MP.L2-3.8.2 Media access: requirements and evidence

What MP.L2-3.8.2 media access requires for CUI on system media

MP.L2-3.8.2 is a requirement you must meet in full before you can reach Conditional or Final Level 2 status. It is worth 3 points in the CMMC scoring methodology, and because it carries more than 1 point, it cannot be placed on a plan of action and milestones. If an assessor finds it NOT MET, the 3 points come off your score of 110 and there is no deferral path. The requirement itself is simple to state: access to CUI on system media must be limited to authorized users. The assessment side is where contractors get caught. NIST SP 800-171A, which assessors use for Level 2, reduces this to a single assessment objective, so the question an assessor asks is whether you can show that only authorized people can reach CUI held on media, and that you can prove it with evidence in final form.

The risk is straightforward. A drive, tape, optical disc, laptop or printed copy holding CUI can be read by anyone who gets physical or logical access to it, whether that person is an outside intruder, a cleaner, a departing employee or a colleague without a need to know. Media is hard to control in practice because it does not stay in one place. Copies sit in several offices, on engineering workstations, in backup sets, in shipping cartons and in the bags of people who travel. Backups are often forgotten because they are treated as IT infrastructure rather than as media. Custody also erodes quietly: a drive is borrowed for a demonstration, moved to a shared cabinet, and never logged back in.

Start by building an inventory of every location where CUI-bearing media exists, including backups and off-site copies, and assign a data owner for each holding. Confirm with your assessor which artifacts they expect, such as storage area access lists, a documented approval step for each access grant, and an access log. Then test the controls yourself: pick a sample of media, check that the storage area is locked or otherwise controlled, confirm that everyone on the access list still needs it, and verify that the log records who accessed the media and when. Gaps found in this internal check are far cheaper to fix now than during an assessment that cannot be deferred.

Which media, storage areas, people and third parties fall in scope for media access

Scope for MP.L2-3.8.2 starts with a simple question: where does CUI sit on media, and who can reach it? The cards below separate the media types, storage locations, people and outside parties that an assessor will expect you to account for. Each one changes how much of the environment you must control and document.

Digital media that holds CUI

Any digital medium that stores CUI falls in scope, including USB drives, external hard drives, optical discs, tapes, and the internal disks of servers and laptops. System-attached storage such as SAN volumes and NAS shares counts when CUI resides on them. Build an inventory that names each device, its owner, and the CUI it holds. An assessor will test whether access to that inventory matches what your procedures say. Start from the inventory, not the policy.

Paper and printed CUI

The requirement covers paper as well as digital media. Printed drawings, specifications, printouts, and handwritten notes that contain CUI are media that must be limited to authorized users. Many contractors scope the digital environment carefully and overlook print output, copies left at printers, and binders kept at engineering benches. Include these in the inventory and decide where they are stored when not in use.

Designated controlled areas

Decide which rooms, cabinets, safes and drawers hold CUI media and mark them as controlled areas. The Level 2 assessment guide points to locked or controlled storage limited to people allowed to access CUI. Confirm who holds keys or badges for each area and whether physical access logs exist. If a CUI enclave is cloud-hosted, the media may sit in a provider data center, so ask the provider for its own physical controls and reports.

People and roles who can reach CUI media

List every role that can open a controlled area, mount a volume, copy files to removable media, or retrieve printed output. This includes administrators, help desk staff, facilities and cleaning crews, and maintenance personnel. Compare that list against the people approved to access CUI in your system security plan. Gaps between the two are the most common source of findings. Route approval decisions through the data owner, and review them on a set schedule.

Third parties that handle media

Off-site storage vendors, shredding and destruction firms, courier services, managed service providers, and equipment repair shops can each take custody of CUI media. Identify each one, the media it touches, and whether a contract or flowdown obligation governs that access. Ask each vendor how it limits staff access, logs custody, and handles media that fails or is returned. Keep the agreements with your evidence.

Scoping choices that change the work

Whether media stays inside a CUI enclave is the scoping decision that matters most. Media that never leaves the enclave needs controls on the enclave boundary and its storage. Media that moves to a general-purpose network, a laptop outside the enclave, or a vendor site brings more systems and people into the assessment. Decide this before you buy storage or write procedures, because redrawing the boundary late means redoing access records. Confirm the boundary with your assessor or C3PAO scoping guidance.

