Media Markings

Official Source Material

Mark media with necessary CUI markings and distribution limitations.

Determine if:

[a] media containing CUI is marked with applicable CUI markings; and
[b] media containing CUI is marked with distribution limitations.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Mark the removable media and the paper, not the fleet of laptops.

The media in this family is paper, USB drives, external drives, and optical disks. A drive fixed inside a laptop is part of the system. A sticker labeling the lid CUI, controlled unclassified information, marks nothing the requirement covers and advertises the machine as a target. Put labels on the things that detach and circulate.

Carry markings forward. Do not invent them.

You are an authorized holder of CUI, not the designating agency that marked it in the first place. Documents and drawings arrive from the government or your prime contractor already carrying their banner and distribution statement. Print and copy them with the markings intact, and write that carry-forward rule into your policy. A DoD distribution statement on an incoming drawing is a distribution limitation on its face, which is exactly what [b] asks for. Mark your own output as CUI only where the contract directs it.

Small media get the minimum marking.

A USB drive has no room for a full banner. Label it CUI or CONTROLLED plus the designating agency, and keep the detailed category and dissemination markings on the documents inside. That minimum comes from the marking guidance of NARA, the federal agency that runs the CUI program, and satisfies both objectives for space-limited media.

Objectives [a] and [b] are two different marks.

The CUI banner tells a reader the information is controlled. The distribution limitation tells them who may receive it. A drive labeled CUI with no indication of distribution meets [a] and leaves [b] open. Pair the control marking with the distribution statement or a named program restriction.

What falls short

A logon banner offered as the marking for media. It marks a login session on a system, not the paper or the drive, so it shows nothing for [a] or [b].
Encrypted but unmarked USB drives. Encryption protects the content and marks nothing, so the drive still needs its CUI label for [a].

Edge cases

CUI arrives from your prime contractor unmarked. You cannot fix the sender's marking failure, so protect the information as CUI, ask the sender to correct the marking, and keep the request as evidence.
One drive holds several categories of CUI. Mark the drive CUI or CONTROLLED with the designating agency, and let the files inside carry their own category markings, because small media need not list every category.
When shipping media, mark the media itself, not the outer package. An envelope or box announcing CUI contents defeats the purpose, because the marking rules put the banner on the item inside.