MP.L2-3.8.4
Media Markings
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.4 in the reference catalog with its NIST cross-references
Official requirement
Mark media with necessary CUI markings and distribution limitations.
Assessment objectives
a. media containing CUI is marked with applicable CUI markings; and
b. media containing CUI is marked with distribution limitations.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Mark media with the applicable controlled-information markings and distribution limitations.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You were recently contacted by the project team for a new DoD program. The team said they wanted the CUI in use for the program to be properly protected. When speaking with them, you realize that most of the protections will be provided as part of existing enterprise cybersecurity capabilities. They also mentioned that the project team will use several USB drives to share specific data. You explain that the team must ensure the USB drives are externally marked to indicate the presence of CUI [a]. The project team labels the outside of each USB drive with an appropriate CUI label following NARA guidance [a] . Further, the labels indicate that distribution is limited to those employees supporting the DoD program [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media marking; physical and environmental protection policy and procedures; system security plan; list of system media marking security attributes; designated controlled areas; other relevant documents or records
Common mistakes
Using a generic sensitive label that omits applicable markings or limitations.