How to implement media access limits step by step

This sequence turns MP.L2-3.8.2 into a working, evidenced process: know where CUI media sits, record who may approve and reach it, control the storage, log access, and review it on a schedule so an assessor can see each step in final form.

Inventory CUI media and storage locations
Start by listing every place CUI resides on system media: laptops, external drives, tapes, NAS devices, paper records, and any removable or portable storage tied to the system boundary. Record each item's owner, location, format, and the system it belongs to. The security or compliance lead owns the inventory, and it is done when every item has a named location and a responsible custodian. Keep the inventory in your system security plan documentation, since assessors will compare it against what they find on site.
Document data owner approval for access
Define who may approve access to CUI on each media type and write that approval path down. The data owner, the person accountable for the information, signs off on who may access it and under what conditions. Record the approval method, such as a signed request form or a ticket in your workflow tool, and the criteria used. This step is complete when a written procedure exists and each current access grant can be traced to a named approval.
Define locked or controlled storage areas
Designate the physical and logical storage areas where CUI media is kept, such as a locked cabinet, a restricted room, or an encrypted and access-restricted storage volume. Specify which controls apply to each area: keys or badges, electronic access rules, or directory group permissions. Facilities and IT staff implement the controls, and the output is a list of designated controlled areas with their protection mechanisms. Confirm that the physical controls align with the protections described in your physical protection and access control procedures.
Build the authorized access list
Create a named list of individuals authorized to access CUI on each designated media type or storage area. Tie each entry to the approval record from the data owner, and remove anyone without a current business need. Store the list where it can be produced on request, and keep it current as staff join, change roles, or leave. The list is complete when every name on it links to an approval and every approved person appears on it, which lets you show the assessor that access is limited to authorized users.
Configure access logs for media access
Turn on logging for both physical and logical access. For physical storage, use a sign-in or check-out log that records who accessed the controlled area or media, when, and why. For electronic storage, enable audit logging on the file system, storage platform, or self-hosted application that holds CUI, and confirm it captures read and write events tied to individual accounts. Test a sample access to verify that the log entry appears. The output is a working log configuration and a test record showing that accesses are captured.
Run periodic reviews of who holds access
Schedule reviews of the authorized access list and the access logs at an interval your organization defines and documents. The reviewer, typically the data owner or a designated manager, confirms each person still needs access, removes accounts that no longer do, and checks log entries for access that falls outside the approval record. Some teams run this as a formal access certification campaign in an identity governance tool, where designated reviewers decide to keep, change, or revoke each item within a set timeframe. Each completed review produces a signed record of decisions and any revocations.
Retain the output of each step
Keep the artifacts from every step in a controlled evidence repository with version history and a clear owner: the media inventory, approval procedures and records, storage area designations, the authorized access list, log configurations and sample logs, and the signed review records. Assessors look for evidence in final form, not drafts, so mark each document as approved with a date and reviewer. Confirm the retention period with your compliance lead and your contract obligations. When this step is done, you can walk an assessor from any media item to its approval, its access list entry, its logs, and its latest review.

How an assessor tests whether CUI media access is limited

An assessor tests MP.L2-3.8.2 against one assessment objective from NIST SP 800-171A: access to CUI on system media is limited to authorized users. The objective is narrow, but it is tested through several assessment objects, and the assessor will walk each of them. Expect questions about the media storage procedures, the physical and environmental protection and access control procedures that cover the storage space, the media themselves, and any designated controlled areas where media are kept. The assessor will then test whether the storage and protection mechanisms work as written, for example by asking to see a locked cabinet being opened by an authorized person and checking who holds the key or badge.

The assessor's test has two halves. First, the documented procedures must say who may access CUI on media, how that authorization is granted, and who approves it. The CMMC Assessment Guide for Level 2 points to locked or controlled storage limited to people allowed to access CUI and to an audit log of who accesses physical CUI, so those are the artifacts to prepare: the access list for each storage location, the approval record from the data owner, and the access log itself. Second, the assessor compares the paper with the practice. A log that is never filled in, or a key list that includes former staff, will fail the objective even when the policy is correct. Confirm with your assessor, before the assessment, how they expect to sample logs and approvals.

