1Overview
MP.L2-3.8.4 makes CUI on media visible as CUI. It requires that media be marked with the necessary CUI markings and any distribution limitations, so that anyone handling the media knows it contains controlled information and how it may be shared. It is a one-point requirement and may be deferred on a plan of action.
Protection depends on people knowing what they are handling. Media that contains CUI but carries no marking looks like any other media, and it may be shared, stored, or disposed of carelessly because no one recognizes it as sensitive. This control requires that media be marked with the applicable CUI markings and with distribution limitations, so the marking itself signals both the sensitivity and the rules for sharing. It is what turns unmarked media into media people know to protect.
Mark media with necessary CUI markings and distribution limitations.
The requirement has two parts: CUI markings, which identify the media as containing controlled information, and distribution limitations, which state how it may be shared. Both have to appear on the media, so a person encountering it knows it is CUI and knows the constraints on distributing it. Marking follows the applicable CUI marking guidance, and the two assessment objectives correspond to the markings and the distribution limitations.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.8.4 into two objectives: mark with CUI markings and mark with distribution limitations.
Media containing CUI is marked with applicable CUI markings. The media is identified as containing CUI.
Media containing CUI is marked with distribution limitations. The media states how it may be shared.
The two objectives are the CUI markings and the distribution limitations. The common gap is media that is protected physically but never marked, so its sensitivity depends on memory rather than a visible label. The assessor looks for both markings on media containing CUI.
3Failure Patterns
The failures are about unmarked media and missing distribution limitations.
Media not marked as CUI
Media containing CUI that carries no marking looks ordinary, so it may be mishandled by people who do not know it is sensitive. Applying the CUI markings makes the sensitivity visible.
No distribution limitations
Markings that identify CUI but omit distribution limitations leave the sharing rules unstated. Both the CUI markings and the distribution limitations are required.
Inconsistent marking
Marking some media but not others leaves unmarked CUI that people will not recognize. Marking has to be applied consistently to media containing CUI.
4Ownership
This is an operations and compliance-owned control that involves everyone who creates media with CUI.
| Role | Responsibility for this control |
|---|---|
| Security or compliance lead | Defines the applicable CUI markings and distribution limitations and confirms media is marked. Owns the marking guidance. |
| All CUI handlers | Mark the media they create with the required CUI markings and distribution limitations. |
| Program lead | Includes marking in CUI handling practice and retains examples. |
5Tooling
The control is delivered by applying CUI markings and distribution limitations to media, following marking guidance.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | CUI marking guidance and labels | Applicable CUI markings on media. |
| [b] | Distribution limitation markings | The sharing constraints on the media. |
The caveat is that marking has to follow the applicable CUI guidance and be applied consistently. Markings that are inconsistent or omit distribution limitations leave gaps, so the marking has to be complete across media containing CUI. The assessor examines media for both markings, so consistent, complete marking is what demonstrates the control.
6Evidence
The satisfied version of 3.8.4 shows media marked with CUI markings and distribution limitations.
| Evidence | What it demonstrates |
|---|---|
| Marked media examples | Objectives [a], [b]. Media carries CUI markings and distribution limitations. |
| Marking guidance | Objectives [a], [b]. The applicable markings and limitations. |
The evidence should show media containing CUI marked with both the applicable CUI markings and distribution limitations. Marked media examples and the marking guidance are the clearest demonstration of the control.
People protect what they recognize as sensitive
Unmarked media containing CUI looks ordinary and gets handled that way, so this control asks for CUI markings and distribution limitations that make the sensitivity visible. Building consistent marking into CUI handling is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.8.4. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.8.4[a] and 3.8.4[b]. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov