MP.L2-3.8.1 Media protection: requirements and evidence

What MP.L2-3.8.1 media protection requires and why it cannot be deferred

If you are a defense contractor preparing for CMMC Level 2, MP.L2-3.8.1 asks you to show that every piece of system media holding CUI is physically controlled and stored securely, whether it is paper or digital. The requirement is the Level 2 version of NIST SP 800-171 Rev. 2 requirement 3.8.1, and it is worth 3 points in the CMMC Scoring Methodology. In practice, an assessor will want to see where CUI sits on paper and on disks, who can reach it, how it is stored when nobody is watching, and how it is checked out and returned. NIST SP 800-171A breaks the requirement into four assessment objectives: physically controlling paper media, physically controlling digital media, securely storing paper media, and securely storing digital media. Each objective must be satisfied with evidence before the requirement counts as MET.

The requirement cannot be deferred because of how the scoring works. Under 32 CFR 170.21(a)(2), a requirement worth more than 1 point cannot be placed on a Plan of Action and Milestones, and MP.L2-3.8.1 is worth 3 points. If it is NOT MET, the point value is subtracted from the maximum score of 110, and you cannot reach Conditional or Final Level 2 status until the control is fully in place with evidence in final form. Before you plan a timeline, confirm the current status of the CMMC phase schedule and the assessment method that applies to your contracts, because the Department of War has changed these milestones recently. The media protection obligation itself does not depend on that schedule.

The difficulty is usually scope, not policy. CUI media rarely stays in one room. It turns up in desk drawers, printer trays and scanner memory, on laptops that travel, in email attachments saved to local folders, on removable drives, and in backup sets that nobody inventoried. Start by asking every team which systems and locations handle CUI, then build a media inventory that covers paper, endpoints, servers and backups. Ask your assessor or consultant to confirm how they will test each location, and document the storage and check-out procedure well enough that a person outside your team could follow it. Evidence that exists only in someone's memory will not be accepted.

Which CUI media, locations and teams fall under MP.L2-3.8.1

Scope for MP.L2-3.8.1 follows where CUI actually resides in your system security plan, not where your policies say it should be. The cards below cover the media and locations that most often pull effort into or out of scope. Confirm each boundary with your assessor or C3PAO before you size the work.

Paper printouts and hard copies

Every printout, handwritten note and paper copy that contains CUI counts as system media under this requirement. Teams often overlook desk drawers, printer trays and meeting room whiteboards. Inventory where paper is printed, copied and filed, then decide which locations need locked storage and a check-out log. The effort is usually in cultural change and physical controls rather than technology, so confirm with your assessor how they expect paper to be tracked.

Removable drives and portable media

USB drives, external disks, optical discs and memory cards that hold CUI must be physically controlled and stored securely when not in use. Each device that has ever touched CUI is in scope, including devices reused for other work. Build an inventory of who holds which devices and where they are kept. Removable media is also governed by MP.L2-3.8.7, so decisions about allowed devices should be documented once and referenced in both places.

Laptops and workstation drives

Laptops that store CUI locally are digital media and fall under the physical control and secure storage expectations. Scope grows when laptops leave the office, so track which devices hold CUI and where they are stored overnight and during travel. Full-disk encryption and asset tracking reduce the manual work of proving control. Use your asset inventory to confirm which endpoints actually hold CUI, because a device that only accesses a cloud service may sit outside this requirement.

Server, NAS and storage arrays

Server disks, network-attached storage and storage arrays that hold CUI are digital media in a controlled data center or server room. The work here is mostly confirming that physical access to racks and drive bays is limited and that drives removed for repair or replacement are accounted for. Document the storage locations in your system security plan so the assessor can trace CUI from the system to the physical device.

Media held by third parties

CUI on media held by a cloud provider, offsite storage vendor, courier or managed service provider can still fall under your responsibility, depending on how your contracts and the shared responsibility model are written. Identify which third parties hold or handle CUI media, obtain their storage and custody commitments, and record them in your system security plan. Where a third party is in scope, confirm with your assessor how their controls are evidenced.

Alternate work sites and home offices

Paper and devices taken to home offices, shared workspaces or other alternate sites bring CUI media outside your controlled facilities. Decide which roles may take CUI media off site, what storage they must use, and how they return it. Written rules and a check-out record for these locations are usually the largest scoping change. Ask your assessor whether the alternate site falls within your assessed boundary before you finalize the policy.

How an assessor tests the four MP.L2-3.8.1 objectives

This table compares the four assessment objectives of MP.L2-3.8.1, one row per test area, showing what the assessor examines, the evidence requested and the findings that most often stop a requirement from being MET. Read each row as a question the assessor will ask, and check that your evidence answers it in final form, because a draft does not count toward a MET result.

Test area	What the assessor examines	Evidence requested	Common findings
Physical control of paper media	Whether paper containing CUI is kept in a controlled location and handled only by people with permission, including check-out and return of files	Media storage procedures, media access restrictions, check-out and return logs, and physical and environmental protection procedures	Printed CUI left on desks or in shared printers, and no check-out record for files taken out of the controlled area
Physical control of digital media	Whether laptops, USB drives, external disks and other digital media holding CUI are controlled and accounted for by people with proper permissions	Media access restrictions, asset or media inventories, and access control records showing who can reach the storage location	Digital media kept in unlocked drawers or open offices, and no record of who holds a device containing CUI
Secure storage of paper	Whether the storage facility for paper CUI limits access and whether the facility records support that limit	Media storage facility records, access control records for the storage room or cabinet, and the written storage procedure	Storage cabinets with no lock or key control, and access lists that do not match the people currently authorized
Secure storage of digital media	Whether the location holding digital CUI media is controlled, and whether the processes and mechanisms that restrict media access actually run	Storage facility records, access control records, and test results showing that access restrictions work as written	Policy exists but no test record shows the restriction works, or the access list was never reviewed after staff changes
Testing the access restriction processes and mechanisms	Whether the restrictions are implemented, not just described, by examining the mechanisms and interviewing staff who run them	Procedures for media access, samples of access control records, and evidence of a check-out and return cycle	Restrictions depend on one person's memory, with no logs or sample records the assessor can examine
Evidence currency	Whether each document is final, approved and dated, and reflects how the process runs today	Approved, versioned procedures and records from the assessment period	Draft procedures or undated logs, which assessors do not accept as final evidence for a MET finding

Which evidence passes MP.L2-3.8.1 and how to keep it current

An assessor testing MP.L2-3.8.1 looks for evidence that paper and digital media containing CUI is physically controlled and securely stored, and that those controls work in practice. Each artifact below answers one part of that question, and each must be in final form at assessment time, not a draft. The organization owns this evidence; an implementation partner can help prepare it, but the assessor reviews it independently.

Media storage and handling procedures

Written procedures define where CUI media is kept, who may handle it, how paper and digital media are labeled for storage, and what happens when media is found out of place. Assessors check that the procedure names the storage locations in your environment, matches what staff actually do, and has been approved and dated. Review it at least annually and after any move, new storage location or change to the system boundary, and keep the approved version history.

Check-out and return logs

Logs record each time media containing CUI leaves its storage location and comes back, with the person, date, purpose and return time. Assessors sample entries and compare them against the storage location and the people who report having access. Keep logs complete and tamper-evident, reconcile open check-outs at regular intervals, and confirm that entries for paper and digital media are kept with the same discipline.

Access control lists for storage locations

Access lists show which named individuals or groups may enter or open each storage location, including locked cabinets, safes, server rooms and encrypted repositories. Assessors compare these lists with directory group membership and with the people listed in your check-out logs. Remove departed staff promptly, record the data owner approval behind each grant, and review the list on a fixed schedule so that stale access does not appear as a finding.

Physical access records for media rooms and cabinets

Badge logs, visitor sign-in sheets, key issuance registers and camera retention settings show who physically reached media storage areas. Assessors check that records exist for the period under review, that they match the access lists, and that someone reviews them. Confirm how long each record source is retained in your facility, and make sure the records cover the cabinets and rooms named in your procedures, not only the main building entrance.

Media inventories tied to CUI

An inventory lists each media item that holds CUI, with its identifier, type, classification, location, custodian and status. Assessors use it to trace a sample of media to its storage location and to the check-out records. Asset management tools can hold this data, and a tool such as GLPI can track hardware and peripherals, but the inventory must state which items contain CUI. Update it whenever media is created, moved, transferred or destroyed.

Training and acknowledgment records

Training records and signed acknowledgments show that staff who handle CUI media know the storage rules, check-out process and reporting duties, and that they accepted them. Assessors look for records dated before the handling activity they support, and for refresher training after policy changes. Track completion by person, keep acknowledgments with the procedure version they reference, and reconcile the training list against the current access lists each quarter.

How to implement secure storage and check-out for CUI media

This sequence takes an organization from knowing where CUI media exists to holding evidence that the physical and procedural controls for MP.L2-3.8.1 work and are reviewed. Each step produces a document or record an assessor can test.

Inventory every location of CUI media
Walk the boundary of the CMMC environment and list every paper and digital media item that holds CUI, including printed drawings, USB drives, backup tapes, laptops, external drives and paper in desks or printers. Assign each item an owner and a storage location in a media register. Done means the register covers both paper and digital media, and the system security plan references it. Confirm with your assessor which asset records they expect to see, since the inventory is the basis for every later step.
Define storage locations and authorized access
For each location in the register, decide whether it is a controlled area such as a locked cabinet, a restricted room or an access-controlled file share, and name the roles allowed to enter or open it. Record the decision in a storage standard that the data owner approves. Done means each location has a documented control, a named custodian and a list of authorized people that the custodian can produce on request.
Write check-out and return procedures
Draft a procedure that requires anyone who takes CUI media out of its storage location to record who took it, what it is, when it left and when it came back. Specify who approves a check-out and how overdue items are followed up. The CMMC Assessment Guide Level 2 describes this check-out and return process as the expected practice. Done means the procedure is approved, staff have acknowledged it, and a blank log form exists for each location.
Configure physical and logical controls
Install the locks, cabinets and room restrictions named in the storage standard, and configure the system so that digital CUI sits only in repositories with role-based permissions and audit logging. Where the platform supports it, restrict file shares and removable media to the authorized groups. Done means each control has a screenshot, configuration export or photograph that matches the register, and a test shows that an unauthorized user cannot open the storage. Your implementation partner can prepare these configurations, but the organization owns the decisions.
Collect evidence in final form and review it
Gather the approved register, storage standard, check-out procedure, completed logs, access lists and configuration evidence into a single evidence folder for 3.8.1. Mark each document with its approval date and version, and avoid submitting drafts, since an objective is met only with evidence in final form. Set a recurring review of the register and access lists, and record each review and its outcome. Done means an assessor can trace each of the four assessment objectives in NIST SP 800-171A to a specific artifact. An independent assessor, not DeployOpen, decides whether the evidence meets the requirement.

What meeting MP.L2-3.8.1 costs in money and effort

This table compares the main cost components of meeting MP.L2-3.8.1, who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to build a written scope and to ask each bidder for the same line items. No prices or durations are published here because none were supplied for this requirement.

Cost component	One-time or recurring	What drives cost up or down	What to request in a written quote
Physical storage and locks for CUI media	One-time for locked cabinets, safes or a secured room; recurring for locks, maintenance and replacement	Number of locations holding CUI media, volume of paper and removable media, and whether existing building controls can be reused	Itemized list of storage units, locking hardware, installation labor and any assumed reuse of current facility controls
Access control and logging tooling	Recurring if licensed; one-time for setup and integration	Number of people with media access, whether badge or key systems already log access, and whether open-source tools are used	Named tools, license terms if any, configuration hours and which logs are retained and where
Engineering and administrator time for procedures and configuration	One-time for writing check-out, return and storage procedures and configuring controls; periodic for updates	In-house skills, number of media types in scope, and how many systems hold CUI	Named roles, hours by task, and deliverables such as the procedure, configuration baseline and training record
Recurring evidence upkeep and log review	Recurring, usually monthly or per review cycle, depending on the organization's own schedule	Frequency of media movement, number of custodians, and how much evidence is generated automatically	Review frequency, who signs off, format of check-out records and how long records are kept
External review or readiness testing	One-time per readiness review; repeated when scope or environment changes	Scope size, number of sites, and whether the consultant tests storage and check-out in practice	Scope statement, sampling approach, written findings and retest terms included in the fixed price
Auditor sampling time paid to the assessor	Recurring per assessment cycle; paid to the independent assessor, not to the implementation partner	Number of media locations and records the assessor samples, and readiness of final-form evidence	Ask the assessor for its fee basis and sampling scope in its own proposal, separate from any implementation quote
Self-hosted open-source tools	Removes most license spend; staff time, hosting and maintenance remain	Skills to deploy and maintain tools, and whether logs integrate with existing monitoring	Confirm that tool licenses are no-cost, and price the setup, hosting and upkeep hours separately

How self-hosted open-source tools support MP.L2-3.8.1 evidence

The tools below produce records that help an assessor test the media inventory, access and storage objectives behind MP.L2-3.8.1. Each one covers part of the picture, and none of them replaces the locked storage, check-out procedures and physical controls the requirement calls for.

GLPI asset inventory

GLPI's Assets module records computers, monitors, peripherals, printers and other hardware, entered by hand or pushed by the GLPI Agent through native inventory built into GLPI since version 10. For MP.L2-3.8.1, that inventory is the starting list of devices that hold or can hold CUI, including removable drives and laptops. Check that every media-bearing device has an owner, a location and a status field, and that records are updated when devices move or leave the organization. An inventory that is out of date will not satisfy an assessor who samples storage locations.

Wazuh endpoint and account inventory

The Wazuh Syscollector module gathers hardware, operating system, installed software, users and groups from each endpoint and stores the results in the Wazuh indexer for dashboard reports. For MP.L2-3.8.1, these records show which accounts exist on systems that handle CUI and which hosts are in scope for media controls. Confirm that the agents you deploy cover workstations and servers that hold CUI, and that the collected data is retained long enough to show the state of the environment during an assessment period. Syscollector does not track physical media or check-out events on its own.

Nextcloud encryption at rest

Nextcloud's server-side encryption protects file contents at rest on local and external storage, with keys held on the server. It does not encrypt file names or folder structure, so anyone with access to the storage backend can still see how CUI is organized. Before you rely on it for MP.L2-3.8.1 storage evidence, document that gap, decide whether folder names can carry CUI details, and confirm the encryption module, key handling and external storage configuration in your own environment. Encryption at rest also does not replace physical control of the servers and backup media.

OpenBao transit encryption

The OpenBao transit secrets engine encrypts and decrypts application data without storing that data, signs and verifies data, and supports versioned encryption keys with key rotation. For MP.L2-3.8.1, it can encrypt CUI records that an application writes to storage, so the stored form is protected even when the media itself is lost. Plan the key lifecycle with the same care as the data: define who may use each key, how rotation is scheduled and how key access is logged. Confirm which cryptographic modules your deployment uses before you claim FIPS-validated encryption for any of this data.

Who owns, implements and assesses MP.L2-3.8.1

Your organization owns MP.L2-3.8.1 from end to end. Its people decide where CUI media may be stored, who may check it out, and whether the procedures are followed day to day. An assessor will ask for proof that these owners acted, so accountability has to be written down, assigned to named people and signed.

Storage locations: Name the secured rooms, cabinets, safes and approved digital repositories where paper and digital media containing CUI may be kept, and assign an owner to each one.
Access approval: Approve who may check out media and record each decision in a form that can be sampled later.
Logs and records: Keep check-out and return records and storage facility access records in a format that remains reviewable over time.
SSP and self-assessment: Write the system security plan entries for 3.8.1, then sign off the self-assessment and affirmations as the accountable officials.

Check whether each storage location has a named owner who can produce records for any date range without rebuilding them from memory.

Where defense contractors usually fall short on media storage

Most media protection failures are not missing policies. They are CUI sitting in places nobody defined as storage, paper left unattended, and procedures that exist on paper but leave no records. Each card below names a gap, the fix, and the evidence an assessor will ask to see for MP.L2-3.8.1.

CUI on unmanaged laptops and personal drives

Engineers often copy CUI to a laptop, a home drive or a personal cloud folder to get work done, and the copy never gets recorded as media. The fix is to define the approved storage locations in the system security plan, block or flag copies outside them, and keep an inventory of endpoints that hold CUI. Ask for the list of approved locations, the inventory extract and the procedure for removing stray copies. An assessor will test whether those locations match what actually exists on the systems.

Printouts left at desks and printers

Paper containing CUI is the most overlooked form of media. Printouts sit on desks, in tray stacks or in shared bins, and the requirement covers paper as well as digital media. The fix is a defined rule for where printed CUI may be kept, locked storage for it when unattended, and a clean-desk expectation checked during walkthroughs. Evidence includes the storage procedure, records of periodic inspections and staff acknowledgments that they understand the rule.

Shared media with no check-out log

Binders, drives and removable media used by several people often leave no trace of who held them or when. Without a check-out and return process, the organization cannot show that media containing CUI stayed under control. The fix is a simple log that records the item, the holder, the purpose and the return date, with a named owner who reviews open items. Assessors look for completed entries that match the items physically held in the storage location.

Storage rooms without access records

A locked room or cabinet is only half of the control. If nobody records who entered, when, and under whose authority, the organization cannot demonstrate that access was limited to people with the proper permissions. The fix is a defined access list for each storage area, a sign-in or badge record that the physical access process produces, and periodic reviews of who still has access. Ask for the access list, the entry records and the date of the most recent review.

Procedures written but never followed

A media storage policy that describes checks nobody performs is worse than none, because the gap between the document and practice becomes visible in an interview or a sample. The fix is to tie each step of the procedure to a recurring activity with a record, then test a sample of media against the log and the location. Evidence is the procedure in final form, dated execution records and notes showing corrective action when the sample failed. Drafts do not count as evidence.

Backups and cloud sync holding CUI elsewhere

Cloud sync clients, automatic backups and file sharing services can copy CUI into locations that were never part of the defined storage. The fix is to list every sync and backup path that touches CUI, confirm each one is inside the approved storage boundary or documented as an exception, and record the decision. Ask for the data flow diagram and the configuration showing which folders sync. Protection of backup contents is covered in the sibling backup requirement, so this card focuses on keeping them within the defined storage locations.

What defense contractors ask before preparing MP.L2-3.8.1 evidence

How much does MP.L2-3.8.1 cost to meet, and what drives the cost?

No supplied figure gives a price for this requirement, so the cost depends on your environment and what you ask others to do. Most of the spend falls into three buckets: staff time to write and run the media handling procedures, physical security work such as locked storage, access logs and check-out forms, and any outside help you buy for preparation. The main drivers are how many locations and media types hold CUI, whether paper and digital records already sit in controlled areas, and how much of the process is already documented. Costs are mostly one-time for setup and recur for staff time, check-out records and periodic reviews. Ask any provider for a quote that lists each item separately, names who performs it, and states what you must supply. Confirm the current assessment expectations with your assessor before you budget.

How long does MP.L2-3.8.1 preparation take, and what must I supply?

No researched duration is available for this requirement, so treat any timeline as an estimate you confirm in writing with your provider and assessor. Preparation time depends on how many systems and storage locations hold CUI, how mature your physical controls are, and how quickly you can produce final, signed versions of your records. You must supply the inventory of locations and media, your access rules and approvals, the storage facilities and their access control records, and evidence that check-out and return steps are followed. Assessors accept evidence only in final form, so drafts take time to finish. Plan the schedule around those inputs rather than around a target date.

Can my own team meet MP.L2-3.8.1 without an outside consultant?

Yes, an internal team can prepare for this requirement if it has someone who understands CUI handling and can operate the physical controls. The organization owns its controls and makes the final decisions, and it is responsible for showing that they work every day. An outside implementation partner can help prepare systems, documentation and evidence, but it does not issue assessment results. Independent assessors and certification bodies perform the assessment and decide whether the requirement is met. Consider outside help if your staff lacks time, if your CUI sits in several sites, or if previous attempts left gaps. Confirm the current assessment path with your assessor before you decide who does what.