Only a MET result counts for this requirement. Because MP.L2-3.8.2 is worth 3 points, a NOT MET result is subtracted from the score, and it cannot be carried on a POA&M under 32 CFR 170.21(a)(2). Evidence must also be in final form. A draft access procedure, an unsigned approval, or a log template with no entries will not satisfy the objective under 32 CFR 170.17 and 170.24(b). Before the assessment, finalize and date each procedure, collect the approvals that cover current users, and confirm that the log has entries for the period under review. The official text of the assessment objectives is available from NIST SP 800-171A.

What assessors test for MP.L2-3.8.2 and the findings they usually raise

This table compares how an assessor tests MP.L2-3.8.2 with the evidence they request and the findings they most often raise in each area. Read each row as a test the organization should rehearse before an assessment, because a single failed test can leave a 3-point requirement NOT MET.

Test area	Evidence requested	Common findings
Procedure review	Written media storage and access procedures, role assignments, and data owner approval workflow for CUI media	Procedures describe storage rules but name no owner for approving access, or they were not updated after staff or system changes
Physical walkthrough of storage areas	Observation of locked or controlled storage, key or badge control records, and designated controlled areas holding CUI media	Media stored in unlocked cabinets or shared offices, keys held by people outside the authorized list, or CUI media left on desks
Sampling of access lists against personnel records	Current access lists for CUI media, HR or identity records, and evidence of removal when staff change roles or leave	Access lists include former employees or contractors, or people with CUI access have no matching clearance or need-to-know record
Log review for CUI media access	Audit log of who accessed physical CUI media, with dates, times and purpose, retained for review	No access log exists for physical media, logs are incomplete, or nobody reviews them, so the assessor cannot confirm access was limited
Tests of technical controls on digital media	Configuration of encryption, file permissions and access groups on system media, and records showing the controls operate	Permissions grant broad group access to CUI folders, encryption is not enabled on removable or external storage, or access settings differ from the written procedure
Interviews with media custodians	Consistent answers from custodians and users on who may access CUI media and how requests are approved	Custodians describe an approval step that the documented procedure does not require, or they are unaware of the access list

Evidence that passes a media access assessment

An assessor testing MP.L2-3.8.2 checks whether access to CUI on system media is limited to authorized users, and then looks for proof that the limit works in practice. The cards below cover the artifacts that carry that proof, from the written procedure through to the records that show who opened a locked cabinet. Each one needs an owner and a refresh cycle so it still matches the environment when the assessor arrives.

Media storage procedures

The written procedure names which media holds CUI, where each type is stored, who may open the storage area, and how custody moves when media is checked out. Assessors treat it as the baseline for every other artifact, so each later record should trace back to a step in this document. Check that the procedure covers paper and digital media, including backup tapes and external drives. Review it at least once a year and whenever a storage location or staffing model changes, and record the approver and date on each revision.

Authorized access lists with data owner approvals

A current list of named individuals permitted to access each CUI media store, with the data owner's approval recorded for each entry. The approval must be dated and traceable to the person who owns the data, not to the administrator who set up the storage. Remove departed staff and role changes promptly, since a stale name on the list is a finding. Ask the data owner to re-approve the list on a fixed schedule and keep the signed or system-recorded approvals alongside it.

Locked or controlled storage configuration records

Records that describe how each storage area is controlled: lock types, key or badge issuance, combination change history, electronic access control settings, and the locations of designated controlled areas. Assessors use these to confirm that the physical or logical control described in the procedure exists and was configured as written. For digital CUI on servers or NAS devices, keep the permission and share configuration exports that show which accounts can read the repository. Refresh them after any hardware move, lock change or permission model change.

Access logs for physical and digital CUI media

Logs that show who accessed CUI media, when, and for what purpose. Physical logs usually come from a sign-in sheet, badge reader or check-out register, while digital logs come from file server audit trails, object storage access logs or document management records. Confirm that each log captures the user identity, the time and the object accessed, and that logs are retained and protected from editing. Reconcile sample log entries against the authorized access list to confirm that no one outside the list appears in the record.

Periodic access reviews

Scheduled reviews in which a designated reviewer confirms, changes or revokes each access entry for CUI media. The review record should show the reviewer, the date, the items examined and the decisions made, with revocations completed and evidenced. Access certification tooling such as midPoint can run these campaigns and keep the decision history, but the organization still has to define who reviews and how quickly decisions are due. Keep at least one completed review per cycle in the evidence folder.

Inspection records of controlled areas

Photographs, floor plans, walkthrough checklists or inspection reports that show a designated controlled area matches its documented description. Assessors look for evidence that someone has checked the area, not just that it was designed to be secure. Record the date, the inspector, the locks and access points checked and any corrective action taken. Repeat inspections after construction, relocation or a reported incident, and reconcile findings with the risk assessment and plan of action where needed.

Why access reviews keep media access limited over time

Periodic access certification is how an organization keeps MP.L2-3.8.2 true after the day access was first granted. Media access rarely shrinks on its own. People change projects, take on new duties, move to other teams and keep the storage locations, shared folders and removable media keys they once needed. Each of those leftover entitlements is a path to CUI on system media that no one currently authorizes. A review cycle forces someone accountable to look at who can reach CUI media today and decide whether that reach still matches the job.

The mechanism that works is a designated reviewer who must decide, for each access item, to keep it, change it or revoke it within a set timeframe. The items should cover the places where CUI media is actually reached: physical storage areas and their key or badge holders, the group or role that can read a controlled network share holding exported CUI, and the data owner approvals that justify each entitlement. Confirm with your own environment who the data owners are, how long the timeframe is in your procedures, and what happens when a reviewer does not respond. An item left undecided should not quietly stay in place.

midPoint, an open-source identity management platform licensed under EUPL-1.2+, offers access certification campaigns that model this workflow. Its access certification documentation describes campaigns in which reviewers decide on role assignments and other access items. It is one illustrative tool, not a requirement. Whether it fits depends on whether your CUI media access is governed through identity records at all, since physical key holders and removable media controls may sit outside an identity system. Keep the review output, including who decided, what they decided and when, as evidence for the assessor.

Using Nextcloud and OpenBao to support digital CUI media controls

Nextcloud can hold CUI files on local and external storage, and its server-side encryption protects file contents at rest, with keys kept on the server. That protects the bytes on disk or in an external bucket, but it does not make the platform's own access rules unnecessary. An assessor testing MP.L2-3.8.2 will still ask who can open, download and share CUI, so the encrypted store and its user accounts must be treated as controlled media. The platform's encryption configuration is documented in the Nextcloud admin manual, and the reader should confirm which storage backends and file types fall under it in their deployment.

File names and folder structure are not encrypted: A file name such as a contract or program title can reveal CUI content, so access controls and naming rules must cover the metadata as well as the file body.
Server-side keys: Because keys are held on the server, administrators with server access can potentially reach plaintext, so restrict root and database access to named personnel.
Group and share permissions: Limit folder shares to users with a documented need to know, and review external shares on a set schedule.
Logging of access: Enable and retain access activity so that who opened which CUI file can be shown to an assessor.
External storage mounts: Confirm that every mounted backend is in scope and protected to the same standard.

Confirm with your assessor how they expect file-level access to be evidenced in your media model.

What meeting MP.L2-3.8.2 costs in money and effort

This table breaks down the main cost and effort components of limiting access to CUI on system media, who is paid for each, and whether the cost is one-time or recurring. Use it to shape what you ask for in a written scope, since no prices are given here and a quote follows the scope you agree. Open-source tooling can remove license spend, but it does not remove the staff time needed to run the control.

