MP.L2-3.8.2: Media Access Control for CMMC Level 2
Media access control is a critical safeguard for protecting Controlled Unclassified Information (CUI) stored on physical and digital media. MP.L2-3.8.2 requires you to restrict access to CUI on information system media—including removable storage, backups, and archived data—to only authorized personnel. Without proper controls, removable media and improperly managed storage devices become a direct pathway for data breaches.
What this means
This control mandates that your organization establish and enforce technical and administrative procedures to ensure only authorized users can access CUI stored on any form of media. This includes: USB drives, external hard drives, optical media, tape backups, cloud storage, and mobile devices. Access restrictions must be enforced through both physical and logical controls, ensuring that even if unauthorized personnel obtain the media, they cannot read or extract the data.
How to comply
- 1.Classify and inventory all media that stores or could store CUI within your systems
- 2.Implement logical access controls (encryption, password protection, role-based permissions) on all media containing CUI
- 3.Use full-disk or file-level encryption for removable media and portable devices
- 4.Establish a media labeling system that clearly marks CUI storage media
- 5.Restrict physical access to media storage areas with locked cabinets or secure rooms
- 6.Implement audit logging to track who accesses CUI on media and when
- 7.Define authorization workflows and maintain documentation of approved users per media or system
- 8.Conduct periodic reviews of media access lists to remove terminated or transferred employees
Evidence auditors look for
- Media inventory spreadsheet with CUI designations and authorized user lists
- Encryption software deployment records and configuration screenshots
- Physical security documentation (locked storage photos, access badges, sign-in logs)
- System access logs showing user authentication and file access timestamps
- Media labeling standards document and labeled media samples
- Access control matrix showing roles, media types, and permissions
- Change management records for media access approval workflows
- Annual user access review sign-offs from department managers
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates media access inventory, encryption verification, and periodic access reviews—eliminating manual tracking and reducing the audit work needed to prove MP.L2-3.8.2 compliance.
See how GRCWatch handles this control automatically
Start free trial