Media Protection covers CUI wherever it is stored on something physical — a printed drawing, a USB drive, a laptop disk, a backup tape. Its nine requirements govern storage, access, marking, transport, sanitization, removable media use and backups.
Organizations tend to treat it as a digital problem and forget that a printout is media too. For manufacturers and engineering firms, paper is often the larger exposure.
What the Media Protection family covers
Media Protection contains 9 requirements, numbered 3.8.1 to 3.8.9 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix MP.L2, so 3.8.1 appears as MP.L2-3.8.1.
The family covers physical control and access (3.8.1, 3.8.2), sanitization (3.8.3), marking (3.8.4), transport (3.8.5, 3.8.6), removable media (3.8.7, 3.8.8) and backups (3.8.9). Marking rules are explained in detail in CUI marking requirements.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.8.1 | Protect (physically control and securely store) system media containing CUI, both paper and digital | 3 | No |
| 3.8.2 | Limit access to CUI on system media to authorized users | 3 | No |
| 3.8.3 | Sanitize or destroy system media containing CUI before disposal or release for reuse | 5 | No |
| 3.8.4 | Mark media with necessary CUI markings and distribution limitations | 1 | Eligible |
| 3.8.5 | Control access to media containing CUI and maintain accountability during transport outside controlled areas | 1 | Eligible |
| 3.8.6 | Implement cryptographic mechanisms to protect CUI on digital media during transport unless otherwise protected | 1 | Eligible |
| 3.8.7 | Control the use of removable media on system components | 5 | No |
| 3.8.8 | Prohibit the use of portable storage devices when such devices have no identifiable owner | 3 | No |
| 3.8.9 | Protect the confidentiality of backup CUI at storage locations | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 23 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.8.3 and 3.8.7. 3.8.1, 3.8.2 and 3.8.8 are worth three points. The remaining 4 are worth one point each.
Three three-point requirements give this family an unusual profile: it can be partially scored more finely than most. The five-point requirements are 3.8.3 (sanitize or destroy before disposal or reuse) and 3.8.7 (control removable media), both of which are straightforward to implement with the right tooling and procedure.
Where media protection fails
No Media Protection requirement appears on the DIBCAC top-ten list. The practical failures are uncontrolled USB ports, printed CUI left in open areas, recycling bins used for controlled documents, and backups that are encrypted in the data center but copied unencrypted to a secondary location.
Sanitization is the other weak point. 3.8.3 expects media to be sanitized or destroyed using a method appropriate to the media; NIST SP 800-88 is the reference most organizations follow. A certificate of destruction from a shredding vendor is good evidence for paper and drives alike. Manufacturers should read the manufacturing guidance on shop-floor drawings.
Implementation priorities for Media Protection
Decide where CUI may be stored on physical media at all, then make every other location impossible or obviously wrong: block or restrict USB storage, provide encrypted company drives for genuine needs, and put locked storage and shredding bins where printed CUI is used. Mark CUI documents and media consistently. Encrypt every backup location. Write a short sanitization procedure that references a recognized standard and keep the certificates.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.8.4, 3.8.5, 3.8.6 and 3.8.9 eligible for deferral.
Four requirements — marking, transport accountability, transport encryption and backup confidentiality — are deferrable. Marking in particular is often done late, but unmarked CUI makes every other media control harder to apply.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- Storage locations and controls for paper and digital media containing CUI.
- Marked examples of CUI documents and media.
- Sanitization procedures and certificates of destruction.
- Removable media policy and technical enforcement settings.
- Transport procedures and encryption for media leaving controlled areas.
- Backup encryption settings for every backup location.
Frequently asked questions
Do we have to block all USB drives?
No, but you must control their use (3.8.7) and prohibit devices with no identifiable owner (3.8.8). Many organizations allow only encrypted, company-issued drives.
Is a printed drawing considered media?
Yes. Paper containing CUI is system media under NIST SP 800-171 and must be protected, marked and destroyed accordingly.
How should CUI paper be destroyed?
By a method that makes it unreadable and unrecoverable, such as cross-cut shredding to a recognized standard or a destruction vendor that provides certificates.
Do backups in the cloud count as media?
Backup data at any storage location falls under 3.8.9, which requires protecting its confidentiality. Cloud backups must be encrypted and, if they hold CUI, hosted in a service that meets DFARS 252.204-7012.