MP.L2-3.8.1
Media Protection
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.1 in the reference catalog with its NIST cross-references
Official requirement
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Assessment objectives
a. paper media containing CUI is physically controlled;
b. digital media containing CUI is physically controlled;
c. paper media containing CUI is securely stored; and
d. digital media containing CUI is securely stored.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Physically control and securely store media containing controlled information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company has CUI for a specific Army contract contained on a USB drive. You store the drive in a locked drawer , and you log it on an inventory [d]. You establish a procedure to check out the USB drive so you have a history of who is accessing it. These procedures help to maintain the confidentiality, integrity, and availability of the data.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media storage; procedures addressing media access restrictions; access control policy and procedures; physical and environmental protection policy and procedures; system security plan; media storage facilities; access control records; other relevant documents or records
Common mistakes
Protecting servers while leaving removable media or paper records unsecured.