MP.L2-3.8.1 Media protection
Physically controlling and securely storing system media containing CUI, both paper and digital, with check-out and return procedures. A 3-point requirement in the scoring methodology.
MP Media protection
The nine CMMC Level 2 media protection requirements: protecting, limiting access to, sanitizing, marking and tracking media with CUI, encrypting portable storage, removable and shared media, and backup confidentiality.
MP.L2-3.8.2 Media access
Limiting access to CUI on system media to authorized users through locked or controlled storage, data owner approval and access logs. A 3-point requirement in the scoring methodology.
MP.L2-3.8.3 Media disposal
Sanitizing or destroying media containing CUI before disposal, and sanitizing it before release for reuse, following NIST SP 800-88. Covers acceptable methods, including cryptographic erase, and sanitization records.
MP.L2-3.8.4 Media markings
Marking paper and digital media containing CUI with the required CUI markings and distribution limitations, following NARA labeling guidance. Covers marking procedures and the evidence assessors look for.
MP.L2-3.8.5 Media accountability
Controlling access to media containing CUI and keeping accountability for that media while it is transported outside controlled areas, for example with custody records and tracked shipments.
MP.L2-3.8.6 Portable storage encryption
Encrypting CUI on digital media during transport, with FIPS-validated cryptography, unless alternative physical safeguards protect it. Covers identifying in-scope devices and transport records.
MP.L2-3.8.7 Removable media
Controlling the use of removable media such as USB drives, CDs and DVDs on system components through a written policy and technical restrictions. A 5-point requirement despite having one assessment objective.
MP.L2-3.8.8 Shared media
Prohibiting the use of portable storage devices that have no identifiable owner, because untraceable devices may carry malicious files. A 3-point requirement in the scoring methodology.
MP.L2-3.8.9 Protect backups
Protecting the confidentiality of backup CUI wherever backups are stored, from tapes and external drives to NAS, servers and cloud backup, through encryption, access control and physical security.