Why can MP.L2-3.8.1 not be placed on a POA&M?

MP.L2-3.8.1 is worth 3 points in the CMMC scoring methodology, and the rule does not allow requirements worth more than 1 point on a plan of action and milestones. If the requirement is scored NOT MET, its 3 points are subtracted from the maximum score of 110. Because a POA&M cannot cover it, you must have it fully met before you can reach Conditional or Final Level 2 status. Treat this requirement as a gate to fix before any assessment, not as a gap to schedule later. Confirm the current POA&M rules in the final rule text, since the rules and phase schedule have been in flux.

Does moving CUI to a cloud environment change how I meet MP.L2-3.8.1?

The requirement stays the same, but the evidence changes. In a cloud environment you still must physically control and securely store media containing CUI, but much of the physical layer sits with the cloud provider. You need to confirm what the provider covers, how it documents its own physical protections, and where your responsibilities begin. Paper records, local endpoints, backups and any devices you retrieve from the cloud remain your responsibility. Review the provider's shared responsibility documentation and your contract terms with the provider before you rely on them. Your assessor will want to see how the boundary is drawn and how it is evidenced.

What will an assessor sample when testing MP.L2-3.8.1?

Assessors test the processes and mechanisms that control media access, using the assessment objectives in NIST SP 800-171A. They typically ask to see the procedures for media storage and access restrictions, physical and environmental protection procedures, storage facility records, and access control records. The CMMC Assessment Guide Level 2 expects media containing CUI in a secure location, accessible only to people with proper permissions, and a check-out and return process for anyone who accesses it. Expect the assessor to pick specific locations, items or check-out entries and ask you to show the record and the control behind it. Keep records complete, dated and in final form. Confirm the sampling approach with your assessor before the engagement.

What changes if the CMMC phase schedule moves again?

The current schedule has changed, so confirm the status with official sources before you commit. The Department of War suspended CMMC Phase II and started a review by a CMMC Reform Task Force, and the DoW CIO page says implementation may only require self-assessments at Levels 1 and 2 for now. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The eCFR text still reflects the original four-phase schedule, so the official pages and your contracting officer may give different signals. Keep your media protection evidence current regardless of the schedule, because the requirement applies whenever you handle CUI. Check the DoW CIO About CMMC page and ask your contracting officer about your specific obligations.

Which parts of MP.L2-3.8.1 can an outside partner prepare for me?

An implementation partner can help prepare the systems, documentation and evidence that support MP.L2-3.8.1. This can include drafting media handling procedures, setting up inventory records of media and locations, and configuring logging and access records in your own systems. Open-source tools such as GLPI can hold asset records for computers and other equipment, and Nextcloud server-side encryption can protect files at rest, though it does not hide file names or folder structure. Your staff still makes the decisions, operates the controls and signs the records. The independent assessor reviews the evidence and issues the result. Confirm the exact scope of any partner's work in a written statement of work before the engagement starts.

How DeployOpen prepares MP.L2-3.8.1 systems and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so that media holding CUI is physically controlled and securely stored, with evidence in final form. The organization owns its controls, DeployOpen prepares the systems and evidence, and an independent assessor reaches the conclusion.

How we scope

We define which paper and digital media holding CUI sit inside the assessment boundary and where they are stored.
We map storage locations, check-out and return steps, and the people who hold access to each location.
The written scope lists the four assessment objectives of 3.8.1 and the deliverables for each, agreed before work starts.

How we build

We configure inventory of digital media and endpoints with GLPI so storage locations and assigned custodians are recorded.
We set up Wazuh system inventory to show hardware and software state on endpoints that store CUI.
We configure Nextcloud server-side encryption and OpenBao key management where those platforms hold CUI at rest, then test them.

How we hand over

We deliver a media storage procedure, a check-out and return procedure and the physical and environmental protection procedures they reference.
We provide sample records such as inventory exports, check-out logs and access records, labeled by the assessment objective they support.
We walk your team through the evidence package and list open items for you to close before an assessor reviews it.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover periodic checks that check-out records and storage controls still match the documented process.
Ask any provider to confirm in writing which parts of the evidence remain your responsibility after the engagement ends.