Control access to media containing CUI and maintain accountability for media
📖 What This Means
This practice means that organizations must ensure only authorized personnel can access media (like USB drives, hard drives, or CDs) that contain Controlled Unclassified Information (CUI). It also requires keeping track of who accesses this media and when. Think of it as locking up sensitive documents in a filing cabinet and keeping a log of who checks them out. For example, if a contractor uses a USB drive to transfer CUI, they must log its use and ensure it’s securely stored afterward. This control helps prevent unauthorized access or loss of sensitive information.
🎯 Why It Matters
Uncontrolled access to CUI media can lead to data breaches, exposing sensitive defense information. For instance, in 2019, a contractor lost a USB drive containing classified plans, costing millions in damages and reputational harm. This control mitigates such risks by ensuring only authorized users handle media and that its use is tracked. From a DoD perspective, this is critical for safeguarding national security information. Non-compliance can result in contract loss, fines, or legal action.
✅ How to Implement
- 1. Use cloud storage solutions with built-in access controls, like AWS S3 bucket policies or Azure Blob Storage.
- 2. Enable logging and monitoring for all media-related activities (e.g., AWS CloudTrail or Azure Monitor).
- 3. Encrypt all media stored in the cloud using services like AWS KMS or Azure Key Vault.
- 4. Restrict access to media via role-based access control (RBAC).
- 5. Regularly audit access logs to ensure compliance.
📋 Evidence Examples
Media Access Logs
Encryption Configuration Screenshots
Media Inventory Report
Audit Report
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For MP.L2-3.8.5 ("Control access to media containing CUI and maintain accountability for media"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how CUI on media is protected throughout its lifecycle, including encryption, access controls, marking, transport procedures, sanitization methods, and accountability tracking. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"MP.L2-3.8.5 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to control access to media containing cui and maintain accountability for media. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"MP.L2-3.8.5 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to control access to media containing cui and maintain accountability for media. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"MP.L2-3.8.5 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all removable media types within the CUI boundary
- • Document media storage locations (on-site, off-site)
- • Specify media sanitization and destruction methods
- • Ensure this control covers all systems within your defined CUI boundary where control access to media containing cui and maintain accountability for media applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Media Protection Policy
- 📄 Media inventory database
- 📄 Certificates of destruction
- 📄 Transport chain-of-custody records
- 📄 Evidence artifacts specific to MP.L2-3.8.5
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will check for CUI markings on media, verify encryption is enabled, review the media inventory for completeness, and examine destruction certificates.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a system to track access to media containing CUI?
Question 2: Is all CUI media encrypted?
Question 3: Are access logs reviewed regularly?
Question 4: Is media stored securely when not in use?
Question 5: Are personnel trained on media handling policies?
⚠️ Common Mistakes (What Auditors Flag)
1. Missing media access logs.
2. Unencrypted media.
3. Inconsistent media labeling.
4. No secure storage for media.
5. Untrained personnel.
📚 Parent Policy
This practice is governed by the Media Protection Policy