Cost component	One-time or recurring	What drives it and how to keep it down
Procedure writing for media storage and access	One-time, with periodic review	Drives: number of media types and storage locations in scope. Keep down by writing one procedure that names the controlled areas and approval steps, and referencing it from the system security plan.
Physical storage upgrades such as locks, cabinets and controlled rooms	One-time capital, plus occasional maintenance	Drives: how much CUI media is physically held and whether a controlled area already exists. Keep down by consolidating media into fewer locked storage points and reusing existing access-controlled rooms.
Access list maintenance for storage and digital media	Recurring staff time	Drives: turnover, number of authorized users and how often access changes. Keep down by tying storage access to the same role assignments used for system access, so one change updates both.
Access logs and log storage	Recurring, tool and storage	Drives: volume of check-out and access events and retention period. Self-hosted open-source logging removes license fees, but storage, backups and staff time to review logs still recur. Confirm retention needs with your assessor.
Data owner approval workflow	Recurring staff time	Drives: number of approvers and request volume. Keep down with a standard request form and a named data owner for each CUI set, so approvals are recorded in one place.
Periodic access reviews	Recurring staff time	Drives: number of people and locations in the review and the review frequency you set. Open-source identity governance tools such as midPoint can run certification campaigns, which reduces manual review effort, but reviewers still decide each item.
External review and assessor sampling	Recurring at each assessment cycle	Drives: scope size, number of storage locations and evidence quality. Assessors sample records and observe storage, so clean, dated access logs and current approvals lower the sampling effort and rework.
Open-source license spend	Removed by design where applicable	Self-hosted open-source platforms avoid per-user license fees for the tools that record access, though hosting, implementation and support are still paid for. Confirm each product's license terms before you rely on them.

Who owns media access controls and what an implementation partner or auditor does

Your organization owns the control. Under MP.L2-3.8.2, the question an assessor asks is whether access to CUI on system media is limited to authorized users, and only your people can answer it for your facilities, your staff and your business. Data owners decide who should be authorized for each category of CUI, physical security staff decide how storage areas are secured and who holds keys or badges, and system administrators decide who can reach digital media. These are management decisions, and they must be documented and carried out by your own personnel.

Data owner approvals: Name the people who approve access to each CUI holding, and keep their approvals in a form you can produce, such as a ticket or signed form.
Storage and key decisions: Decide which cabinets, rooms or safes hold CUI media and who holds the keys, combinations or badges.
Access reviews: Schedule periodic reviews where data owners confirm or remove each person on the access list.
Access logs: Assign an owner to the log of who accesses physical CUI and to the review of that log.
Written procedures: Approve the media storage and access procedures that your staff must follow.

Before any assessment, confirm that the named owners, approval records and review dates exist and that they reflect what actually happens in your facilities.

Common gaps that cause MP.L2-3.8.2 to fail

MP.L2-3.8.2 is a 3-point requirement, so a single gap in access limitation can keep an organization from reaching Conditional or Final Level 2 status. The gaps below recur in readiness reviews because they sit in paperwork, access lists and copies of data that teams forget to track. Each one has a specific closure step that an assessor can verify.

No documented data owner approval

Access to CUI on media is often granted by the IT administrator who has the keys, not by the person who owns the data. Assessors look for a record showing who approved each grant, when, and for what purpose. Check that every storage location holding CUI has a named data owner, that approvals are written before access is granted, and that the approval record ties to the specific media or repository. Closing this gap means adding an approval step to the access request workflow and keeping the signed or ticketed record with the access list.

Access lists that do not match current staff

Locked cabinets and restricted storage rooms only limit access if the list of people allowed in matches the people who work there today. Lists tend to lag behind reassignments, contractor exits and role changes, so former staff keep access that nobody reviewed. Compare the access list against the current HR roster and the CUI data owner approvals, then remove anyone without a current approval. Schedule a recurring review, and record each review decision so the assessor can see it happened.

Controlled areas with no access logs

The CMMC Assessment Guide suggests an audit log of who accesses physical CUI, and assessors check whether a locked room or cabinet actually produces one. A key register, sign-in sheet or badge reader report is enough if it is complete and kept. Gaps appear when logs cover the main door but not the cabinet inside it, or when staff sign in only sometimes. Confirm that each controlled area and container has a log entry for every access, and that the log is reviewed and retained.

CUI copies outside the controlled set

CUI often exists on laptops, shared drives, email attachments and backups that were never added to the list of controlled media. An assessor who finds one unmanaged copy can find that the access limitation does not hold across the environment. Build an inventory that includes endpoints, cloud storage, removable media and backup sets, then apply the same authorization and logging rules to each. Where a copy is not needed, delete it and record the disposal.

Evidence still in draft form

Assessors credit only evidence in final form. A policy marked draft, an access list saved with no approval date, or a log template with no entries will not satisfy the objective, even if the practice exists informally. Before the assessment, finalize the media access procedure, approve it, and confirm that each supporting record carries a date, an owner and a version. Store finished records in the system security plan evidence set so they can be produced without rework.

Questions buyers ask about MP.L2-3.8.2 media access

Can we meet MP.L2-3.8.2 media access in-house?

Yes, in most organizations the control can be built and evidenced internally, because the requirement is one assessment objective: access to CUI on system media is limited to authorized users. The work is mostly defining who may reach CUI media, locking or controlling where that media sits, and keeping records. Internal teams usually struggle with the evidence, not the design. Confirm with your assessor which artifacts they expect, such as storage procedures, access lists, data owner approvals and access logs, and check that each is in final form before the assessment. The organization owns the control; a partner can help prepare systems and evidence, but only an independent assessor issues the outcome.

How much effort does media access take, and what drives it?

Effort depends mainly on how much CUI media exists and how many places it lives. The main drivers are the number of physical storage areas and the people who need to enter them, whether media is digital, paper or both, how many systems hold CUI on removable or shared media, and whether an access log already exists. Costs fall into one-time work (procedures, locking or access control changes, initial approvals, log setup) and recurring work (reviewing access lists, approving new requests, reviewing logs, and updating records when staff change). Ask any consultant for a quote that separates these two groups and names the systems and locations in scope.

How long does preparing for MP.L2-3.8.2 usually take?

No researched timeline is available for this control, so treat any duration you hear as unverified until it is tied to your environment. The schedule depends on how many storage locations and systems are in scope, whether controlled areas already exist, and how quickly data owners approve access. Ask for a written plan with milestones for scoping, access design, approvals and evidence collection. Also confirm the current assessment schedule with your sponsor or assessor, because CMMC timing has been changing and the schedule for Level 2 certification assessments may not be fixed.

Can MP.L2-3.8.2 go on a POA&M?

No. Under the CMMC scoring methodology, MP.L2-3.8.2 is a 3-point requirement, and a plan of action and milestones is not allowed for requirements worth more than 1 point. It must be MET before you can reach Conditional or Final Level 2 status. Because a POA&M is not an option, schedule this control early and make sure access restrictions and records work before the assessment window. Confirm the current POA&M rules in the eCFR text of 32 CFR Part 170 with your counsel or assessor, since the rule governs how the status is calculated.

What does the client team need to provide?

The client team owns the decisions and the records. Expect to provide a named data owner for each body of CUI who approves access, an accurate list of physical and logical locations holding CUI media, the people authorized to access them, and access logs that show who reached controlled storage. Your IT and facilities staff must be able to lock or restrict those areas and produce logs on request. Internal reviewers should also check that procedures match practice, because assessors test whether the control works in operation, not only whether a policy exists.

Can an implementation partner replace the assessor?

No. An implementation partner can help prepare systems, controls and evidence, but only an independent assessor or certification body issues findings, reports or certificates. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. For Level 2 certification, assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, and the assessor must be independent of the party that prepared the environment. Ask any partner to show how they keep preparation and assessment separate, and confirm the assessor's independence rules before you sign.

How DeployOpen prepares media access controls and evidence

DeployOpen prepares the systems, storage controls and records that show CUI on system media is limited to authorized users, inside the client's own infrastructure. The organization owns the requirement and its policy, and an independent assessor decides whether the requirement is MET.

How we scope

We agree in writing which media, storage areas, systems and backups hold CUI and fall within the 3.8.2 scope.
We record who owns each data set and who the data owner is for approving access to CUI on media.
We confirm the evidence the client already has and list the gaps before any build work starts.

How we build

We configure locked or controlled storage and access rules for CUI media, limited to people authorized to handle it.
We set up access logging so each access to CUI on system media can be traced to a named person and date.
We configure encryption and key handling for digital media where the client's policy requires it, using the organization's own key custody.

How we hand over

We deliver a written procedure for media access approval, storage limits and log review, mapped to the 3.8.2 assessment objective.
We provide test records showing that unauthorized access attempts are blocked and that logs capture authorized access.
We hand over evidence in final form, with owners and review dates, so the client can present it to its assessor.

How we support

Ongoing support, upgrades and periodic access reviews are available as a retainer after the fixed-scope work closes.
We can rerun access tests and refresh evidence when storage locations, personnel or data owners change.
Confirm with your C3PAO or assessor which evidence formats they accept before the final handover.