DKDavid Koran& Associates
Home The CMMC Guide Part III · Media Protection MP.L2-3.8.5
The CMMC Guide · Media Protection Family

MP.L2-3.8.5  Control and Track Media in Transport

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Family
Media ProtectionMP, 9 requirements
Point Value
1Lower weight, but not POA&M exempt
POA&M Eligible
YesOne-point requirement, may be deferred
Objectives
TwoPer NIST SP 800-171A

1Overview

MP.L2-3.8.5 protects media when it travels. It requires that the organization control access to media containing CUI and maintain accountability for it during transport outside controlled areas, so that media in transit is neither exposed nor lost track of. It is a one-point requirement and may be deferred on a plan of action.

Media is most vulnerable when it leaves controlled areas: carried between sites, shipped, or taken off-site, it passes beyond the physical protections of the facility. This control requires two things during that transport: controlling access, so only authorized people can reach the media, and maintaining accountability, so the organization knows where the media is and who has it. Together they keep media in transit from being exposed or quietly disappearing.

The requirement · NIST SP 800-171 Rev 2, 3.8.5

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

The requirement applies specifically to transport outside controlled areas and has two parts. Controlling access means the media is handled so that only authorized people can reach it during transport. Maintaining accountability means tracking the media, through custody records or similar, so its location and handling are known throughout. The two assessment objectives correspond to access control and accountability during transport.

2The Assessment Objectives

NIST SP 800-171A decomposes 3.8.5 into two objectives: control access during transport and maintain accountability during transport.

[a]

Access to media containing CUI is controlled. Only authorized people can reach media containing CUI, whether it is stored in the facility or moving outside controlled areas.

MeetsAccess to media containing CUI is controlled wherever it is, so only authorized people can reach it.
FailsMedia containing CUI is accessible to anyone, whether in storage or in transit.
[b]

Accountability for media containing CUI is maintained during transport outside of controlled areas. The media is tracked in transit.

MeetsAccountability is maintained, through custody records or tracking, so the media's location is known.
FailsMedia is transported with no record of where it is or who has it.

The two objectives are access control and accountability during transport. The common gap is at objective [b], accountability, where media is sent without any custody record, so a loss is not even noticed. The assessor looks for both controlled access and maintained accountability during transport.

3Failure Patterns

The failures are about untracked or exposed media in transit.

No custody tracking

Media transported with no record of who has it or where it is cannot be accounted for, so a loss goes unnoticed. Custody records maintain accountability during transport.

Media exposed in transit

Media left accessible during transport, such as unattended in a vehicle, can be taken. Controlling access keeps it reachable only by authorized people.

Informal transport without controls

Carrying media off-site casually, with neither access control nor accountability, leaves both objectives unmet. A defined transport process applies both.

The common root
This control fails when media leaves the facility without the controls that travel with it. Outside controlled areas the facility's protections no longer apply, so unless access is controlled and accountability maintained during transport, media can be exposed or lost with no one the wiser.

4Ownership

This is an operations-owned control tied to how media is transported.

RoleResponsibility for this control
Operations and CUI handlersControl access to media and maintain accountability during transport. Own the custody records.
Security or compliance leadConfirms transport controls apply both access control and accountability.
Program leadDefines the transport process and retains the records.
See also: This control extends the protection of MP.L2-3.8.1 to transport and works with the encryption of MP.L2-3.8.6 for digital media in transit.

5Tooling

The control is delivered by controlled handling and custody tracking during transport.

ObjectivesToolingWhat it provides
[a]Controlled handling, secured containersAccess to media limited to authorized people during transport.
[b]Custody records, tracked shippingAccountability for media throughout transport.

The caveat is that both access control and accountability have to apply throughout transport, not just at the ends. Media handed off without custody records loses accountability mid-transit, and media left accessible loses access control. The assessor examines both during transport, so the controls have to travel with the media.

6Evidence

The satisfied version of 3.8.5 shows access controlled and accountability maintained in transit.

EvidenceWhat it demonstrates
Transport processObjectives [a], [b]. Controlled access and accountability during transport.
Custody recordsObjective [b]. Accountability for media in transit.

The evidence should show access controlled and accountability maintained for media during transport outside controlled areas. The transport process and custody records are the clearest demonstration of the control.

Media in transit is media outside your protections

Once media leaves controlled areas the facility's safeguards no longer apply, so this control asks for controlled access and maintained accountability during transport. Building a transport process with custody tracking is part of the onsite readiness work this practice does.

Start CMMC Readiness or call 802-335-2662

7Sources

  1. NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.8.5. csrc.nist.gov
  2. NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.8.5[a] and 3.8.5[b]. csrc.nist.gov
  3. 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov
← Previous in Media Protection
MP.L2-3.8.4 · Mark Media
Next in Media Protection →
MP.L2-3.8.6 · Encrypt CUI on Media in Transport
About the Author
David W. Koran is a CyberAB Registered Practitioner Advanced and the author of The CMMC Decision, now in its second edition. He works onsite with defense contractors and their counsel, from the first leadership briefing through the pre-assessment review. Reach him at 802-335-2662 or dkoran@davidkoran.com.
Entry MP.L2-3.8.5 · Edition 2026.1 · Last reviewed July 12, 2026