Media Protection

Official Source Material

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

Determine if:

[a] paper media containing CUI is physically controlled;
[b] digital media containing CUI is physically controlled;
[c] paper media containing CUI is securely stored; and
[d] digital media containing CUI is securely stored.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This requirement is about media you can pick up, not the drives fixed inside your computers.

The assessment guide's examples are paper, microfilm, flash drives, external and removable hard drives, tapes, and optical disks. A drive that takes a screwdriver to remove is still system media, but SC.L2-3.13.16 and your physical protection requirements cover its everyday protection. Aim the controls this requirement adds at what moves: inventory the paper and the portable media that hold CUI, the controlled unclassified information your contract requires you to protect.

The four objectives cover two actions across two media types. You control and store, for paper and for digital.

Physically controlled means you know what media exist, where each item is, and who has it, which is an inventory plus a check-out habit. Securely stored means a locked drawer, cabinet, or room that only authorized people can open. Satisfy all four combinations. A locked cabinet with no inventory fails [a] and [b]. An inventory of media left on desks fails [c] and [d].

A locked cabinet and a short inventory carry this requirement for a small shop.

List each item of media that holds CUI, keep the media in a locked drawer or cabinet, and record when something is taken out and returned. A controlled media library with check-out software does the same thing at a larger organization. You do not need one to meet this requirement.

The cheapest approach is to hold less media.

Every USB drive you do not issue and every page you do not print is media you do not inventory, store, or track. If your CUI lives in a cloud environment and you prohibit printing and removable media, say so and enforce it. Write the prohibition into your system security plan, the document that describes how your system meets each requirement. The requirement then rests on the few exceptions you actually allow.

Know where MP.L2-3.8.1 ends and MP.L2-3.8.2 begins.

This requirement is about controlling and storing the physical items. MP.L2-3.8.2 asks whether the people accessing the CUI on those items are authorized to see it. A single procedure that issues encrypted drives to named people from locked storage produces evidence for both.

What falls short

A policy that says media must be secured, with no locked storage location and no inventory behind it. Words alone show nothing for [c] and [d].
Full-disk encryption offered as the whole answer. Encryption protects a lost drive's confidentiality but physically controls nothing and securely stores nothing, so [a] through [d] still need the inventory and the locked storage.

Edge cases

Internal fixed drives in workstations and servers are not the media this requirement targets. Protect the CUI on them through encryption at rest under SC.L2-3.13.16 and through physical protection of the machines, and keep this requirement focused on paper and portable media.
If you issue encrypted thumb drives as the only authorized removable media, the issuance record is your inventory and the issuance procedure is your physical control. The same evidence serves MP.L2-3.8.2.