MP.L2-3.8.5
Media Accountability
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee MP.L2-3.8.5 in the reference catalog with its NIST cross-references
Official requirement
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Assessment objectives
a. access to media containing CUI is controlled; and
b. accountability for media containing CUI is maintained during transport outside of controlled areas.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control access to media containing controlled information during transport and maintain accountability.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your team has recently completed configuring a server for a DoD customer . The customer has asked that it be ready to plug in and use. An application installed on the server contains data that is considered CUI. You box the server for shipment using tamper-evident packaging and label it with the specific recipient for the shipment [b]. You select a reputable shipping service so you will get a tracking number to monitor the progress. Once the item is shipped, you send the recipients the tracking number so they can monitor and ensure prompt delivery at their facility.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System media protection policy; procedures addressing media storage; physical and environmental protection policy and procedures; access control policy and procedures; system security plan; system media; designated controlled areas; other relevant documents or records
Common mistakes
Recording shipment without establishing who controls the media during transit.