Media Protection (MP.L2-3.8.1): Secure Your CUI Storage
Controlled Unclassified Information (CUI) stored on paper and digital media requires physical protection and secure storage to prevent unauthorized access. This CMMC Level 2 control ensures your organization prevents data breaches at the physical layer—a critical gap many SMBs overlook. Proper media protection separates compliant organizations from breach-prone ones.
What this means
Media Protection requires you to physically control and securely store all information system media that contains CUI, whether in paper or digital form. This means implementing access controls to prevent unauthorized personnel from handling sensitive documents or storage devices, maintaining secure storage locations (locked cabinets, restricted rooms), and tracking media inventory. The control addresses the reality that data breaches often start with physical theft or misplaced documents.
How to comply
- 1.Identify all media containing CUI across your organization—including hard drives, USB devices, backup tapes, printed documents, and external storage
- 2.Establish physical storage locations with restricted access, such as locked cabinets, safes, or controlled server rooms
- 3.Implement access logs and authentication requirements for media retrieval and use
- 4.Create and enforce a media labeling system to clearly mark CUI-containing materials
- 5.Develop procedures for secure media transportation, especially when moving materials off-site
- 6.Document and maintain an inventory of all CUI-containing media with storage locations
- 7.Train employees on proper handling, storage, and protection of CUI media
- 8.Establish secure media destruction procedures for end-of-life materials
Evidence auditors look for
- Photographs or video of locked storage areas housing CUI media with access control signage
- Media inventory spreadsheet with location, contents, and storage conditions documented
- Access logs showing who retrieved media, when, and for what purpose
- Security labels or stickers applied to CUI-containing materials
- Procedures document detailing media protection, storage, and destruction protocols
- Training records showing employee completion of media protection awareness
- Delivery receipts or signed statements confirming secure transport of CUI media
- Media destruction certificates from certified destruction vendors
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates media inventory tracking, access logging, and destruction workflows—eliminating manual spreadsheets and giving you audit-ready evidence for MP.L2-3.8.1 in minutes.
See how GRCWatch handles this control automatically
Start free trial