MP.L2-3.8.5 Media accountability: requirements and evidence

What MP.L2-3.8.5 media accountability requires when CUI leaves a controlled area

MP.L2-3.8.5 asks for two things: control who can reach CUI on media, and keep an accountable record of that media while it is transported outside a controlled area. The first objective covers access to media containing CUI. The second covers accountability during transport outside controlled areas. A defense contractor whose CUI sits on disks, tapes, USB drives or laptops that leave the building has to show both. In practice that means knowing which devices hold CUI, who holds each one at every handoff, and how the chain of custody is recorded. The NIST assessment guidance expects evidence such as media storage procedures, physical and environmental protection procedures, access control procedures and a designated list of controlled areas, with tests showing those mechanisms work.

The requirement carries 1 point in the CMMC scoring methodology, so it looks minor next to 3-point requirements. It is harder than the score suggests because portable media is easy to lose and hard to see. A laptop bag or a drive in a courier's box can leave the scope of every system-level control in minutes. Assessors look for the gap between what the policy says and what happened: a custody log with missing signatures, a shipment with no tracking number, or a drive that nobody can account for. A short inventory of media that ever leaves a controlled area, with a named custodian for each item, is usually the first step. Confirm with your contracting officer or prime which assessment objectives and evidence they expect for media you transport.

Two points of scheduling matter for planning. Level 2 certification assessments are performed by C3PAOs, and the Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Because the DoW CIO's guidance and the eCFR text may not match, confirm which schedule applies to each contract before deciding whether to pursue a certification assessment. Implementation partners can prepare the custody records and media inventory, but only an authorized C3PAO issues the certification assessment outcome.

Which media, custodians and transport paths fall under MP.L2-3.8.5

MP.L2-3.8.5 applies wherever CUI sits on media that leaves a controlled area, so the first job is deciding which media, people, transport routes and systems are in scope. These scoping choices determine how many custody records you keep and how many shipments you track, and they matter far more than which tracking tool you pick.

Media types that hold CUI

Start with an inventory of every device or medium that can hold CUI outside a controlled area: hard drives, tapes, USB drives, CD-ROMs, DVDs, laptops and external drives. Include media created by copying, printing to file or exporting reports, because those copies are often forgotten. Any item that can carry CUI out of a controlled area needs an accountability record, so decide early whether a device is in scope based on what it holds, not on how it is labeled.

People who act as custodians

Name a custodian for each medium or group of media, and record who signs it out, who carries it and who receives it. Custodians include employees, contractors, field staff and anyone with a shared drive or bag. Confirm that each custodian understands the handling and sign-off steps, and that the custody chain can be shown from the start of a transport to its end.

Third-party carriers and couriers

When a courier, postal service or logistics provider moves CUI media, the carrier becomes part of the custody chain. Decide whether the carrier is trusted for chain-of-custody purposes, what proof of pickup and delivery you require, and how the contract records handoffs. Ask each carrier for tracking data you can retain as evidence, and confirm the terms in writing before you rely on them.

Transport paths that leave controlled areas

List every route by which CUI leaves a controlled area: courier and mail shipments, hand carry to meetings, field work at customer or remote sites, and copies sent to offices. Cloud sync and file transfers also move CUI out of a controlled area, even though no physical media moves. Each route needs a defined method of custody and a record, so treat sync to remote offices as a transport path during scoping.

Systems inside the assessment boundary

Define which systems store, process or transmit CUI and where their media are created or handled. Systems that generate removable media, such as backup servers, file shares and engineering workstations, belong in the boundary if their output carries CUI. Systems that never touch CUI may stay outside it, but document that decision and the reasons so an assessor can test it. Your system security plan should match this boundary.

Exceptions and specialized equipment

Decide how to handle media that cannot be tracked in the usual way, such as test equipment, instrument storage or devices embedded in machinery. Document each exception, the compensating safeguards and who approves it. Confirm with your assessor how they treat these items, because undocumented exceptions are a common source of findings during assessment preparation.

How an assessor tests media access and transport accountability

This table compares what an assessor examines, tests, and requests for each of the two NIST SP 800-171A objectives behind MP.L2-3.8.5. Read each row as a checkpoint: the requirement is met only when both objectives are satisfied with evidence in final form.

Assessment step	What the assessor checks	Evidence requested and common findings
Objective 1: Access to media with CUI	Whether access to CUI on portable media is limited to authorized people and controlled areas, and whether the process is followed in practice	Media storage procedures, access authorization records, and locked or controlled storage locations. Finding: access rules exist in policy but no one can show who holds keys or combinations.
Objective 2: Accountability during transport	Whether each movement of CUI media outside controlled areas is traceable from sender to recipient	Custody records, chain-of-custody forms, and shipment tracking. Finding: custody handoffs happen verbally or by email with no signed record.
Examine: storage and protection procedures	Written procedures for media storage, physical and environmental protection, and access control	Current, approved procedures with revision dates. Finding: procedures describe a process that staff do not know or that differs from daily practice.
Examine: system media and controlled areas	Inventory of media holding CUI and the boundaries of designated controlled areas	Media inventory linked to the system security plan and a defined list of controlled areas. Finding: removable drives appear in no inventory.
Test: storage and protection mechanisms	Whether locks, cabinets, access controls and transport containers work as described	Observed or sampled checks of storage units, access lists against badge or key records, and transport packaging. Finding: access list includes former staff.
Test: transport accountability	Whether a sample of recent transports has complete custody and tracking records	Sampled custody logs and carrier tracking numbers matched to media identifiers. Finding: tracking records exist for some shipments but not for hand-carried media.
Evidence finality	Whether the records presented are final, approved and dated	Signed logs and approved procedures. Finding: access logs or custody sheets are drafts, unsigned or reconstructed after the assessment began.
Scoring effect	How the result is recorded for 3.8.5	The requirement is worth 1 point. It is MET only when all applicable objectives are satisfied with final evidence. Confirm current scoring and POA&M rules against the rule text before relying on them.

Building custody control for CUI media in a sequence the auditor can follow

This sequence turns MP.L2-3.8.5 from a policy statement into a set of records that show who controlled each piece of CUI media, who approved its movement, and how its transfers were tracked from start to finish.

Inventory CUI media and transport paths
Start by listing every type of media that holds CUI, including paper, laptops, external drives, tapes and backup media, and map each path media takes when it leaves a controlled area, such as couriers, carriers, field offices or subcontractor sites. Assign each item an identifier and a named owner. The output is a media inventory with a transport path map that the assessor can compare against your system security plan. Confirm that the inventory matches the scope you documented for the assessment.
Define checkout and transport approval roles
Write down who may check media out of a controlled area and who must approve each transport, and separate those roles where your staffing allows. Tie approval authority to the data owner or a designated custodian, and record the names and roles in a procedure that staff can find. The output is an approved access and approval matrix, signed off by management. Assessors commonly ask how the people on this list were chosen and whether the list is current.
Set handoff and sealing rules
Define how media changes hands: who signs it out, what packaging or tamper-evident seals are required, how seal numbers are recorded, and what the receiving party must check on arrival. Cover exceptions such as hand carry, emergency moves and transfers to subcontractors. The output is a written handoff procedure with a seal log template. Confirm with your legal or contracts team that any transfer to an outside party is also covered by the relevant agreement.
Select tracked shipment and receipt methods
Choose carriers or internal courier methods that provide tracking, signature on delivery and proof of receipt, and decide when a hand carry is acceptable. Document the tracking number or chain-of-custody form for each shipment type. The output is an approved shipping method list with the evidence each method produces. Ask the carrier what tracking and signature records it retains and for how long, because you will need those records during the assessment.
Record every transfer in a custody log
For each movement, record the media identifier, date, sender, recipient, destination, approval reference, seal number, tracking number and receipt confirmation. Use a single controlled log, whether it is a spreadsheet, a ticketing queue or a GRC tool, and restrict who can edit it. The output is a complete custody log in which every transfer has both an outbound and a receipt entry. Gaps between outbound and receipt entries are the first thing an assessor will look for.
Review custody logs on a set cadence
Assign a reviewer who is independent of the people who move media to check the custody log on a fixed schedule, reconcile open transfers against receipts and investigate any missing or late confirmations. Record each review with its date, reviewer and findings. The output is a dated review record that shows the control operates over time, not only on the day of the assessment. Confirm the cadence you choose in your own policy and keep the review records in final form.

Evidence that passes for media access and custody during transport

An assessor testing MP.L2-3.8.5 looks for two things: proof that access to CUI media is controlled, and proof that custody is kept while media moves outside controlled areas. The cards below are the artifacts that show both, and each one must be current and in final form when the assessment happens, not reconstructed afterward.

Media inventory tied to CUI

A current register of every removable drive, tape, optical disc and portable device that holds or has held CUI, with a unique identifier, owner, storage location and the data classification it carries. Assessors use it as the starting point for every custody test, so a device missing from the register is an immediate question. Update it at each check-out, return and disposal, and reconcile it against physical counts at a set interval you define in policy. Open-source asset tools such as GLPI (GPL-3.0-or-later) can hold device records and the Wazuh Syscollector module (GPL-2.0-only) can collect endpoint inventory that supports this register, but neither replaces a physical media log. Confirm coverage for each device type you use.

Check-out and access approvals

Records showing who requested each piece of CUI media, who approved the request, the purpose, the date and the return date. For the access objective, an approval should trace back to an authorized user and to the data owner's permission where your procedures require it. Check that approvals exist before the media left the controlled area, not after. Keep the approval history linked to the media identifier so an assessor can follow one device from request to return without gaps.

Custody records for each transfer

A transfer log entry for every handoff, recording the sender, recipient, media identifier, time, and either a signature or an authenticated system entry. Paper logs should be signed at the time of transfer and scanned into the record under your retention rule. System entries should show the user account that made the change. A gap between two handoffs is the most common finding, so require a receiving signature before the sender closes the entry.

Carrier tracking and proof of delivery

For media sent by courier or postal service, keep the tracking number tied to the media identifier, the shipping date, the carrier's delivery scan and the signed proof of delivery. Confirm that the package used approved packaging and an agreed method, and record any exception such as a lost or delayed shipment and the steps taken. Carrier portal screenshots alone are weak evidence, so export and retain the delivery record itself. Ask your carrier which proof-of-delivery records it keeps and for how long.

Access logs for media stores

Logs from the locked cabinet, safe or room where CUI media waits between uses, showing each entry by an authorized person, the time and the purpose. Badge and key logs should match the custody records, so an assessor can test whether a person who opened the store also appears in a transfer entry. Review these logs on a regular schedule and record the reviewer's sign-off. Where access is recorded electronically, confirm that the logs cannot be edited by the people whose access they record.

Procedures that define the process

Written procedures for media check-out, transport, custody handoffs, shipping, loss reporting and inventory reconciliation, with a named owner and a revision date for each. Assessors use these to decide whether the records above follow a defined process or happened ad hoc. Each procedure should name the records it produces, so the evidence and the rule stay linked. Review the procedures after any change to shipping vendors, storage locations or systems, and keep prior versions for the period your assessment cycle requires.

What meeting MP.L2-3.8.5 costs in money and effort

This table breaks down the cost and effort components of keeping custody and accountability for CUI media during transport, showing who is paid, whether each cost is one-time or recurring, and what moves it up or down. No prices from the supplied research apply, so use the right-hand column to decide what to request in quotes from carriers, vendors and advisers. The main takeaway is that tooling licence spend is often the smallest part of the cost, while custody handling and log review recur for as long as CUI moves on media.

Cost component	Who is paid or who bears it	One-time or recurring	What drives cost up or down
Encrypted or tracked media and carrier services	Media vendors and couriers; tracked or signature-required shipping is billed per shipment or per contract	Recurring per shipment, plus one-time purchase of encrypted drives or cases	Shipment volume, distance, signature and tracking tiers, and whether encryption on the media is already in place (see MP.L2-3.8.6)
Custody and inventory tooling	Internal IT, or an implementation partner for configuration; open-source licences carry no licence fee	One-time setup, then recurring hosting, patching and maintenance	Number of media items tracked, integration with asset inventory, and whether the platform is hosted in your own cloud or data center
Staff time for custody handling and log review	Internal staff, custodians and reviewers, sometimes a managed service provider	Recurring for every transport event and periodic review	Transfer frequency, number of custodians, whether handoffs are logged electronically, and how quickly exceptions are reviewed
Procedure writing and training	Internal compliance or security staff, or an outside consultant for drafting	One-time drafting, with periodic refresh and retraining	Number of sites and carriers, how many roles touch media, and how often procedures change
External review or testing (optional)	Independent reviewers or testers, billed against a written scope	Optional, one-time per engagement, may repeat before assessment	Scope of transport paths tested, number of sampled shipments, and whether reviewers also test related controls
Auditor sampling effort	Assessor time is billed by the assessor; your team supplies records and staff time	Recurring at each assessment or self-assessment cycle	Number of transport records requested, completeness of custody logs, and whether evidence is in final form at review

Who owns MP.L2-3.8.5 and what an implementation partner can take on

Your organization owns MP.L2-3.8.5. The requirement asks for control over access to media that holds CUI and for accountability while that media is transported outside controlled areas. Those decisions belong to people who answer for the contract and the CUI, so they cannot be delegated to a vendor. Your team also has to run the process every day, because custody records only mean something if the people handling media use them consistently.

Transport approval: Named owners decide which CUI media may leave a controlled area, for what purpose, and by which route.
Custody records: Staff sign media out and in, and the custodian of each item is always known.
Tracked shipments: Your logistics or courier arrangements provide tracking and proof of delivery for media in transit.
Log review: Someone accountable reviews custody logs, inventory exceptions and shipment records on a set schedule.
Policy and training: Written procedures reflect how your staff actually work and are trained on them.

Before any assessment, confirm that each control has a named owner, that the procedures are approved and dated, and that records exist for real transport events rather than only for a sample.

Where MP.L2-3.8.5 gaps usually appear and how to close them

Most MP.L2-3.8.5 findings are not missing policies. They are records that were written late, handoffs that never happened, and inventories that drifted from reality. The cards below cover the gaps assessors most often find in media accountability and the concrete action that closes each one.

Custody records written after the fact

Teams often reconstruct who held a drive or tape from memory once an assessor asks. Assessors look for records made at the time of each transfer, with the media identifier, the sender, the recipient and the date. Close the gap by requiring the custody entry before the media leaves the controlled area, and by keeping a timestamp in the record system so that back-dating is visible. Check a sample of past transfers against the entries to see whether they match.

Media leaving with no handoff record

A USB drive or backup tape walks out of a server room in a colleague's bag with no entry anywhere. This is the most direct failure of accountability during transport outside controlled areas. Close it by making a signed handoff a step in the transport procedure, with the courier or recipient confirming receipt. Walk the building exits and loading areas to find where media actually leaves, then tie those points to the handoff step.

Inventories that do not match circulation

A media register may list ten encrypted drives while twelve are in use across several sites. The register then fails as evidence because it does not reflect what is in circulation. Close the gap by reconciling the register against asset discovery data on a fixed schedule. GLPI can hold the media register as assets, and Wazuh Syscollector inventories endpoints, so you can compare what is recorded with what is connected. Confirm that your tools cover removable devices before you rely on them.

Logs that are still drafts

Custody logs kept in personal spreadsheets or unsigned forms are often drafts that people edit at will. Assessors need evidence in final form, so a log that can be changed silently does not satisfy the requirement. Close the gap by moving logs into a controlled system with restricted edit rights, version history and a named owner who approves periodic reviews. Ask whether the log is locked after each entry and who can alter earlier rows.

Carrier services without tracking

Media sent by ordinary post or a courier account with no tracking number leaves the organization with no chain of custody. Tracked and signed delivery shifts the evidence to the carrier, but only if the tracking number is recorded in your custody log. Close the gap by requiring a tracking reference and signature confirmation for every shipment that contains CUI, and by storing the carrier record next to the internal entry. Confirm the carrier's proof-of-delivery terms in writing.

Personal devices used for CUI transport

Staff sometimes carry CUI on personal phones, home laptops or personal USB drives when no approved option is available. These devices are outside the inventory and outside the custody record, so no accountability exists. Close the gap by stating in writing which transport methods are approved, blocking unapproved devices on endpoints where your tools allow it, and reviewing exceptions. Ask your team to name every device type that could carry CUI and check each one against the approved list.

How much effort MP.L2-3.8.5 takes and whether a team can do it alone

How much effort does MP.L2-3.8.5 take in a typical environment?

The effort depends on how many people, media types, sites and transport routes touch CUI outside controlled areas, more than on the requirement's single point. Drivers include the number of portable drives, tapes and backup media in use, whether shipments go by courier or by staff, how many locations hold CUI, and how much custody history already exists. Setup work is largely one-time: writing the custody procedure, building log templates, setting up carrier terms and training staff. Recurring work is logging each movement, reviewing logs and handling exceptions. Before estimating, list every transport path that leaves a controlled area, because each path needs its own accountability record.

Can an in-house team meet MP.L2-3.8.5 without outside help?

An internal team can do this work if it has one person who understands the two assessment objectives, owns the media inventory and can enforce the procedure across shifts and sites. The objectives cover controlling access to media containing CUI and keeping accountability for that media during transport outside controlled areas. Gaps tend to appear in practice: couriers without agreed handoff terms, custody records kept in personal spreadsheets, or staff who skip the sign-out step under deadline pressure. Teams often underestimate the time needed to review their own evidence objectively. Outside help is most useful when no one internally can write the procedure or test whether the records would satisfy an assessor.

What people and carrier relationships does media custody require?

Media custody needs named people, not just a policy. Most organizations assign a custodian at each site who holds keys and signs media out and in, an approver such as the data owner or security lead who authorizes each movement, and a records owner who keeps the logs complete. Carrier relationships also need attention. An approved courier or carrier agreement should specify tracking, signature on delivery, handoff steps and notice of exceptions, so the custody chain survives the journey. Storage areas need key and badge control so custodians can show who had access. Document these delegations in writing, because an assessor will ask who was responsible for each step.

How long does it take to prepare evidence for MP.L2-3.8.5?

No fixed duration applies, because preparation time depends on scope and on the records you already keep. If custody logs exist and cover a meaningful period, preparation is mostly review, gap closure and a check that each entry is complete. If no records exist, you must design the procedure, run it in daily operations and accumulate records before they can show consistent practice. Assessment guidance treats a requirement as MET only when all applicable objectives are satisfied with evidence in final form, not drafts, so the operating period matters. Ask your assessor or the Cyber AB-authorized assessor what history they expect before you schedule an assessment.

What does an implementation partner do for MP.L2-3.8.5, and what does it not do?

DeployOpen plans, implements and documents systems and evidence inside the client's own infrastructure, under a fixed scope agreed in writing. For this requirement, that can include helping define the custody procedure, setting up asset records for media devices in a tool such as GLPI, configuring monitoring where it supports the control, and organizing the evidence for review. DeployOpen does not own the controls, act as the media custodian, decide whether the requirement is met, or issue reports or certificates. Only an independent assessor or certification body issues those. The organization remains accountable for operating the procedure every day.

What changes for MP.L2-3.8.5 if CMMC Phase II is reinstated?

On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. A 60-day review by a CMMC Reform Task Force followed. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The control itself does not change, since Level 2 still follows NIST SP 800-171 Rev. 2 and requirement 3.8.5. What would change is the form of assessment: a certification assessment by a C3PAO. The DoW CIO page and the eCFR text can differ on the schedule, so confirm the current status with the Department before planning.

How DeployOpen scopes and prepares MP.L2-3.8.5 evidence

DeployOpen works on MP.L2-3.8.5 as a fixed-scope implementation partner: we prepare the systems, custody procedures and evidence that show access to CUI media and transport accountability are controlled. Your organization owns the control, and only an independent assessor can judge whether it is met.

How we scope

Agree in writing which media types, transport paths and controlled areas fall under CUI handling for MP.L2-3.8.5.
Map where custody records, shipment logs and access records for CUI media are created today and who keeps them.
Confirm the assessment objectives for access control and transport accountability, and list the evidence each one needs.
Document scope, deliverables and timelines in a written agreement before any work begins.

How we build

Set up or configure tooling that records CUI media inventory, assignments and custody changes in one place.
Draft custody, check-out, transport and courier procedures that match the systems your staff actually use.
Test media storage and transport mechanisms with staged handoffs to confirm records are complete and retrievable.
Review each record for final form, since drafts do not count as evidence for an assessment.

How we hand over

Deliver the custody procedures, inventory exports, sample transport logs and configuration documentation as client-owned files.
Provide a short evidence index that maps each artifact to the MP.L2-3.8.5 assessment objective it supports.
Walk your compliance and operations staff through the records so they can run the process after handover.
Flag gaps we find, with suggested remediation, so your organization decides what to fix before an assessment.

How we support

Ongoing support, upgrades and periodic re-testing of media accountability records are available as a retainer.
Confirm with your assessor or Registered Practitioner which evidence they accept before we finalize the package.
Ask any quote to name the written scope, the platforms covered and which deliverables are one-time versus recurring.