing CUI is marked with applicable CUI markings. The media is identified as containing CUI.

MeetsMedia is marked with the applicable CUI markings, so it is recognized as CUI.
FailsMedia containing CUI carries no markings.
[b]

Media containing CUI is marked with distribution limitations. The media states how it may be shared.

MeetsMedia carries the applicable distribution limitations.
FailsMedia lacks any distribution limitation marking.

The two objectives are the CUI markings and the distribution limitations. The common gap is media that is protected physically but never marked, so its sensitivity depends on memory rather than a visible label. The assessor looks for both markings on media containing CUI.

3Failure Patterns

The failures are about unmarked media and missing distribution limitations.

Media not marked as CUI

Media containing CUI that carries no marking looks ordinary, so it may be mishandled by people who do not know it is sensitive. Applying the CUI markings makes the sensitivity visible.

No distribution limitations

Markings that identify CUI but omit distribution limitations leave the sharing rules unstated. Both the CUI markings and the distribution limitations are required.

Inconsistent marking

Marking some media but not others leaves unmarked CUI that people will not recognize. Marking has to be applied consistently to media containing CUI.

The common root
This control fails when CUI on media is invisible as CUI. People protect what they recognize as sensitive, and unmarked media relies on memory rather than a visible signal, so it gets handled like ordinary media. Marking is what tells everyone who touches the media to treat it as controlled.

4Ownership

This is an operations and compliance-owned control that involves everyone who creates media with CUI.

RoleResponsibility for this control
Security or compliance leadDefines the applicable CUI markings and distribution limitations and confirms media is marked. Owns the marking guidance.
All CUI handlersMark the media they create with the required CUI markings and distribution limitations.
Program leadIncludes marking in CUI handling practice and retains examples.
See also: This control supports the protection of MP.L2-3.8.1 by making CUI recognizable and works with the transport controls of MP.L2-3.8.5.

5Tooling

The control is delivered by applying CUI markings and distribution limitations to media, following marking guidance.

ObjectivesToolingWhat it provides
[a]CUI marking guidance and labelsApplicable CUI markings on media.
[b]Distribution limitation markingsThe sharing constraints on the media.

The caveat is that marking has to follow the applicable CUI guidance and be applied consistently. Markings that are inconsistent or omit distribution limitations leave gaps, so the marking has to be complete across media containing CUI. The assessor examines media for both markings, so consistent, complete marking is what demonstrates the control.

6Evidence

The satisfied version of 3.8.4 shows media marked with CUI markings and distribution limitations.

EvidenceWhat it demonstrates
Marked media examplesObjectives [a], [b]. Media carries CUI markings and distribution limitations.
Marking guidanceObjectives [a], [b]. The applicable markings and limitations.

The evidence should show media containing CUI marked with both the applicable CUI markings and distribution limitations. Marked media examples and the marking guidance are the clearest demonstration of the control.

People protect what they recognize as sensitive

Unmarked media containing CUI looks ordinary and gets handled that way, so this control asks for CUI markings and distribution limitations that make the sensitivity visible. Building consistent marking into CUI handling is part of the onsite readiness work this practice does.

Start CMMC Readiness or call 802-335-2662

7Sources

  1. NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.8.4. csrc.nist.gov
  2. NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.8.4[a] and 3.8.4[b]. csrc.nist.gov
  3. 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov
← Previous in Media Protection
MP.L2-3.8.3 · Sanitize or Destroy Media
Next in Media Protection →
MP.L2-3.8.5 · Control and Track Media in Transport
About the Author
David W. Koran is a CyberAB Registered Practitioner Advanced and the author of The CMMC Decision, now in its second edition. He works onsite with defense contractors and their counsel, from the first leadership briefing through the pre-assessment review. Reach him at 802-335-2662 or dkoran@davidkoran.com.
Entry MP.L2-3.8.4 · Edition 2026.1 · Last reviewed July 12, 2026