NIST 800-171 Control 3.8.5: Media Accountability
Media containing Controlled Unclassified Information (CUI) requires strict access controls and accountability measures, especially during transport outside secure facilities. Control 3.8.5 ensures your organization tracks and protects sensitive data on physical and removable media throughout its lifecycle. Non-compliance exposes your business to data breaches, regulatory penalties, and loss of customer trust.
What this means
Control 3.8.5 requires you to restrict who can access media holding CUI and maintain a documented chain of custody when that media moves beyond your controlled environment. This includes physical tracking, access logs, and accountability mechanisms that prove who handled the media, when, and for what purpose. The control applies to all storage media—including hard drives, USB devices, tapes, and optical media—whether in transit or temporary storage locations.
How to comply
- 1.Classify all media containing CUI and mark it appropriately with security labels
- 2.Establish and enforce access controls limiting media handling to authorized personnel only
- 3.Create a media inventory system documenting all CUI-containing media and storage locations
- 4.Implement chain-of-custody procedures requiring sign-offs for media transport outside controlled areas
- 5.Maintain detailed logs recording who accessed media, when, and the purpose of access
- 6.Require secure packaging and tracking (e.g., tamper-evident seals) for media in transit
- 7.Establish protocols for media destruction or secure return to controlled storage
- 8.Conduct regular audits of media accountability records and physical media inventories
Evidence auditors look for
- Media inventory spreadsheet with CUI classification status and current location
- Access control policies restricting media handling to specific job roles
- Chain-of-custody forms signed by handlers during media transport
- Media transport logs showing date, time, handler, destination, and return confirmation
- Physical inspection records documenting condition of media before and after transport
- Access logs from systems where media was connected or read
- Media destruction certificates for decommissioned or obsolete storage devices
- Audit reports showing periodic verification of media locations and accountability
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates media inventory tracking, generates chain-of-custody forms, and alerts you when CUI-containing devices leave your control perimeter—eliminating manual spreadsheets and ensuring 3.8.5 accountability is audit-ready.
See how GRCWatch handles this control automatically
Start free trial