1Overview
MP.L2-3.8.5 protects media when it travels. It requires that the organization control access to media containing CUI and maintain accountability for it during transport outside controlled areas, so that media in transit is neither exposed nor lost track of. It is a one-point requirement and may be deferred on a plan of action.
Media is most vulnerable when it leaves controlled areas: carried between sites, shipped, or taken off-site, it passes beyond the physical protections of the facility. This control requires two things during that transport: controlling access, so only authorized people can reach the media, and maintaining accountability, so the organization knows where the media is and who has it. Together they keep media in transit from being exposed or quietly disappearing.
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
The requirement applies specifically to transport outside controlled areas and has two parts. Controlling access means the media is handled so that only authorized people can reach it during transport. Maintaining accountability means tracking the media, through custody records or similar, so its location and handling are known throughout. The two assessment objectives correspond to access control and accountability during transport.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.8.5 into two objectives: control access during transport and maintain accountability during transport.
Access to media containing CUI is controlled. Only authorized people can reach media containing CUI, whether it is stored in the facility or moving outside controlled areas.
Accountability for media containing CUI is maintained during transport outside of controlled areas. The media is tracked in transit.
The two objectives are access control and accountability during transport. The common gap is at objective [b], accountability, where media is sent without any custody record, so a loss is not even noticed. The assessor looks for both controlled access and maintained accountability during transport.
3Failure Patterns
The failures are about untracked or exposed media in transit.
No custody tracking
Media transported with no record of who has it or where it is cannot be accounted for, so a loss goes unnoticed. Custody records maintain accountability during transport.
Media exposed in transit
Media left accessible during transport, such as unattended in a vehicle, can be taken. Controlling access keeps it reachable only by authorized people.
Informal transport without controls
Carrying media off-site casually, with neither access control nor accountability, leaves both objectives unmet. A defined transport process applies both.
4Ownership
This is an operations-owned control tied to how media is transported.
| Role | Responsibility for this control |
|---|---|
| Operations and CUI handlers | Control access to media and maintain accountability during transport. Own the custody records. |
| Security or compliance lead | Confirms transport controls apply both access control and accountability. |
| Program lead | Defines the transport process and retains the records. |
5Tooling
The control is delivered by controlled handling and custody tracking during transport.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | Controlled handling, secured containers | Access to media limited to authorized people during transport. |
| [b] | Custody records, tracked shipping | Accountability for media throughout transport. |
The caveat is that both access control and accountability have to apply throughout transport, not just at the ends. Media handed off without custody records loses accountability mid-transit, and media left accessible loses access control. The assessor examines both during transport, so the controls have to travel with the media.
6Evidence
The satisfied version of 3.8.5 shows access controlled and accountability maintained in transit.
| Evidence | What it demonstrates |
|---|---|
| Transport process | Objectives [a], [b]. Controlled access and accountability during transport. |
| Custody records | Objective [b]. Accountability for media in transit. |
The evidence should show access controlled and accountability maintained for media during transport outside controlled areas. The transport process and custody records are the clearest demonstration of the control.
Media in transit is media outside your protections
Once media leaves controlled areas the facility's safeguards no longer apply, so this control asks for controlled access and maintained accountability during transport. Building a transport process with custody tracking is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.8.5. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.8.5[a] and 3.8.5[b]. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov