MP.L2-3.8.4 Media markings: requirements and evidence

What MP.L2-3.8.4 media markings requires for CUI media

MP.L2-3.8.4 requires that media containing CUI carry the necessary CUI markings and distribution limitations, so anyone who picks up a drive, binder or file knows it holds controlled information and who may receive it. The requirement is about visible labels on the media itself, applied to both paper and digital media. For a defense contractor, this means every document, extract, export and removable device that holds CUI must show the marking that identifies it as CUI, the category where applicable, and the dissemination limits set by the data owner. The assessment objectives in NIST SP 800-171A split the requirement into two tests: the media is marked with the applicable CUI markings, and it is marked with distribution limitations. Assessors will check both. The risk is simple. Unmarked CUI looks like ordinary data, so it gets printed, emailed, copied to a shared drive or released without the handling controls it needs. NARA CUI Notice 2019-01, which the CMMC Assessment Guide for Level 2 points to, covers coversheets and labels for CUI. The assessment guide also suggests adding ownership information to labels, because MP.L2-3.8.8 requires an identifiable owner for portable storage. Confirm the current CUI marking guidance and your contracting officer's specific markings before you write your procedure, since the labels your contracts require can be more specific than the baseline. This is a 1-point requirement, yet it is often a plan of action item because marking rules are easy to write and hard to apply. The policy is one page. The difficulty lies in exports, printouts, scanned documents, attachments and files copied into shared drives, where the marking disappears or was never applied. Plan a check on each system where CUI is produced, such as templates that carry the marking by default, a review step before release, and periodic sampling of shared locations. Ask any consultant or assessor to show you how they will test those specific paths, not only the policy.

Which media and systems fall under the media marking requirement

MP.L2-3.8.4 applies wherever CUI exists on media, not only in document repositories. The cards below walk through each media type and the scoping decisions that determine where marking happens and who must do it.

Paper printouts and hard copies

Every printed page, report, drawing or form that contains CUI needs the applicable CUI markings and a coversheet or label that states distribution limitations. Marking usually fails at the print step, when staff print from a system that does not add the banner. Check which printers, print queues and mail rooms handle CUI, and confirm that a printed copy carries the same markings as the original file. Assessors commonly ask to see a sample printout alongside its source record.

Digital files on servers and file shares

Files stored on file servers, document management systems and shared drives must carry markings in a way that stays with the file when it is copied, opened or renamed. Check whether your platform embeds markings in document metadata, headers or footers, and whether it can apply them automatically to new files. Identify the folders that hold CUI so you can test a sample of files for the required markings.

Endpoints and local working copies

Laptops, desktops and workstations often hold downloaded or exported copies of CUI that never passed through the central repository. Each local copy is a separate piece of media that needs markings. Decide whether users must mark files manually, whether templates enforce markings, and how you will detect unmarked files on endpoints during your own review.

Cloud storage and collaboration tools

CUI shared through cloud storage, email attachments or collaboration platforms moves into systems that may not preserve markings when content is converted, previewed or exported. Confirm which cloud services hold CUI, whether markings survive sharing links and format conversion, and whether the service provider environment meets the scope of your system security plan.

Removable media and transfers

USB drives, optical discs and external drives holding CUI must be labeled with the applicable markings and distribution limitations, and the label should identify the owner. Mark the device itself when feasible, and keep the marking consistent with the files stored on it. Check how transfers are logged, since a marked file on an unlogged drive is hard to account for.

Scoping decisions: creation, export and print

Decide whether CUI is marked when it is created, when it is exported from a system, or when it is printed. Marking at creation covers most content, but exports and printouts from legacy systems often lose markings. Document the decision in your system security plan and test each point, because an assessor will sample outputs from each path.

How an assessor tests media markings under NIST SP 800-171A

This table compares the two assessment objectives for MP.L2-3.8.4, the examine and test methods an assessor uses for each, and the evidence that usually decides whether the requirement is met. Read it as a checklist of what to prepare before an assessment, since a single missing marking type or draft document can cost the point.

Element	What the assessor checks	Evidence that usually passes	Common finding
Objective 1: CUI markings	Media containing CUI carries the applicable CUI markings, such as the banner and designation indicator on documents and labels on digital media	Marking procedure, sample marked paper and digital media, and a marking tool or template showing the required content	Exports from reporting or collaboration tools that drop the banner
Objective 2: Distribution limitations	Media carries the distribution limitation statement that tells recipients who may receive it	Written distribution statement in the marking standard and marked samples that display it	Marking present but distribution limitation missing or left as a placeholder
Examine: marking procedures	Documented procedures for marking media, who applies markings and when	Current, approved procedure with a named owner and revision history	Procedure exists only as a draft or is not followed by staff
Examine: media marking security attributes	The list of attributes the system uses to mark media, such as category, owner and limitation	Attribute list matched to the marking procedure and the systems that apply it	Attribute list does not match what the tools actually produce
Examine: physical and environmental controls	Procedures and designated controlled areas where marked media is handled and stored	Controlled area designation, handling procedure and marking step within it	Marking steps are not reflected in the physical handling procedure
Test: sampling of marked media	Assessor selects a sample of paper and digital media and checks each against both objectives	Inventory or log that lets the assessor pull representative samples across media types	Unmarked exports, such as spreadsheets or backups, found in the sample
Owner information	Markings identify an owner so the media can be traced to a responsible party	Label template that includes ownership fields, following the CMMC Assessment Guide suggestion tied to MP.L2-3.8.8	Markings that omit owner information
Evidence status	Evidence is in final form and reflects current practice, not drafts	Approved versions with dates and version history showing the current marking standard	Draft evidence not in final form, which does not satisfy the objective

How to implement media marking step by step

This sequence turns the MP.L2-3.8.4 requirement into a documented marking standard, configured templates, trained staff and sampled proof that CUI media carries the right markings and distribution limits.

Inventory CUI categories and their marking rules
The owner of the CUI program, usually a compliance lead working with the data owners, lists every CUI category the organization handles and records the marking rules that apply to each one. Confirm the current category registry and marking guidance against the NARA CUI program materials, since the rules govern which banner text, designation indicators and dissemination controls appear. The output is a CUI category register that names each category, its required markings and any distribution limitations. The step is done when every system that stores CUI maps to at least one entry in the register.
Define the marking standard for paper and digital media
The compliance lead and the system owner write a marking standard that says how each media type is marked: coversheets and banner markings for paper, headers and footers for documents, and file labels or metadata for digital objects. The standard also states where the owner identity and the distribution statement appear, which the Assessment Guide suggests adding because MP.L2-3.8.8 requires an identifiable owner. Review the draft against NARA CUI Notice 2019-01, which the Assessment Guide cites for coversheets and labels. The output is an approved marking standard with a sample for each media type. It is done when the security office signs off and the standard is version controlled.
Configure templates and automated labels
The IT or platform team builds the marking templates that implement the standard, such as document templates with a CUI banner, coversheet pages, and file naming or label conventions. Where the chosen productivity suite or document system supports automated labels or sensitivity classifications, the team configures them to apply the same markings, and confirms with the vendor which label types and banner options the product supports. Records of the configuration (template files, label definitions and change history) are kept with the standard. The output is a template set and a configuration record. The step closes when a test document created from each template shows the expected markings.
Assign marking responsibilities and access to templates
The system owner names who may create, mark and re-mark CUI media and who may approve changes to the templates. Access to the template library and label settings is restricted to those roles, and the permission model is written down so that an assessor can see who can change marking behavior. Where a wiki or knowledge base holds the standard, the team confirms that its roles and page-level permissions limit editing to the owners. The output is a responsibility matrix and a list of role assignments. The step is done when each role in the matrix matches an access setting in the system.
Train staff on marking procedures
The security office delivers training to everyone who creates, edits, prints or distributes CUI, using examples drawn from the organization's own templates and the marking standard. Training covers how to choose the correct markings, how to handle media received from outside the organization, and what to do when a marking is missing. Attendance and the training content version are recorded for each person. The output is a training record and a short job aid. The step is done when every person in the assigned roles has a completed record.
Sample and test marked media
The compliance lead selects a sample of paper and digital CUI media from the systems in scope and checks each item against the marking standard, confirming the banner, coversheet, owner and distribution statements. Any gaps are logged with the owner, the corrective action and the retest result. The sampling method, the selection criteria and the outcome are recorded so that the test can be repeated. The output is a sampling record with findings and retest results. The step is done when the sample passes or each failure has an approved corrective action and a passing retest.
Retain evidence and review the standard
The team stores the marking standard, template set, configuration records, training records and sampling records together, with version history showing what changed, when and by whom. The compliance lead schedules a review of the standard whenever the CUI category register changes or the templates are updated, and confirms the current requirement text and assessment objectives in NIST SP 800-171A before the review. Ask the independent assessor which evidence form they will accept for final review. The output is a controlled evidence folder. The step is done when the evidence is complete and traceable to the requirement.

Why marking must name an owner for media accountability

The CMMC Assessment Guide for Level 2 suggests adding ownership information to CUI labels, and the reason sits in a neighboring requirement rather than in 3.8.4 itself. MP.L2-3.8.8 requires that portable storage devices with no identifiable owner be prohibited, so a label that names the owner gives the organization and the assessor a way to tie a physical or digital item back to an accountable person or function. A marking that carries only the CUI banner and category tells a reader what the content is, but not who answers for the device when it moves between desks, vehicles or sites. Owner information is the link that lets 3.8.4 support 3.8.8, 3.8.5 and 3.8.7 in the same evidence set.

The practical work happens before anyone prints the label. Teams should decide which role is the named owner (a data owner, a program manager or a custodian function), whether that name appears on the coversheet, the label or both, and how the owner is kept current when people change roles. They should also decide how labels apply to removable and shared media such as USB drives, optical discs and backup tapes, since those are the items most likely to lose their chain of custody. Confirm with your contracting officer and your own CUI policy which marking categories and dissemination limitations apply to each data set, because the owner field should not be used to guess at them. Check the current NARA CUI marking guidance through the reference the Assessment Guide cites, and document the decision in the system security plan so an assessor can trace it.

Before rollout, run a short test that an assessor would recognize. Pick a sample of marked media, including one portable device and one shared drive, and confirm that each label shows the CUI marking, the distribution limitation and the owner, and that the owner can be matched to a current inventory entry. Record the results and the procedure version as evidence. Ask any consultant or implementation partner to show how the labeling template, the inventory and the removable media records reference the same owner field, because a label that names an owner who is not in any record will not satisfy either requirement.

Evidence that passes a media marking assessment

An assessor testing MP.L2-3.8.4 looks for two things: that marking is defined and followed, and that the organization can prove it on real media. The cards below cover the artifacts that carry that proof, from the written procedure through sampled marked files. Each one must be in final form and kept current, because the assessment objectives are met only with final evidence.

Marking procedure in final form

The written procedure states which media carry CUI, which CUI markings and coversheets apply, who applies them, and who checks them. It should name the labeling guidance it follows, including NARA CUI Notice 2019-01 for coversheets and labels, and it should be approved and dated. Assessors reject drafts, so confirm the approved version is the one staff can open. Check that it covers both paper and digital media.

Marking templates and label standards

Keep the approved coversheet, header, footer and label templates as controlled files, with the required CUI banner and distribution limitation statement pre-built. Add a field for the owner, since the Assessment Guide suggests ownership information on labels to support MP.L2-3.8.8. Ask whether templates are locked against edits by ordinary users, because an altered banner defeats the control.

Sample marked documents and file metadata

Assessors pick samples of CUI and inspect them. Prepare a set of marked paper copies and digital files drawn from real holdings, with the banner, designation indicator and distribution limitation visible. For digital media, check document properties and footers so the marking travels with the file. Record which samples were chosen and which were found unmarked, and show the correction.

Distribution limitation statements

Each marked item needs a distribution limitation that tells recipients who may receive it and why. Keep the approved statement wording, the list of limitation categories used by the organization, and examples showing how a limitation was chosen for a given dataset. Confirm that the statement appears on coversheets and digital labels, not only in the policy text.

Training records for markers

Staff who apply or approve markings need documented training on the procedure and templates. Keep attendance or completion records with dates, the course or briefing content, and the roles covered. Include contractors and staff who create documents in shared repositories. Refresh records when the procedure or templates change, and confirm the training matches the version in use.

Sampling log and version history

A sampling log records each review: date, reviewer, items checked, findings and corrective action. Store template and procedure revisions with change summaries, approval dates and the reason for each change. Wiki and document platforms can keep this history automatically, so confirm your platform records who changed each page and lets you restore an earlier version. Assessors compare the current template against the one in use during the review period.

Where open-source document systems fit the marking workflow

A wiki or knowledge base is a good home for the written marking standard: the CUI categories in use, the banner and portion marking rules, the coversheet and label text, and the distribution limitation statements your organization applies. Its main value for MP.L2-3.8.4 is the record it keeps. Assessors reviewing marking procedures want to see that the standard exists in final form, that it was approved, and that it changed only through a traceable process. XWiki, which is licensed under LGPL-2.1-or-later, keeps every change to a page under version control and lets users compare any two versions and roll back to an earlier one.

Change history: each edit records what changed, when and by whom, which supports the question of which marking standard was in force on a given date.
Version comparison: reviewers can compare the current marking template against an earlier approved version to confirm the change was intended.
Rollback: a bad edit to a label template can be reverted without rebuilding the page from memory.
License caveat: LGPL-2.1-or-later terms apply to modifications of the library itself, so confirm with counsel how your deployment and any customizations are licensed before you rely on it in a contract.
Limit of the tool: the wiki records the standard. It does not apply markings to files or stop an unmarked document from being saved.

Before you rely on version history as evidence, confirm which version is the approved one and that the approval record exists outside the wiki.

What meeting media marking costs in money and effort

This table breaks down the cost components of MP.L2-3.8.4 media marking, showing who is paid for each, whether it is one-time or recurring, and what drives it up or down. Read it as a checklist for scoping a quote, since no supplied figures exist for these costs and the main variables are internal to your organization.

Cost component	One-time or recurring	What drives it
Marking standard and rules (which CUI categories, banners and distribution limitations apply, and who approves exceptions)	One-time, reviewed periodically	Number of CUI categories you handle and how many teams create CUI documents
Label and coversheet template build (paper coversheets, digital banners, file and system-level markings)	One-time build, then recurring maintenance	Number of document types, file formats and systems that must carry markings
Configuring automated markings in document systems and wiki or document platforms	One-time configuration, recurring upkeep	Whether markings are applied by people or by templates and metadata, and how many platforms are in scope
Staff training for document creators, reviewers and custodians	Initial course, then recurring refresh	Headcount of staff who create or handle CUI, and turnover
Sampling and periodic checks of marked media against the standard	Recurring	Volume of CUI media produced, number of owners, and how often records are reviewed
Evidence upkeep (version history, approval records, marking logs)	Recurring	Frequency of document changes and how long records must be retained under your own policy
External review by a consultant or independent assessor	Usually one-time readiness review, then periodic	Scope agreed in writing, number of systems, and whether a Level 2 assessment is planned. Ask for a fixed-scope quote with named deliverables
Software licenses for documentation and version control	Recurring if commercial	Self-hosted open-source wiki and document platforms can remove per-seat license spend, but hosting, administration and upkeep remain costs to plan for

Who owns media marking, who helps, and what the assessor checks

The organization owns MP.L2-3.8.4. Marking is a decision made by the people who create and hold CUI, so the contractor must define what gets marked, with which CUI markings and distribution limitations, and who is accountable for applying them. No outside party can make that determination on the organization's behalf, and an assessor will ask who signed off on the process.

Owning the standard: Set a written media marking procedure that names the required CUI markings, the distribution limitations and the people authorized to apply them.
Applying markings: Mark paper and digital media at creation or receipt, including coversheets and labels, following the guidance the Assessment Guide points to in NARA CUI Notice 2019-01.
Training staff: Train creators and handlers to recognize CUI and apply markings consistently, and keep training records.
Recording owners: Add ownership information to labels where it supports MP.L2-3.8.8, as the Assessment Guide suggests.
Keeping final evidence: Retain approved procedures, marked samples and training records in final form, since drafts do not satisfy an objective.

Before engaging anyone, confirm internally who the designated CUI program owner is and whether that person can approve the marking procedure.

Common gaps that fail media marking reviews

Most failed media marking reviews come from a small set of gaps: markings that stop at the cover page, outputs that leave the system unlabeled, procedures that exist only as drafts, and media with no named owner. Each gap is easy to miss in daily work and easy to find in an assessor's sample, so check them before the assessment rather than during it.

Markings only on top-level documents

Teams often stamp the cover page or the file name and leave interior pages, headers, footers and embedded attachments unmarked. An assessor who opens a random page or an attached spreadsheet will find the gap quickly. For MP.L2-3.8.4, check that every page carries the required CUI banner and designation indicator, and that attachments and embedded objects are marked too. Sample at least one file from each repository and confirm the marking survived the last save.

Exports and printouts without markings

Reports exported from a CUI system to CSV, PDF or a print queue frequently lose the banner that the source page displayed. Printed copies made at shared printers are another common path for unmarked CUI to leave the controlled environment. Close this gap by configuring report templates to include markings in the body, not only the interface, and by documenting who may print CUI and where. Ask your team to name every export path, then test each one and keep the output as evidence.

Draft marking procedures

A marking procedure that exists only as a draft or a working note does not satisfy the assessment. Assessors look for the procedure in final form, approved and in use. A missing or unfinished procedure can leave the requirement unmet even when staff mark content correctly by habit. Finalize the procedure, record its approval date and owner, and show that staff were trained on the current version. Keep older drafts out of the evidence set so the assessor sees a single controlled document.

Missing distribution limitations

The CUI marking must include the distribution limitation statement along with the category marking, and the two are assessed as separate objectives in NIST SP 800-171A. Teams frequently apply a category label such as a CUI banner but omit the dissemination control that tells recipients who may receive the content. Build a checklist that lists both elements and require reviewers to confirm each one before release. Test the templates in your document system to confirm the limitation text appears on every generated page.

No owner named on labels

Labels and coversheets often identify the category but not the controlling organization or person. The CMMC Assessment Guide suggests adding ownership information because MP.L2-3.8.8 depends on an identifiable owner for media. Without an owner on the label, the chain back to the responsible party breaks during an assessment. Add an owner field to label templates, populate it for legacy media, and assign one accountable role per repository so the owner remains current when staff change.

Marking that is not versioned or traceable

Markings applied once and never reviewed can drift as documents are edited, merged or reclassified. A marking that was correct on one revision may be missing on the next. Document systems with version history let you show when a marking was applied, changed and by whom, which is useful evidence for an assessor. Confirm that your platform records these changes, that you can compare versions, and that reverting to an earlier version does not remove the current markings.

Questions about media markings and CMMC Level 2 readiness

How much does it cost to implement CUI media markings?

The main cost is usually internal staff time, because MP.L2-3.8.4 is met through written procedures, labels and records rather than new hardware. Costs fall into four groups: staff time to write and approve the marking procedure and label templates, relabeling existing paper and digital media, training people who create or handle CUI, and any outside help. Outside help is paid under a written scope, so ask for a fixed-scope quote that lists deliverables, such as the marking procedure, label templates and evidence file, along with exclusions. Assessor fees are a separate line set by the assessor, so confirm them directly. The sources used for this page do not give a figure for these costs, so build your estimate from your own media inventory. Most of the spend is one time, with smaller recurring costs for periodic review and refresher training.

How long does it take to put media markings in place?

The timeline depends on how much CUI media already exists and how many places produce it. The main drivers are the number of repositories, printers and file shares that hold CUI, whether marking is manual or generated by the system, how many approval steps the marking procedure needs, and how many people must be trained before the process works. A small team with one document store can move quickly, while a large organization with many data owners will need more time for approvals and relabeling. The sources used here do not give a duration, so ask any partner or consultant for a schedule tied to a written scope. Then check it against your own contract dates and any Plan of Action and Milestones (POA&M) closeout deadline.

Who on the team needs to be involved in media marking?

Several roles share the work, and the organization owns all of them. Data owners decide which information is CUI and which distribution limitations apply. A records or security owner writes the marking procedure and keeps the evidence. Print, records and document staff apply coversheets and labels. IT configures templates, file headers and system banners where marking is automated. Each media item needs an identifiable owner, which the CMMC Assessment Guide ties to MP.L2-3.8.8, so many organizations add ownership information to labels. A security reviewer should check that the evidence is in final form before it goes to an assessor, because drafts do not count as met.

Can we implement CUI media markings in-house without a consultant?

Yes, if your team understands CUI handling and has the time to write, apply and document the procedure. The work is mostly policy, labeling and records, and an internal team can do it if the roles above are assigned. A consultant or implementation partner can help by preparing label templates, document configuration and evidence files, but the organization still owns its controls and approves what goes into the system. DeployOpen, for example, can prepare systems and evidence inside your environment, but it does not issue assessment reports or certifications. Only an independent assessor or certification body can do that, so plan your evidence for that review regardless of who prepares it.

Can MP.L2-3.8.4 media markings go on a POA&M?

It can, under specific conditions. MP.L2-3.8.4 is a 1-point requirement that is not on the exclusion list in 32 CFR 170.21(a)(2)(iii), so it may be placed on a POA&M for Conditional Level 2 status if your score is at least 88 of 110 (0.8). The POA&M closeout is due within 180 days. Treat this as a time-limited bridge, not a permanent status, and confirm the details in the rule text and with your assessor before you rely on it. Keep in mind that a requirement on a POA&M is not met until the evidence is complete and in final form, so start the marking work now rather than waiting for the closeout deadline.

Is CMMC Phase II still starting on 10 November 2026?

No. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. The suspension also covers later implementation milestones, and a 60-day review by a CMMC Reform Task Force began that day. The DoW CIO About CMMC page says implementation is paused in Phase 1, which began 10 November 2025, and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, so confirm the current status with your contracting officer and the DoW CIO About CMMC page before you plan around any date.

Do DFARS 252.204-7012 and SPRS obligations still apply?

Yes. According to the Department of War's 13 July 2026 announcement, Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. That means your Level 2 self-assessment score and the affirmation still matter for contracts, and MP.L2-3.8.4 contributes to that score. Confirm which clauses apply to each contract, because the obligations depend on contract language and the scope of CUI handled. If you are unsure whether a subcontract flows down these requirements, ask the prime contractor in writing before you accept the work.

How can open-source tools help produce media marking evidence?

Open-source collaboration and documentation tools can hold the evidence assessors ask for, but they do not mark media themselves. XWiki keeps every change to a page under version control, recording what changed, when and by whom, and lets users compare versions and roll back. That history supports a marking procedure that shows how it changed over time. BookStack assigns abilities through roles, and permissions can be overridden at the shelf, book, chapter or page level, so you can limit who edits the marking procedure and label templates. Confirm that each feature works as described in your deployed version and within your access control design before you rely on it as evidence.

How DeployOpen prepares media marking evidence

DeployOpen works on MP.L2-3.8.4 as an implementation partner: we scope, build and document the marking procedures, labeling templates and tracking records that your organization operates and that an independent assessor reviews. We do not assess the requirement or issue any report or certificate.

How we scope

Agree in writing which media types, repositories and output channels carry CUI and need marking.
Confirm which CUI categories, markings and distribution limitations your contracts and data owners require.
Define the owners of each marking procedure, label template and review step before any build work starts.

How we build

Configure marking templates for documents, files and removable media that include the CUI banner, designation and distribution limitations.
Set up system-level metadata fields for media ownership and marking attributes, so labels can be checked against records.
Test marking procedures on sample paper and digital media, recording where labels are missing or inconsistent.

How we hand over

Deliver written marking procedures, label templates and a record of the tests performed, in final form for your assessor.
Document who applies each marking, who checks it and how exceptions are logged and corrected.
Walk your team through the evidence set so they can show it to an assessor without DeployOpen present.

How we support

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
Ongoing support, upgrades and continuous testing are available as a retainer for procedures that change over time.
Ask us to confirm scope changes in writing, including new media types or revised CUI marking guidance.