03.08.01 Media storage
Physically controlling and securely storing digital and non-digital system media that contain CUI, from flash drives and tapes to paper.
03.08 Media protection
Rev. 3 media protection requirements for digital and non-digital media that contain CUI: storage, access, sanitization, marking, transport, restrictions on media use and encryption of backups.
03.08.02 Media access
Restricting access to CUI on digital and non-digital system media to authorized personnel or roles.
03.08.03 Media sanitization
Sanitizing system media that contain CUI before disposal, release out of organizational control or reuse. Rev. 3 folded Rev. 2's 3.7.3 (sanitizing equipment removed for maintenance) into it.
03.08.04 Media marking
Marking system media that contain CUI with distribution limitations, handling caveats and the applicable CUI markings.
03.08.05 Media transport
Protecting and controlling media that contain CUI during transport outside controlled areas, keeping accountability for them in transit and documenting transport activity.
03.08.07 Media use
Restricting or prohibiting defined types of system media, such as external drives or flash drives, and prohibiting removable media without an identifiable owner. Rev. 3 folded Rev. 2's 3.8.8 into it.
03.08.09 System backup: cryptographic protection
Protecting the confidentiality of backup information and encrypting CUI at backup storage locations; drawn from the contingency planning family, which Rev. 3 otherwise leaves out.
